Now 3 million L drivers' details 'lost'

[streaky]

Apparently the personal details of three million L-drivers were on a hard drive that was 'lost' by Pearson Vue - an American contractor to DVLA - from their facility in the Iowa. They concern people who took the theory test between September 2004 and April 2007. The details include name, address, telephone number and email address. Pearson Vue provide "computer-based testing solutions".

Remember, the USA does not have any Data Protection legislation, but Pearson Vue adheres to the US Commerce Department's 'Safe Harbor' principles. Clearly, in their case - as with some UK government departments, including DVLNI, this does not include compliance with the Seventh Data Protection Principle: "Appropriate technical and organisational measures shall be taken against ... accidental loss of ... personal data."

Streaky

Edited by streaky on Monday 17th December 18:34

[odyssey2200]

WTF was the data doing in America?

You assume your data is secure.
Then you find out that the Gov't sends it around by post and loses it
Now you find out its actually being sent all over the world FFS!

Does the Data Protection act stand up in the USA or is it open to abuse?

[streaky]

odyssey2200 said:

WTF was the data doing in America?

You assume your data is secure.
Then you find out that the Gov't sends it around by post and loses it
Now you find out its actually being sent all over the world FFS!

Does the Data Protection act stand up in the USA or is it open to abuse?

As I said: "Remember, the USA does not have any Data Protection legislation, but Pearson Vue adheres to the US Commerce Department's 'Safe Harbor' principles. Clearly, in their case - as with some UK government departments, including DVLNI, this does not include compliance with the Seventh Data Protection Principle: 'Appropriate technical and organisational measures shall be taken against ... accidental loss of ... personal data.'" - Streaky

[Peter Ward]

streaky said:

odyssey2200 said:

WTF was the data doing in America?

You assume your data is secure.
Then you find out that the Gov't sends it around by post and loses it
Now you find out its actually being sent all over the world FFS!

Does the Data Protection act stand up in the USA or is it open to abuse?

As I said: "Remember, the USA does not have any Data Protection legislation, but Pearson Vue adheres to the US Commerce Department's 'Safe Harbor' principles. Clearly, in their case - as with some UK government departments, including DVLNI, this does not include compliance with the Seventh Data Protection Principle: 'Appropriate technical and organisational measures shall be taken against ... accidental loss of ... personal data.'" - Streaky

As long as there is a chain of contracts in place between the data owner (DVLA) and the data processor (Pearson Vue) that commits the data processor to manage the data according to EU regulations, then there should be no problem with data going to the US. I assume that such a chain of contracts is in place. In which case, this is simply another case of data being lost while being processed under EU law. As Streaky says, it indicates a lack of concern regarding physical security, which is sometimes the case even when all logical/IT security has been taken care of.

[driverrob]

Even as an experienced but amateur user of computers, I cannot understand the need to send physical copies of sensitive, personal data via a slow and insecure postal system, let alone in the personal possesion of an employee.
Surely (shirley?) it would be better to extract the data, zip and encrypt it then send it over the internet using a private key?

[tigger1]

FishFace said:

How often do they send such data? Not that much I'd imagine. Few enough times to hand-deliver it?

Business class to the US? About £5k?

Cost of having to stand up in HoP and own up to this? Priceless.

SOMEBODY needs a ing rocket.

Actually...although it has got shitty..I'll edit that picture.

Edited by tigger1 on Monday 17th December 19:11

[esselte]

FishFace said:

How often do they send such data? Not that much I'd imagine. Few enough times to hand-deliver it?

Was it actually lost in transit or was it lost "on site"?

[streaky]

Apparently lost on site. Loss was reported in May, so shortly after the data were received (whether on a hard drive or not isn't clear).

It's likely that many of the people whose Personal Data were lost are additional to those affected by the HMRC debacle (i.e under 20, so less likely to be in receipt of Child Benefit).

Streaky

[davidra]

Prevent further abuse of government data by registering your support at http://www.no2id.net/

[Who me ?]

Perhaps now is he time to send a few Cabinet Ministers via some form of Government Postal system and see if they get lost ---although in truth it might be no loss to the UK

[banzai_dan]

I took my theory test about december '05, does that mean that my data is among that lost. Can someone tell me what, if any, actual risk I'm in? Sidesteping all the hysteria that the red tops are parading about.

