Breach across the pond

The HMRC (Her Majesty's Revenue & Customs, Britain's tax collectors) has had a series of troubles over the last year when it comes to providing adequate security to its citizens' private data. 

I guess we shouldn't be surprised that this time a Welsh division of the HMRC has apparently lost a cartridge containing the data of more than six thousand UK pensioners. I read here in this New York Times online article "U.K. Government Loses Pensioner Data" that the risk to the individuals whose data is contained on the cartridge is "low."  But no matter what the reasoning is behind that claim of "low" risk, I'm sure those pensioners would disagree.

While this security lapse was only revealed Tuesday, apparently the cartridge had gone missing back in September! As we're more than halfway through December, I guess their risk assessment was on the money (so to speak). Nonetheless, I fail to see how these losses keep happening at big organizations - organizations that have sound security policies in place. Again - just like here in the U.S. with the numerous VA shortcomings - organizations that process and maintain huge databases of citizen information (especially government organizations) have a responsibility to their citizenry.

Whenever failures occur, I think swift ramifications have to be the norm because apparently there are plenty of employees who just don't realize - or at least care to accept - the severity of such lapses. Every individual in a responsible position must be fully aware that their action (or inaction) is of major consequence and they have to live up to their responsibilities or pay the price.