Request for comments 

*Key* 
<T> = title 
<ST> = Subtitle 
<R> = Recommendation

  
  <T> Security of data

<ST>InstitutionalFramework for Data Security

  A data subject may apply to the court for compensation if he/she 
has suffered damage (financial loss or physical injury, and possibly 
associated distress) because personal data have been lost or 
destroyed or disclosed without the authority of the data user, or 
access has been obtained to personal data without the authority of 
the user. A court dealing with a claim for compensation will need to 
consider if the institution has taken all reasonable care to prevent 
the particular loss, destruction, disclosure or access.

HE and FE institutions are obliged under the 1998 Act to have in 
place an institutional framework designed to ensure the security of 
all personal data during the collection to destruction cycle. A key 
current international benchmark for Information Security 
Management Systems (ISMS) is BS7799.  A framework that 
meets this standard will provide a high level of compliance with the 
1998 Act.  Where complete compliance with BS7799 is infeasible 
or unreasonable for all, or certain types of, institutional personal 
data processing operations, certain minimum standards should still 
be met.

Such standards should ensure:

 - a level of security appropriate to the risks represented by the 
processing and the nature of the data to be protected.

 - that data security is assured no matter where or by whom data is 
stored or processed and throughout the whole procedure, including 
the transmission of data.

 - that there are clear lines of responsibility and the controller's 
ultimate responsibility for data security is clearly understood. 

<R>HE and FE institutions should, as a minimum, ensure that:

 - wherever possible, data are de-personalized, or coded, or 
encrypted, with any key being kept securely. 

 - Existing and proposed personal data processing operations are 
evaluated to ascertain and evaluate all potential risks in order to 
determine the cost, effectiveness and practicability of proposed 
levels of security.

 - Appropriate levels of security are applied, commensurate with the 
anticipated risks, and appropriate to the type of personal data held.

 - Agreed levels of security are applied, monitored and regularly 
reported upon as regards their effectiveness 

 - All staff are trained to take effective action to protect life, data 
and equipment (in that order) in the event of disaster.

 - Competent people are assigned to be responsible for the 
accuracy and integrity of personal data held in each part of an 
institution’s personal data processing operations.

<ST>Employees and Student Security Training and Management

A primary part of any HE or FE institution’s personal data security 
framework will be the effective training and management of its 
employees and students in necessary security procedures.  A 
significant proportion of unauthorised disclosure of, and access to, 
personal data occurs because employees and students are 
unaware of, or fail to adhere to, existing institutional guidelines.  
The potential consequences under the 1998 Act for institutions of 
unauthorised disclosure of, and access to, personal data are such 
that it is essential to both culture an institutional awareness of data 
privacy rules, and to provide a verifiable mechanism for sanctions 
for breach of those rules. 

<R> HE and FE institutions should ensure that:

 - Employees and students dealing with personal data are aware of 
the purposes for which the data has been collected, including the 
parties to whom disclosure may legitimately be made, and are 
aware that disclosure may not be made to other parties, unless 
one of the exemptions in the Act applies.  

 - Employees and students dealing with personal data have a 
formal point of contact within the institution, such as a Data 
Protection Officer, where they can refer requests for disclosure 
under one of the exemptions in the Act (e.g. law enforcement)

 - Employees and students dealing with personal data are aware 
that their access to personal data is for specified authorised 
purposes only.  Institutional regulations should provide that access 
to personal data by employees and students for unauthorised 
purposes (e.g. browsing of personal data) will be a disciplinary 
offence 

 - Employees and students are aware that casual access to 
personal data by unauthorised persons (e.g. members of the 
general public having access to personal data via VDU screens or 
printouts), by act or omission, should not be permitted.  
Institutional regulations should provide that acts or omission that 
lead to unauthorised access or disclosure to unauthorised persons 
will be a disciplinary offence.

 - Reasonable access control mechanisms, including where 
appropriate the use of passwords, encryption, compartmentalised 
access and access logs, are used to detect and prevent attempts 
to access computer files through terminals or computer networks 
without authorisation. Institutional regulations should provide that 
failure to adhere to the correct use of applicable access control 
mechanisms will be a disciplinary offence.

 - Basic security steps are taken to ensure that building perimeters 
and internal sensitive areas are secure, and that the general public, 
unescorted visitors, and unauthorized personnel be restricted from 
areas where personal data is used. 

 - Existing security controls are reviewed for improvement or 
modification and that awareness programs, as well as policy and 
guidelines be established to protect personal data.

<ST>Vendors, contractors, and suppliers

Vendors, contractors, and suppliers are often required to have 
access to areas in which personal data may be stored or 
processed.  In certain circumstances, it may also be necessary to 
allow contractors access to personal data (e.g. computer 
engineers) in the course of maintenance or repair work.

<R> HE and FE institutions should ensure that contractors are:

 - Controlled, documented, and required to wear some form of 
identification 

 - Restricted from unnecessary admittance to areas where personal 
data is held or processed

 - Required to sign nondisclosure agreements where access to 
personal data is unavoidable
    
<R> HE and FE institutions should ensure that vendors and 
suppliers are:

 - Controlled, documented, and required to wear some form of 
identification 

 - Escorted throughout the general premises by the person they are 
visiting 

 - Restricted from unnecessary admittance to areas where personal 
data is held or processed

<R> Employees and students should be advised to challenge, or 
report to security, individuals found in areas where personal data is 
held or processed without proper credentials.