Oh and, bloody incompetant muppets.

[odyssey2200]

So of all the companies in the UK we had to resort to a US based company to provide the service?

What exactly were they doing with the data?

Edited by odyssey2200 on Tuesday 18th December 13:46

[Piglet]

banzai_dan said:

Can someone tell me what, if any, actual risk I'm in? Sidesteping all the hysteria that the red tops are parading about.

Oh and, bloody incompetant muppets.

Your name, address, email and phone number apparently. Which whilst it might be irritating isn't much more than is on the electoral roll and in the phone book and probable less info than many people post about themselves on websites.

No need to panic...

[Munter]

banzai_dan said:

I took my theory test about december '05, does that mean that my data is among that lost. Can someone tell me what, if any, actual risk I'm in? Sidesteping all the hysteria that the red tops are parading about.

Oh and, bloody incompetant muppets.

Well as I understand it they have your Name, Address, and date of birth, and possibly your driving licence number. To be honest I dont think theres a lot can be done with that data on it's own. But it might help someone start to build up an identity to try and steal. Now they know your name and address they can look you up on facebook and see who you are, who you're friends with etc. Might be lucky and get a maiden name etc.

To be honest it's probably in a skip/rubbish tip or something and will never see the light of day.

[mark69sheer]

Ive just recieved my letter telling me I need to pay for my next years Data Protection act registration...

£34.95

I am not going to renew.. I am way better than the government at keeping my data safe..

Imagine the govt supposedly sticking to the act and then sending data to a country where the act doesn't apply?

yet more mind boggling hypocrisy.

[streaky]

mark69sheer said:

Ive just recieved my letter telling me I need to pay for my next years Data Protection act registration...

£34.95

I am not going to renew.. I am way better than the government at keeping my data safe..

Imagine the govt supposedly sticking to the act and then sending data to a country where the act doesn't apply?

yet more mind boggling hypocrisy.

Oh, dear. Processing Personal Data whilst not registered is an absolute offence. VH, VH, bring your baton and plastic restraints - I see a possible terrorist here, determined to bring down the British establishment! - Streaky

PS - wait a minute, M69S, I'll come with you - S

[driverrob]

[quote=mark69sheer]Imagine the govt supposedly sticking to the act and then sending data to a country where the act doesn't apply?
[quote]

I think that'll be the USA, then. They do have a freedom of information act, though.

[streaky]

Munter said:

banzai_dan said:

I took my theory test about december '05, does that mean that my data is among that lost. Can someone tell me what, if any, actual risk I'm in? Sidesteping all the hysteria that the red tops are parading about.

Oh and, bloody incompetant muppets.

Well as I understand it they have your Name, Address, and date of birth, and possibly your driving licence number. To be honest I dont think theres a lot can be done with that data on it's own. But it might help someone start to build up an identity to try and steal. Now they know your name and address they can look you up on facebook and see who you are, who you're friends with etc. Might be lucky and get a maiden name etc.

To be honest it's probably in a skip/rubbish tip or something and will never see the light of day.

It can also mean in increase in 'spam' and other unwanted email. The price of a confirmed email address is higher than that of an invented one, and so is more likely to be used for directed email.

driverrob said:

mark69sheer said:

Imagine the govt supposedly sticking to the act and then sending data to a country where the act doesn't apply?

I think that'll be the USA, then. They do have a freedom of information act, though.

There are only a handful of countries outside the EU with an equivalent Data Protection law. The toughest of these is Norway. The USA adopted a 'Safe Harbor' scheme that enables registered compliant companies to conform to the essentials of the EU Data Protection Directive and thus process Personal Data under the umbrella Principles. Other ways to address the requirements include enshrining the Principles in a contract between the Data Controller and the Data Processor (and ensuring that sub-contractors to the Data Processor are required to comply too ... a point often missed). Of course, the Register entry must be updated to include the countries to which data are sent for processing ... although there appears to be little critical scrutiny of this by the ICO - Streaky


PS - readers may be amused to learn that the ICO website is currently (and has been for several days) reporting: "The online Data Protection Register is currently unavailable as we are carrying out maintenance work to enhance its security." - S

Edited by streaky on Wednesday 19th December 08:07