Intellectual Property Law

Personal Data Should be Handled Like Spent Nuclear Fuel

By IBLS Editor

Private data is so dangerous and volatile if mishandled and its power to damage lasts so long that one author claims it needs to be viewed like "Hot Nuclear Waste." Personal information is precious to those to whom it belongs to, highly damaging to their security and future prospects if exposed and needs to be treated as if it is a dangerous threat to all of society when not handled with the utmost care and respect. Since the Internet age is still developing we have yet to develop all the cannons of ethics and disciplines of procedure that future generations will take for granted. But the time has come to draw up these industry-wide data care rules of thumb and back them up on the Government side with harsh laws that will even include long jail stretches for worst case scenarios.

Tech writer Cory Doctorow says, "We should treat personal electronic data with the same care and respect as weapons-grade plutonium - it is dangerous, long-lasting and once it has leaked there's no getting it back." Britain has had several spectacular data loss incidents in the last year due to Government mishaps that have exposed up to half the island's residents, measuring 37 million, to privacy loss and there are no announced plans for how to deal with the issue. When one loss occurred involving the personal and financial information of 25 million persons, critics termed it a "Privacy Chernobyl." (Covered here in a recent IBLS artcle: Continuing Data Loss Debacle Creates UK Government IT Circus )

While most data is innocently collected, the broader issue is whether the companies collecting private information are really going to protect these personal details as if it were their own. Many do not. Therefore, a new set of standards must be established that puts explicit directives on exactly how data must be collected, stored and disposed of. Further, companies must be encouraged to minimized their demands on how much data is needed to process everyday transactions. Businesses themselves have as much to lose as private citizens in data loss debacles.

According to a study by Pepperdine University, the costs of data loss are very high for both individuals and companies. For example, the paper claims, "One study reports that a company that experiences a computer outage lasting for more than 10 days will never fully recover financially and that 50 percent of companies suffering such a predicament will be out of business within 5 years." And while the data is recoverable in 83% of cases, the costs of retrieving lost data is high, as well.

A typical computer specialist trained to retrieve lost data will make a minimum of $30 or more an hour. The average amount of time spent for each retrieval is 6 hours, meaning the data re-capture will cost almost $200 in outsourced tech work. But companies report what is spent may be as high as $340 per incident. The insurance company, Darwin Professional Underwriters used a sophisticated tool to analyze a security breach of 46,000 persons and found it would extract from an organization $7.6 million on average for a breach that large. Pepperdine estimates it cost U.S. businesses nearly $20 billion a year in lost data, all factors considered, in 2004.

The true impact of the 17% of data that cannot be retrieved is staggering as well. Sometimes it takes hundreds of man-hours and months to recover or reconstruct, and companies can expend millions of dollars doing so. The study notes, "The value of 100 megabytes of data is valued at approximately $1 million, translating to $10,000 for each MB of lost data. Using this figure, and assuming the average data loss incident results in 2 megabytes of lost data, one can calculate that such a loss would cost $20,000. Factoring in the 17 percent probability that the incident would result in permanent data loss, one can further predict that each such data loss would result in? data loss incident to $3,957." They add,  "A survey conducted in 2001 by Contingency Planning Research reports that the majority of companies estimate the average cost of computer network downtime to exceed $50,000 an hour, and for some companies that figure rises to over $1,000,000 per hour."

The Poneman Institute just released a study showing that in 2005, companies spent nearly $5 million on average, and 30% more to recover when corporate data was lost or stolen. Further, much data loss is totally avoidable, given the prevalence and inexpensiveness of backup systems, where even a terabyte ? 1,000 gigabytes -- of storage can be had for under $500 these days. The 2006 "Cost of Data Breach Study," released last September, shows that, "the main culprit for data loss in 49% of the cases is a lost or stolen laptop, desktop, PDA or thumb drive."

Clearly, much of what goes missing in data breaches is preventable. Sometimes the victim is business work and the expense and toil of regaining what has been lost or living without it is massive, especially considering how preventable it usually is. But much worse is when the personal and confidential data of innocent, hard working persons has been recklessly or preventably leaked. This results in some poor souls being harmed irreparably and leaves all the rest involved wondering from then on if their financial and personal lives will be destroyed by the radioactive effects of private data being mishandled by some incompetent, untrained or indifferent paper pusher and exploited by some con artist living hundreds or thousands of miles away.

Full post as published by IBLS Internet Law Blog on January 16, 2008 (boomark / email).