James Ashton: Data’s great value cries out for first-class security

Unlucky: Morrisons is at the forefront of the tech debate following a data breach

11 December 2017

A recent High Court ruling put supermarket group Morrisons at the forefront of technological debate.

It is not a position the grocer is accustomed to: it only started to take online grocery orders four years ago.

But a case in which it was found liable for a former employee leaking the personal details of its staff shows that data — its collection, storage and use — is an issue that is soaring up the boardroom agenda everywhere.

Morrisons was unlucky. A disaffected IT worker posted payroll information of almost 100,000 of his colleagues online. He was jailed in 2015 for his actions but 5500 present and former staff banded together in the UK’s first data protection class action in pursuit of compensation.

The judge found that Morrisons had adequate internal controls in place but should still take secondary liability for what happened. It is appealing, but whether it is successful or not, the judgment highlights that the responsibility for data protection lies squarely with the organisations that hold it.

It is a timely reminder because smart data use will lie at the heart of many businesses in the future. The essential workforce co-ordinates — salary, National Insurance number, date of birth and bank account details — have merely moved from filing cabinet to hard drive and maybe now into the cloud over recent decades.

But the opportunities that exist from the clever mining of reams of figures to drive profits have multiplied many times over.

From May, the UK must comply with the European Union’s General Data Protection Regulation. That means an overdue upgrade of the Data Protection Act which mostly dates back to 1998 — the year Google was set up.

New rules will make life harder for any company looking after consumer data, which in practice is almost any company. Rather than blaming sophisticated criminals, firms will have to prove they have done enough to protect against cyberattacks such as WannaCry and Petya, or face higher fines.

At the moment, the financial penalty for data security failings is about as severe as the punishment meted out for a dodgy audit by the Financial Reporting Council.

It will go up, to the higher of £17 million or 4% of a company’s global turnover, but the idea that multi-million pound fines will become a common occurrence is far-fetched.

However, broadband provider TalkTalk would surely have to pay much more than the £400,000 it was hit with after suffering a major hack two years ago.

There are likely to be similar moves in the US, where politicians are probing the consumer credit checking firms after the blockbuster Equifax data breach.

If the value of data is being inflated in the eyes of the law, it should be in the eyes of the consumer who too often gives too much away without thinking. The Morrisons workers had the right idea, equating the chance of identity theft to demands for a payout.

Businesses have long recognised the value of data: one of this year’s buzz phrases, “Data is the new oil”, has investors almost as excited as they are about bitcoin. Can data really become a valuable resource to power the economy long after fossil fuels have run out? For a country whose North Sea riches are behind it, we had better hope so.

Perhaps data can be even more valuable because it can be used over and over, whereas oil burns once. There is plenty to drill into because global internet traffic is growing by a quarter every year.

There is a land grab for personal information going on. A good example is Experian, the FTSE 100 credit checker, which has signed up three million UK consumers to a free credit score tracker.

But Experian is a data amateur compared with Facebook. The social media giant’s $10 billion (£7.5 billion) revenues last quarter works out at £5.50 for each of its 1.37 billion users who check for updates at least once a day.

The human race has proved to be an extremely cheap resource in building a business set up only 13 years ago that now has a market value of $525 billion.

Of course, Facebook users may regard surrendering reams of personal data as a fair price for keeping in touch with friends and the world at large at the touch of a smartphone. They claim to know what they are consenting to, although very few will have read the website’s extensive terms and conditions.

Such a commercial trade-off is not new, whether it is the advertising break that interrupts a TV programme or the free bank account that pays no interest on deposits.

What is different with data is we are still in the foothills of how a new industry will develop. Privacy, security and ownership are all areas to be fought over if the digital economy is to work for everyone.

James Ashton: Data’s great value cries out for first-class security

Read More