By John Leyden
17th April 2007
Consumers are wary about returning to shop at retailers that have been
the subject of security breaches, according to a new study.
The survey of 1,200 UK consumers revealed that the majority would take
their business elsewhere in the event of loss of customer data as a
result of a security breach or hack attack.
One in seven of the high income earners among those quizzed in the poll
confessed to having been the victim of data theft. Four in five (82 per
cent) would expect to be notified immediately in the event of a data
breach, an issue brought to the fore by the recent high profile security
flap involving the loss of up to 45 million card records by discount
One third of punters polled avoided putting their personal information
online. Even so, 11 per cent of this group still became the victim of
data theft, illustrating that the problem on data security extends
beyond internet security.
Nearly all (95 per cent) the respondents to the survey expressed concern
about some aspect of the security of their personal data, with 83 per
cent singling out the security of credit and debit cards as their
principle priority. A sizable minority (45 per cent) of those quizzed
reckon banks and online retailers are not doing enough to protect their
More and more UK-based firms are deciding to outsource their database
storage and management facilities overseas. The survey reveals that two
in three (63 per cent) are concerned about the ability of data centres
to protect their data, in the UK and abroad.
Paul Davie, chief exec of Secerno, the UK-based database security firm
that sponsored the survey, said recent high-profile data breach cases
are beginning to affect public attitudes. He called for US-style
information security disclosure laws to be applied in Europe.
"Consumers have a right to be told immediately whenever their personal
information may have been compromised, yet those companies holding
personal data know that they are likely be punished when a breach
becomes known - by loss of customers, damage to reputation, cost of
clear up, and share price impact. This means that companies have an
immediate disincentive to do the right thing in such cases," Davie said.
"A new legal framework is needed in Europe to force disclosure of
breaches. Currently, there is no EU Directive to enforce disclosure
which means a TJX/TKMaxx could already have happened but, unlike US
companies, European companies would not necessarily be obliged to warn
their customers," he added.
Subscribe to InfoSec News