The printing of embarrassing MPs’ expenses claims was, for one speaker at IFSEC, more proof of how important data protection is – and how the security industry is not acting on it.
Consultant and investigator Chris Brogan was introduced by IFSEC conference chair Bill Wyllie thus: "I have often regarded Chris Brogan as the Alfred Hitchcock of the security sector, because I always leave the theatre more scared than I went in." Brogan began: "What really scares me is that the security industry is doing absolutely nothing about it [data protection], and it is going to take your legs away. You would have to be blind not to see the impact of it. Look at the MPs [he was speaking on Tuesday, May 12, during the publication by the Daily Telegraph of expenses claims as made in recent years by MPs of all political parties]. They are running because of all the information released; and that could be released by truculent employees; and yet I am still amazed that the security industry hasn’t taken this on board. I am still amazed at the appalling advice given in security magazines, written by people who have read articles written by people who have read articles." In other words, he stressed the need to read the relevant laws. <br><br>He made the point that an organisation is more likely to face an employment tribunal than a fire, as risks go. As a private investigator and pre-employment screener for 30 years, he wanted access to databases, yet realised there were limits. "No matter how you dress up screening, whatever posh term you give it, it is an intrusion into a person’s privacy. That intrusion has to be lawful, reasonable and proportionate and I know that because the Human Rights Act 1998 quite specifically states it; article eight." <br><br>As for outsourcing your screening of people before they work for you; you are doubling the risk, he warned. And Chris Brogan said this as a PI whose income partly comes from such outsourced work. Because, how can you know if the investigation agency knows the first thing about the privacy laws? "If they screw up, you would be held responsible, unless you can demonstrate in a court of law a defence that you had taken all reasonable precautions. I wonder how many of you in your contracts with these people say you will comply with the Data Protection Act 1998. If you don’t, and this goes to court because of that truculent employee; if they take you to a tribunal, where does that lead you. A mistake can be extremely expensive to your company and I would suggest your career just might have ground to a halt, if it is your responsibility." And if you have someone’s consent to do screening, that does not mean you can do anything. What for example if the person makes a subject access request? What people have said about a job applicant could come to light. Chris Brogan gave some of his favourites: the pilot who was recommended not to fly below 300 feet; the former military man of whom it was said ‘his men would follow him anywhere, if only out of sheer curiosity’. Such statements could leave you open to a discrimination case. As for the standards in place for screening, Chris Brogan called BS 7858 ‘seriously flawed’ [the British Standard on ‘Security Screening of Individuals Employed in a Security Environment’]; and recommended a guide from CPNI (Centre for the Protection of National Infrastructure, www.cpni.gov.uk) on pre-employment screening, which he termed ‘very good, but partly flawed’. <br><br>To contact Chris Brogan – <br>
