Security & Risk Management

« Role Management and eSSO vendors - a call for action | Main | Citigroup leaks customer data through P2P file sharing »

Posted by Chris McClean on September 25, 2007

Play fair... or they'll come after your secrets

I’m not usually one for ‘this-could-happen-to-you’ stories, but I’m still having trouble getting over last month’s story about grocery giant Tesco having to turn over 11 million emails to the UK’s Competition Commission for their investigation into possible anti-competitive practices against its suppliers.

Besides the sympathy headaches I have for the poor interns that have to spend the next year sifting for keywords like “monopolize”, “price gouge”, and “illegal”, I’m curious how the company is going to handle the privacy and confidentiality issues of turning over this amount of information. For example, what are the chances this will expose other data relevant to the two other investigations the Competition Commission launched against the company this summer, much less exposing personal employee information?


I’m even more curious about how Tesco enforces the promise in its corporate responsibility report that the company is “determined that everyone involved in (its) supply chain benefits from their relationship with Tesco.” If the company can demonstrate how this works, it’s good news for the Commission... and certainly much easier on those poor interns.

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a00d8341c50bf53ef00e54ee912da8833

Listed below are links to weblogs that reference Play fair... or they'll come after your secrets:

Comments

Jen Albornoz Mulligan

Chris, you've raised a great point about the conflict between investigations and employee privacy rights. How can companies turn over the information needed for electronic discovery while not turning over so much as to violate employees privacy? This problem comes up even more frequently in the case of internal investigations. The best practice to proactively prevent problems is to be sure that HR is part of the investigations team from start to finish along with the privacy officer. They each add their own expertise of applicable laws.

The comments to this entry are closed.

Enter your email address:

Delivered by FeedBurner

Search this blog

S&R Links

Security & Risk Analysts on Twitter