At present, the UK does not have the data breach notification laws that exist in the US and some other countries and so there is no imperative for businesses to have policies and procedures in place for reporting, according to Robert Bond, head of intellectual property, technology and commercial practice at City law firm Speechly Bircham LLP. “However the lack of breach notification law is not a reason to ignore the need to put in place crisis management practices. Leading insurers like Hiscox and AIG are all insisting that data-loss policies and procedures are mandatory if businesses want insurance cover.”

The UK government is currently debating the introduction of data breach notification laws to match similar legislation that exists in over 40 states in the US. The US government is also considering the introduction of nationwide data breach notification legislation to provide harmony in reporting between the states. But despite the growing international backing for legislation that forces companies to be more open about breach incidents, not everyone is convinced it makes sense.

“Take the prison database that fell out of someone’s hands: did it do anybody any good to know data was lost? I don’t know,” says former FBI agent and now Microsoft chief security advisor Ed Gibson.

If the incident was accidental, as in the case of the HMRC breach, then there is less pressure to report. However, if the data was stolen by an employee then companies may want to take steps to have that individual prosecuted unless the incident is small enough that a mere dismissal will suffice. However, if it is discovered through computer forensics or other means that the data was stolen by an external party, then there may be little choice but to involve the law. “There are companies in the UK, let there be no doubt, that have been blackmailed and extorted that we never hear about,” says Microsoft’s Gibson.

After the initial fire-fighting has died down, attention will inevitably turn to working out what went wrong.
“Many of us think when something like that happens: ‘let’s fire the guy’,” says Gibson. “But let’s say you have got a government employee who lost a USB device and that person happened to be a pilot and received hundreds of thousands of pounds of training and he or she was just doing their job... You want to fire that guy?”

Rather than negligence, many recent data breaches can be traced to a basic lack of training – one of the conclusions of the Poynter review into the HMRC incident. “Time and again we have seen that staff are clearly incapable of handling confidential documentation, proving that it is not the technology but the human element that is fallible,” says Richard Millett, head of security at Firebrand Training.