Businesses need guidance on offshore storage of personal information - survey shows

MEDIA RELEASE
1 May 2011

Both public and private sectors need guidance on the use of cloud computing and sending information offshore. Individuals also need more awareness of what is happening to their information, new survey results indicate.

The Privacy Commissioner, Marie Shroff, has just released the results of the 'International Disclosures and Overseas ICT Survey'. The survey asked where personal information being held by private sector organisations and government agencies was going; why it was being sent overseas; what was being done with it; and how it was being protected.

Fifty businesses and government agencies - most with substantial holdings of personal information - took part. These included Air New Zealand, Fonterra, major trading banks and the majority of government ministries.

More than half the respondent agencies send personal information overseas, for a variety of reasons including using third party overseas ICT to store or process the information.

'Businesses have been telling us for some time that they need guidance on how to get the most out of technology but also how to get it right to keep their customers happy. Our survey bears this out', said Marie Shroff.

'Results showed that a large number of respondents that send information overseas do not check the overseas organisations' use and management of the information. The people whose information it is often don't have a clue where the information is or how it's controlled. And decisions to use overseas infrastructure are also predominantly made on an ad hoc basis - agencies frequently don't have policies or clear ideas to help them make good decisions about their customers' information.'

Mrs Shroff says that a vast majority of respondents use mobile internet or email devices such as smart phones but most of them responded to the question by saying they do not use overseas infrastructure.

'Obviously, many businesses and government agencies do not see the use of these devices as involving overseas infrastructure, which it usually does.'

Most information ends up in Australia and the US. Some information is held by overseas third party ICT solution providers in Singapore, India and the European Union.

Mrs Shroff says the issue of ‘cloud computing' clearly has major benefits for businesses and government agencies but it also carries some risks.

'This survey has found that both the private and public sectors need guidance in this area. While most of the organisations have controls to protect the security of personal information in transit, some have no control over what happens once the information is sent overseas or don't know if they have controls.'

'We know that good privacy is good business, and businesses and government agencies know this too. But the survey found what's actually going on.' Mrs Shroff says the survey has given her office a better understanding of how businesses and government agencies are using overseas-based information and communication technologies.

'This survey will help us to develop guidance on how to mitigate ICT risks that will enable businesses and government agencies to get the most out of cloud services.

'If New Zealand businesses and government agencies are going to take advantage of the benefits the cloud can offer, it is imperative that privacy issues are tackled and got right.'

ENDS

The full report can be downloaded at http://privacy.org.nz/assets/Files/Media-Releases/Overseas-ICT-Survey.pdf

For further information or to arrange an interview with the Privacy Commissioner, please contact Annabel Fordham on 021 509 735.