For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Companies urged to maintain privacy, security or face legal trouble
or
Other Privacy Stories
|
|
|
|
May 01, 2002 (Computerworld) -- Companies face many snares, some of which are hidden, when protecting sensitive information and maintaining security, said lawyers addressing the Massachusetts Software and Internet Council today.
Security and privacy issues are mixed together, and companies must understand that their security and ability to maintain privacy are only as good as those of others who have access to their systems.
"I was amused to read in the paper that the Harvard Medical School was giving PalmPilots out to all its medical students," said David S. Szabo, a lawyer at Nutter, McClennen & Fish LLP in Boston. "This is a radioactive device filled with medical data."
Szabo said that it's impossible to guessthe school's liability if one of the devices were lost or stolen. Privacy rules laid out in the Health Insurance Portability and Accountability Act say such data has to be protected. A question, he said, then arises: What would constitute protection in such a case?
Donna Sherry, a lawyer at Boston-based Goodwin Procter LLP, said companies need to keep liability in mind when they send private information via e-mail.
All the lawyers at the conference said they consider e-mail open to privacy and security risks, which points to the need for clear policies for e-mail and Internet usage.
"When you send an e-mail, it goes 20 different places and it is stored forever," said Nicholas M. Gess, a lawyer at Boston-based Bingham Dana LLP.
Szabo advised users to consider who will read the e-mail before sending one containing sensitive information.
Sherry cited a case in which an information services manager at a small, privately held company was reading incoming e-mail from a larger, publicly held company that was looking into buying it. The manager found the details of the sale and other confidential business information and told his colleagues what he had learned. If the information had gone public, there could have been wider consequences, including problems with the Securities and Exchange Commission, Sherry said.
Companies should draft clear policies for Internet and e-mail usage and make sure that employees get copies of these policies at least twice a year, said Neil McKittrick, a lawyer at Hill & Barlow of Boston.
He said every new employee should be given a copy of the policy when he starts, adding that the company should follow up with updated versions of the policy at least every six months.
When one member of the audience asked if there is an authority or anyone who can define the "industry standard" for dealing with these issues, attorney Gene K. Landy, at Boston-based Ruberto, Israel & Weiner PC, laughed.
"There is someone who knows what that means, and that's a jury," Landy joked. He followed the joke by suggesting that people visit a number of sites on the Web, including the SANS Institute, for information about privacy and security issues.
The attorneys said potential pitfalls remain for companies, including employees who use their own equipment on the job.
Sensitive data downloaded to a handheld device or a personal laptop may be beyond the reach of a company's security measures, but the company might still find itself liable for any leaks that arise, the attorneys said.
Sherry said companies should consider the security measures implemented by their clients, partners, contractors, Web site hosts and Internet service providers. Company security is only as good as the security of each of those entities, she said. If sensitive data is captured through a breach in one of those entities, the company may end up paying for that lapse.
Related stories:
- Senator's privacy bill drawing industry opposition, April 26, 2002
- DoubleClick Settlement May Affect Corporate IT Policies, April 8, 2002
- Corporate Privacy Credibility Crumbles, March 4, 2002
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Google gives away home-cooked Web application security scanner
- HP eyes move of support facilities out of Colorado Springs
- Microsoft trumpets security additions in upcoming IE8
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 In SecurityStripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Our columnist describes how asserting the importance of information governance is crucial to making that asset tangible, addressable and protected. Click here to read the latest column by Jon Espenschied |
Computerworld Technology Briefing: An open-source path to optimal virtualization Looking for a virtualization strategy that offers both the flexibility and reliability to meet the demands of mixed-source environments? Look no further than the fast-emerging open virtualization approach backed by some of the biggest names in enterprise computing. Together they are pointing the way toward higher data center performance without higher costs.Download this briefing
|
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
