The Information Commissioner’s Office says law firm Herbert Smith is likely to have breached data protection rules in disclosing the names of Keydata investors and the amount they have been paid in compensation.

Read the rest here:
ICO says FSCS law firm could have breached data rules on Keydata

The Pensions Regulator has moved to allay provider fears over data protection issues ahead of automatic enrolment.

Read more here:
TPR says providers won’t breach rules on auto-enrol data

Broker says insurers are using a data protection loophole to get full medical records at reduced prices.

Read the original:
Insurers use data loophole to cut medical record costs

European requirements on data protection and internet trackers will be backed by tough auditing and investigatory powers for the Information Commissioner’s Office

See original here:
EU rule on web ‘cookies’ bears £500,000 fine

Ed Vaizey, the UK’s communications minister, questions the practicality of planned additions to the European data protection directive

See the rest here:
UK questions EU online privacy plan

Trustees and those responsible for administering workplace pensions will need to improve standards of record keeping.  Following research during 2009, the Pensions Regulator published a consultation today setting out standards for member records and requiring schemes that fall short of requirements.

The regulator will continue to ‘educate and enable’ schemes to improve their record keeping performance but is clear now that further measures are needed. Under these proposals, it will now be a requirement for all schemes to maintain high-quality standards of data.

The regulator proposes to set targets for the accuracy of the common data which schemes must hold. The regulator also proposes to review performance of schemes. Where schemes fail to have adequate plans in place to resolve data issues, the regulator will require them to improve.

Good record-keeping applies to all schemes, whether trust-based or contract-based. In respect of contact-based arrangements, the Pensions Regulator works closely with the Financial Services Authority to improve standards and take corrective action where necessary.

Full details can be found HERE

CEI Compliance is looking for serious consultants with UK Financial Services Compliance experience from complaints to sales process and auditing to process redesign experience for work currently under negotiation.

Applicants should be qualified in compliance or a related subject or have 5 years or more business review, sales compliance or other related experience

The standards covered by the PCI Council can be used to help build or augment the security policies and structure for the enterprise, data centres and your customers. This comprehensive set of requirements for security management, policies, procedures, network architecture, software design and other critical protective measures will be used by the wise as a best practices guide to implement and follow.

Although the PCI Council manages the underlying security standards, compliance is set independently by the individual brands. Each brand has its own set of financial penalties per incident, with additional penalties ranging from restrictions to outright loss of use.

A common misconception is that this is an IT issue and best left solely to the technical departments to resolve. In fact, most companies find that this is a multi-discipline exercise best co-ordinated by a risk and compliance function who can then co-ordinate any IT requirements and engagement; governance for policy writing or amendment; operations for current practices and training; HR for new hires security checks; as well as providing feedback to the audit function for reporting to senior management.

In the latest release of PCI DSS is the requirement that all Web-facing applications be protected against known attacks. Also, further consideration is paid to the vulnerability of the application if someone does get access: How much damage can they do? Historically hosting companies over the years have become very good at protecting the networks and the operating systems from attacks, while the applications themselves have been left vulnerable.

An investigation is currently being carried out at Positive Solutions into an alleged fraud by one of its advisers.