Security: your PDA could land your boss in court.

This article explores liability under the Data Protection Act in relation to mobile devices - particularly where company data is being used on private devices. This is no longer just a security issue - it is a legal issue with a potential criminal conviction at stake. The biggest problem is the PDA. Sometimes these devices belong to the company, sometimes to the employee. But they are personal digital assistants - and whoever owns them, are used in a personal manner. Consequently they frequently fall outside of the corporate security policy, because they are not treated as company property. If staff aren't told where they can drive their company car, why should they be told how to use a few hundred pounds worth of PDA?

PDAs are serious computers

But PDAs are no longer simple electronic aide memoires - they are small computers of increasing power and sophistication. The current crop of Palm Pilots has a memory capacity of 8 MB and can store 10,000 addresses, 400 e-mails, and 3,000 documents with notes. They are carrying more and more corporate data, more and more personal data - and are more and more a popular target for theft. The only solution to all of these `threats' is encryption. Encryption is clearly the way to protect communications. It won't stop eavesdroppers (whether government - sponsored Echelon, profit-driven industrial spies, or good old hackers) from intercepting your messages - but it will stop them gaining anything useful from them. But encrypting communications is no longer enough you also need to encrypt the data stored on the PDA to keep on the right side of the law. PDAs are easily stolen and lost as was recently illustrated by Taxi Newspaper and Pointsec Mobile Technologies in a survey which found that a staggering 2,900 laptops, 1,300 PDA's and over 62,000 mobile phones had been left in London's licensed taxi cabs in the past 6 months. And unless the data on these devices is encrypted, it could not only prove very costly but also result in a criminal conviction. What is happening to laptops today will happen to PDAs tomorrow. The number of high profile laptop thefts is frightening, and growing. In the USA, a computer insurer has estimated that 5% of all laptops are stolen within their first 12 months of service. Last year the Daily Mirror reported that at least 37 UK government laptops had been lost or stolen since 1997. We have to wonder just how many unreported thefts actually occur.

However, while it is clearly advisable to encrypt the data stored on your Palm, it may, within the European Union, in fact be a legal requirement. Palm Pilots are frequently used to store company contact information. This is likely to include a home address, mobile phone number and even home phone number. In other words it is likely to include personal information that needs to be registered under the Data Protection Act 1998, and is liable to the strictures of the Act.

The seventh principle of this Act is unequivocal: "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data." First of all it is worth considering who is liable under this Act. The Act states that conformance to the Data Protection Act is the responsibility of the Data Controller. And it says that ... data controller' means ... a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed."

Senior managers are personally liable

In other words, this `person or persons' is effectively the Board and the immediate data processing managers. One thing it isn't is the person who `owns' the computer/PDA. You could say that if the data is on the PDA by company assent, then it is the company that is determining the purposes for and manner in which it is to be processed - and it is therefore the company that is liable. Therefore, if your PDA gets into the wrong hands it could land your boss in court. But if the data is on the PDA without company assent, then the company has already broken the Data Protection Act by failing to protect "against accidental loss or destruction of, or damage to, personal data", that is, it has `broken' the seventh principle. "if it's company data being used by an employee on company business, then the company in principle controls it (through the employee's duties of fidelity, following the rulebook, etc) and must make rules (and provide systems) that protect it from unauthorised use or disclosure. The rules might say, for example, that if employees carry company data on their own PDAS, they must use encryption to protect it. The employee is of course responsible for implementing the rules, but is probably responsible to the employer rather than directly to the Commissioner," explains Nicholas Bohm, a consultant to the E-Commerce Group of City law firm Fox Williams. In other words, the company is still liable!

Quite simply, there is no way round this - if employees use PDAs that include contact information, the company is liable to the conditions of the Data Protection Act. And, once again, it is worth considering the wording of the Act itself: "Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of or to be attributable to any neglect on the part of any director, manager, secretary or similar officer of the body corporate or any person who was purporting to act in any such capacity, he as well as the body corporate shall be guilty of that offence and be liable to be proceeded against and punished accordingly." That means you Mr Company Director!

Now, what actually constitutes appropriate technical and organisational measures is something that ultimately can only be defined by the Courts - but it would be best not to let it get that far. It seems fairly clear that organisational measures' could be covered by a formal written and enforced security policy designed to protect the PDA and its data. But appropriate `technical' measures is more difficult. If we were talking about the corporate mainframe, then we would obviously be thinking about a firewall. Vendors are known to be working on chip-based firewalls that can be built into PDAs - but we're not there yet. So for the Palm Pilot and other PDAs we need something else - and all we've really got is encryption.

Be safe - encrypt!

Encrypted data is safe data. Confidential information is hidden from industrial spies and hackers alike. This is an advisable although not compulsory course of action. However, if the PDA contains contact information, then you must seriously consider its liability under the Data Protection Act. In this case, encryption is almost compulsory.

Strong wireless security devices are being used by companies more frequently than ever before with products such as Pointsec for Palm OS which combines access control with encryption for mobile devices. It now means organisations can have one security system which protects a range of handheld computers, laptops and PC's from unauthorised users as well as keeping companies compliant with EU and UK legislation. Thus putting an end to embarrassing and potentially damaging leaks of information from wireless and potentially landing the company on the wrong side of the law.

Are you businessmen breaking the law? It is generally accepted that the majority of people and companies have never bothered to register with the Data Protection Registrar, even when it is very clear that they should.

It is not so well known, however, how many people and companies contravene the Data Protection Act through their use (or abuse) of personal data stored on their computers.

The two most important let-offs are that processing of personal information may be carded out

(a.) with the permission of the individual

(b.) in performance of a contract with the individual What does this mean? Well, it implies that you can keep and process personal information on your existing clients. But you cannot (without their permission) maintain and process a database of information on prospects. If you do this, you are probably breaking the law.

But remember that even where the use of personal data is legal, you still need to obey the seventh principle - you need to keep the data secure, and that probably means you need to encrypt it. If you use a PDA to store contact information, you are probably subject to the Data Protection Act, 1998. Within the European Union, the seventh data protection principle requires you to protect personal data with appropriate organisational and technical measures. On a PDA, data encryption is the best technical method to secure personal data.

Magnus Ahlberg, Pointsec Technologies Ltd