data-protection-and-journalism-a-guide-for-the-media-draft

Data protection and journalism
In practice
Security
Key points:
You must take reasonable steps to prevent people’s information
being lost, stolen or misused.
You will need to consider technical (computer) and physical
security measures, your policies and procedures, and staff training
and supervision. These should cover staff working both in and
outside of the office.
The DPA says you must keep information about people secure. This
means you must take reasonable steps to stop it being lost, stolen or
misused. You are not exempt from these security obligations.
There is no one-size-fits-all answer to what security measures might be
appropriate, but you should be able to justify the level of security you
have. You should take into account how sensitive or confidential the
information you hold is, the harm that might result from its loss or
improper use, the technology available, and the costs involved. You don’t
have to have state-of-the-art security, but it should fit the level of risk.
The level of security appropriate for employee records or information from
confidential sources is likely to be different to the level of security
appropriate for information which is publicly available.
You should consider your:
technical (computer) security. This includes log-on controls,
firewalls, encryption, remote wiping facilities, suitable back-ups,
and proper disposal of old equipment. You should consider both
office computer systems and any mobile devices used out of the
office (eg smartphones, laptops or tablets). If you allow people to
use their own mobile devices, refer to our Bring Your Own Devices
(BYOD) guidance.
physical security. This includes things like doors and locks, alarms,
supervision of visitors, disposal of paper waste, and how to prevent
notebooks and mobile devices being lost or stolen when staff are
out of the office.
DRAFT 39