A Password Shared Is A Password Lost

Mobile phone company Orange recently admitted to breaching the Data Protection Act 1998 (the DPA) by failing to keep customers’ personal details secure. An employee blew the whistle on Orange by revealing that new employees were permitted to share log in details (usernames and passwords) to access the company’s IT system. Little detail has been disclosed however some reports suggest that callers’ bank details and addresses may have been accessed, although Orange has not found any evidence that customer details were disclosed.

The DPA requires data processors to take technical and organisational measures in order to keep personal data (such as customer details) secure and prevent unauthorised use of personal data. This requirement has become increasingly important as the threat of identity theft and unlawful trading of personal data has materialised - so-called ‘blaggers’ often pretend to be someone else in order to gain snippets of personal data, which can then be sold on for