Recruitment site failed to protect data of clients

THE Data Protection Commissioner yesterday ruled that recruitment website Jobs.ie did not have sufficient security to protect the personal information of its clients and held on to private information for longer than was necessary.

Commissioner Billy Hawkes was reporting on his investigation into an incident on March 27 when hackers entered the website and downloaded the curriculum vitaes of site users looking for a job.

The investigation found that Jobs.ie failed to meet its obligations under three pieces of data protection legislation.

Mr Hawkes said the website did not have enough security in place but the company had shown determination to make amends during his investigation.

Last night, chairman of Jobs.ie, Leslie Buckley, issued a statement. He said it had put in additional security measures after the breach and the entire incident was now under investigation by the Garda computer crimes’ division.

“I would like to compliment the Data Protection Commissioner for the excellent work he and his department are doing and thank him for his assistance in this matter,” he said.

The commissioner’s report only dealt with the data protection issues and it was not within its remit to investigate the criminal actions of the hackers.

Mr Hawkes’s report praised the actions of Jobs.ie after it became aware of the incident and its efforts to contact everybody affected.

“The Office of the Data Protection Commissioner feels that it is important to make clear that Jobs.ie has responded to the illegal access to the personal data that took place in an exemplary fashion.

“There is no doubting that it now takes its data protection responsibilities very seriously. It moved to put in place additional security measures immediately to minimise the potential for any repetition of the incident and has taken on board all of this office’s recommendations,” he said.

Jobs.ie has also reiterated its advice not to give out personal banking information to anybody soliciting it, avoid sharing password details and delete any suspicious email, especially if they come with a .exe attachment.

Mr Hawkes said he was able to complete his investigation in just under two months due to the assistance offered by the company.

He said companies which accept personal information had an obligation to delete this after it was no longer useful so that it was not accessible to people unauthorised to see it.