Canadian businesses are storing more personal information digitally, but many are not using the technological tools or implementing the recommended practices to protect this information, a new survey has found.
In a telephone survey of 1,006 companies across Canada, commissioned by the Office of the Privacy Commissioner of Canada and published today, companies are storing personal information on a variety of digital devices, such as desktop computers (55%), servers (47%) and portable devices (23%).
Most (73%) are using some type of technological tool, such as passwords, encryption or firewalls, to prevent unauthorized access to the personal information stored on these devices.
However, the survey also suggested that many businesses may not be adequately using technology when it comes to protecting the personal information they store digitally.
Passwords are the most popular technological tool used by businesses to protect personal information (96%). However, of those using passwords, 39% do not have controls in place to ensure that those passwords are difficult to guess and 27% never require employees to change passwords.
The poll also found that nearly one quarter of businesses are storing personal information on portable devices, such as laptops, USB sticks or tablets, which are more vulnerable to theft and loss. And almost half of those who do (48%) indicated that they did not use encryption to protect the information on these devices.
Privacy commissioner Jennifer Stoddart said, “Encryption is one step better than locking your doors – it is like putting information into a safe – and it can really help limit the risks if a laptop is stolen or a USB key is misplaced.
“Businesses that lose their customers’ data, lose their customers’ trust, so they need to take every precaution to ensure they safeguard personal information they hold.”
The survey did find that many Canadian companies attribute considerable importance to protecting privacy (77%).
Only 40%, however, indicated that they were concerned about data breaches that might compromise the personal information of their customers and 31% indicated that they have guidelines in place for responding in the event of a breach.