<ST> Transfer of personal data

Reasonable precautions must be taken when transferring personal 
data in either hardcopy or electronic form.  HE and FE institutions 
should not assume that documents transferred by electronic 
means (e.g. e-mail, WWW, FTP) are secure, and thus information 
containing personal data, and in particular sensitive personal data, 
should be encrypted before transmission. 

<R> HE and FE institutions should ensure that personal data is 
transferred under conditions of security commensurate with the 
anticipated risks, and appropriate to the type of personal data held

<ST>Employee and student use of personal data on home 
computers or at remote sites.

Employees and students should take particular care when laptop 
computers or personal machines are used to process institutional 
personal data at home or in other locations (e.g. in public places, 
or on public transport) outside the institution.

<R> Employees and students should be required to ensure that 
when processing institutional personal data at home or in other 
locations:

 - they take reasonable precautions to ensure that the data is not 
accessed, disclosed or destroyed as a result of act or omission on 
their part.

 - they have an up-to-date virus scanning program installed on 
laptop computers or personal machines and scan all disks for 
viruses prior to loading.

 - they back up system hard drives to avoid loss of data.

 - they report all computer security incidents including virus 
infections to the institution

 - when using laptops they:

 -- keep the laptop constantly in view when travelling, especially in 
airports;

 -- store the laptop in the boot of an vehicle in which it is left 
unattended

 -- do not check the laptop as baggage unless it is placed inside 
luggage that has been locked

 -- record the model number and serial number of each hardware 
component associated with the laptop and keep this information in 
a separate location

 -- notify the institution immediately in the event of loss or theft 

<ST>Back-upof personal data

  Loss or destruction of personal data may have severe 
consequences for the operations of HE and FE institutions, in 
addition to their incurring liability to individuals who have suffered 
damage or distress as a result of the loss or destruction of their 
personal data.  Disaster recovery plans are thus an essential part 
of any institutional data protection framework.

<R> HE and FE institutions should ensure that:

 - A workable disaster recovery mechanism is in place for all 
personal data processing operations where it would be reasonable, 
by virtue of the importance of the personal data, for such a 
mechanism to be implemented. 

 - There are provisions for frequent back-up or duplicate copies of 
all personal data produced in personal data processing operations 
at an institution to be made, and securely stored, in a location 
wholly separate from that of primary data source (e.g. off-site). 

 - There are designated personnel tasked with the responsibility of 
ensuring the recovery of personal data, and establishing its 
accuracy and integrity, within a reasonable time following any 
disaster.

<ST>Migration or upgrade plans

  Changes to an institution’s hardware or software systems may 
result in personal data becoming inaccessible or unreadable due to 
incompatibility between data formats meaning that the institution 
cannot properly ensure the data’s accuracy and integrity.  

<R> HE and FE institutions should ensure that:

 - future migration or upgrade plans for institutional systems are 
documented to address the potential effect of hardware, software 
and operating system upgrades, or obsolescence, on personal 
data processing operations.

 - Successful data transfer tests of existing personal data to new 
systems or file formats are carried out before those systems go 
live, and old systems are discarded

<ST>Disposal of Data

  The proper disposal of personal data should be the final element in 
an institutional framework designed to ensure the security of 
personal data.  The method of disposal should be appropriate to 
the sensitivity of the personal data to be destroyed.  The minimum 
standard for the destruction of paper and microfilm documentation 
should be shredding; paper and microfilm documentation 
containing sensitive personal data should be horizontally and 
vertically shredded or incinerated.  The minimum standard for the 
destruction of data stored in electronic form should be reformatting 
or overwriting, and electronic storage media containing sensitive 
personal data should be overwritten to [what] standard or 
destroyed.  
    
<R> HE and FE institutions should ensure that:
    
 - All paper or microfilm documentation containing personal data is 
permanently destroyed by shredding or incinerating, depending on 
the sensitivity of the personal data.

 - All computer equipment or media to be sold or scrapped have 
had all personal data completely destroyed, by re-formatting, over-
writing. or degaussing.

 - Employees and students are provided with guidance as to the 
correct mechanisms for disposal of different types of personal data 
and regular audits should be carried out to ensure that this 
guidance is adhered to.  In particular, employees and students 
should be made aware that erasing electronic files does not equate 
to destroying them.

<R> Where disposal of equipment or media is contracted to a third 
party, HE and FE institutions should ensure that the contract 
contains a term requiring the third party to ensure that all personal 
data is completely destroyed, and permitting the institution to audit 
the third party’s performance of that term at regular intervals



Andrew Charlesworth
Senior Lecturer in IT law
Director, Information Law and Technology Unit
University of Hull Law School
Hull, UK, HU6 7RX
Voice: 01482 466387   Fax:   01482 466388
E-mail: [log in to unmask]


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%