Marks & Spencer ordered to encrypt data after laptop theft

This is one of a series of articles appearing on OUT-LAW this week to celebrate Data Protection Day 2008.

The retailer must ensure that all laptop hard drives are encrypted by April of this year. If it fails to comply with an enforcement notice issued against it by the ICO it could face criminal charges.

"It is essential that before a company allows personal information to leave its premises on a laptop there are adequate security procedures in place to protect personal information, for example, password protection and encryption," said Mick Gorrill, assistant commissioner at the ICO. "The ICO has issued clear guidance to help employers understand their obligations under the Data Protection Act."

M&S said that it would not appeal the issuing of the notice, and that it has already started the process of encrypting laptop hard drives. "We will be doing everything we can in order to meet the ICO's deadline," said a spokeswoman for the company. "We started the encryption process in October."

M&S employed a company to change the pension plans of its employees, a process which led to that un-named company having access to 26,000 workers' details. A laptop containing all of these was stolen from the home of the managing director of that company last April.

"The Commissioner takes the view that in this case the personal data held on the laptop computer should have been encrypted so that in the event of its theft it would not have been possible to view the personal data in a readable format," said the enforcement notice. "The Commissioner has come to the view that the data controller’s processing contravenes the Seventh Data Protection Principle in that it failed to take appropriate measures to ensure the security of its data."

The ICO was willing to accept a less formal resolution to the problem, according to the notice, which said it was prepared simply to accept undertakings from M&S that it would comply with the Data Protection Act (DPA).

The enforcement notice, though, said that M&S was not prepared to accept that those undertakings would be made public, which was "not acceptable to the Commissioner", according to the notice.

The notice orders M&S to: "ensure that personal data are processed in accordance with the Seventh Data Protection Principle in Schedule 1 Part I of the Act and, in particular, ensure that the process of laptop hard drive encryption commenced by the data controller in October 2007 is completed by 1st April 2008".