The recent controversy over stacks of documents containing personal information on Rogers Communications’ customers being discovered in a downtown parking has once again brought the issue of “client confidentiality” into sharp focus.
Rogers said an employee of a company it hired to sell cable TV and high-speed Internet access, misplaced forms containing the names, addresses, phone numbers, social insurance numbers and driver’s license numbers of around 300-400 people.
The documents were discovered by a bystander in a parking lot near Ryerson University in Toronto.
The blunder underscores inadequate security policies and practices on the part of Rogers, and alerts us to the need for stringent privacy legislation, according to Canadian observers.
“This lack of strict security measures is worrisome for consumers,” according to Joe Greene, vice-president, security research, IDC Canada Inc., in Toronto.
“This breach adds another layer of mistrust,” he said. “Rogers said the forms did not include credit card information, but there was enough data out there to create bogus IDs and run up some bills.”
Rogers said the recovered data would have been stored and eventually destroyed by the third-party firm.
The telecom company characterized the slip as an “isolated incident” that is being “investigated internally.”
However, a security expert for a Canadian IT and business process services firm, noted a number of other companies have lost sensitive client information in the recent past.
“This is happening often because Canadian privacy laws have no teeth,” according to Philippe Giroux, director for security solutions, CGI Group Inc. in Montreal.
“We may have the laws,” Giroux said, “but have you heard of anyone being fined or punished?” He said there is “a strong need [to impose] fines and penalties on companies that fail to protect their clients’ personal information.”
Giroux’s concerns echo those made by other analysts and privacy advocates.
The Canadian Internet Policy and Public Interest Clinic (CIPPIC) had rued the absence of clear requirementsfor companies to notify their clients of security breaches.
Last week’s incident, Greene said, could give Rogers a “black eye” if the company is not quick to announce corrective action.
Another Toronto-based analyst agrees.
The best move for Rogers, at this moment, would be to “investigate the incident and come out publicly with a plan to remedy the situation and prevent another breach,” according to Stefan Dubowski, managing editor of Canadian telecom research at Ottawa-based Decima Reports Inc.
Some three year ago, Dubowski recalled, the BMO Financial Group faced potential disaster when two of its discarded servers containing customer data ended up on the online block at eBay.
However, Toronto-based BMO claimed it won back customer confidence by contacting affected customers immediately and taking steps to remedy the situation.
IDC’s Greene said the Rogers incident was most probably “the result of poor security procedures.”
He said if a firm wanted to get rid of its data, it could either “destroy the information internally” or make sure a third-party hired to do the job was “under close supervision.” While Rogers blamed an employee of a third-party firm, Greene said the “ultimate responsibility for what happens to its clients’ information” is with Rogers.
Giroux said many companies hire a third-party to handle their data to cut costs and free up internal personnel for business-oriented tasks. “This could be an effective strategy, but it adds another layer of complexity to data management,” he said.
For companies that choose to get outside help for data management and destruction, Giroux has the following advice:
• Develop an internal security policy – Map out a comprehensive data management plan that protects both your company and your clients;
• Devise an information asset classification system – Differentiate the types of data in your possession, and develop appropriate means of dealing with each type;
• Get appropriate departments involved in security planning – Make sure the IT security and privacy departments are aware of data that the company is handling and;
• Check out the third-party – Do a background check on any outside company that touches your data. Determine if the company passed an audit from a neutral organization or was it was involved in security slip.
QuickLink 071897