Loss of notebook computer under work-from-home arrangements – DPP 4 – security of personal data
Background
A government department reported to the PCPD that a staff member had lost an official notebook computer, which was provided to the staff member under work-from-home (WFH) arrangements, on public transport. The computer contained draft staff appraisal reports including their names, ranks and dates of appointment, salary points, duties and preliminary assessments. The staff member had failed to delete the draft appraisal reports upon completion of the appraisal period.
Remedial Measures
Upon receiving the notification from the government department, the PCPD initiated a compliance check. The PCPD found that while the personal data contained in the notebook computer had been encrypted to reduce the risk of unauthorised or accidental access to the data, the department reminded staff to take extra care in handling official portable devices. The department revised its guidelines reminding staff members that notebook computers should not be used as permanent storage of restricted information, and such information should be deleted when it was no longer necessary.
Lesson learnt
In view of the severity of the COVID-19 pandemic situation, many organisations have adopted WFH arrangements to reduce the flow of people and social contacts in the community. It is noted that most organisations have policies in place to require their staff members to encrypt electronic records in notebook computers. However, it is difficult to ensure staff members deleted obsolete documents containing personal data in notebook computers. To further enhance the protection of personal data, organisations should consider requesting their staff members to access work files through a virtual private network (VPN) connection instead of storing work files locally.
(Uploaded in February 2023)