Auditor exposes client information

Firms have been reminded of the need to protect data on mobile devices and
elsewhere after an auditor from Ernst & Young lost a laptop containing
highly sensitive client information.

The names, addresses and credit card details of almost a quarter of a million
Hotels.com customers were on the laptop stolen from a locked car in the US,
according to reports.

In a letter sent to its customers Hotels.com said, ‘The computer contained
certain information about customer transactions with Hotels.com and other sites.
This information may have included your name, address and some credit or debit
card information you provided at that time.’

Such losses are embarrassing, but also have wider implications. Legal experts
said firms have a legal responsibility to ensure the security of their clients’
and customers’ data.
‘In the UK there is a general obligation within the Data Protection Act that a
business must apply technical and organisational measures to guard against
security breaches,’ said Struan Robertson of law firm Pinsent Masons.

Robertson said that firms should encrypt data, and use more sophisticated
safeguards than a simple password. He also advised that staff should never take
laptops off company premises if they contain sensitive data of the sort lost by
Ernst & Young.