Privacy watchdog orders M&S to improve computer security

Marks & Spencer broke data protection rules by failing to secure the personal details of some 26,000 employees, a UK privacy watchdog said today.

A laptop containing pension arrangement details of the M&S staff was stolen during a burglary.

The employees’ details were unencrypted which meant they were not secure, the Information Commissioner’s Office (ICO) said.

After an investigation, the ICO found M&S in breach of the Data Protection Act.

It has ordered the retailer to ensure all its laptop hard drives are fully encrypted by April.

An investigation was launched after the laptop was stolen from the home of an M&S contractor.

ICO Assistant Commissioner Mick Gorrill said: “It is essential that before a company allows personal information to leave its premises on a laptop there are adequate security procedures in place to protect personal information, for example, password protection and encryption.”

The ICO has issued M&S with an enforcement notice ordering it to step up its laptop security.

Failure to comply with such a notice is a criminal offence.

The ICO is the official watchdog set up to police the Data Protection Act and the Freedom of Information Act.