O2 admits to loss of tape which could have customers’ personal data

Updated 8.55pm

MOBILE PHONE SERVICE provider O2, which has some 1.6 million customers in Ireland, has said that a tape that may have contained some of its customers’ personal information has gone missing.

The tape went missing in September 2011 but the potential data breach is only emerging now following consultation with the Data Protection Commissioner (DPC).

The company has insisted that there is a “low risk to customer data privacy”. The DPC said that it is satisfied from its investigation that the level of risk to individuals is “low”.

O2 said that it has been working with the Data Protection Commissioner (DPC) since the summer to establish the facts of the case before announcing the incident in a notice posted to its website this evening.

The tape contained what the operator said was a “snapshot of data at a particular moment in time, including files from O2′s internal corporate drives”.

“While it is possible that it could contain some personal data, it is more likely that it simply contained information about O2′s normal business affairs and company information,” a statement said, adding:

While the tape has been lost, it is likely still in an O2 building. As a result we believe there is a low risk to customer data privacy.

The company said that it was informed by its IT partner IBM in the summer of this year that a tape used for routine daily back-up work had been “misplaced” in September 2011.

“While the tape remains unaccounted for it is possible that it has simply been misplaced within an otherwise secure location in O2,” the company said.

A spokesman for O2 told TheJournal.ie that IBM’s failure to notify it of the disappearance until last summer was an issue for the computer company but said that the matter had been “taken up with them”.

He described it as “normal practice” to work with the DPC to establish the facts of the case “to ascertain what the situation is”.

“As soon as we concluded that discussion with the DPC we put the notice up on our website,” the spokesperson said this evening.

O2 has been asked to notify all of its customers as of September 2011 of the matter while the investigation remains ongoing. O2 said that the incident had never happened before.

Its statement on its website added: “We have undertaken a full review of the process around the handling of back-up tapes to ensure this does not happen again.”

The Data Protection Commissioner, Billy Hawkes, told TheJournal.ie this evening that there is still a possibility his office could prosecute O2 for the breach.

“Data breaches by telecommunications companies are subject to prosecution by us under the law so obviously it’s an option that we have available to us, but we’ve not made a decision it yet,” he said.

“But from the point of view of the public as well, we’d like to say that we are satisfied from our investigation that the level of risk to individuals is low in this case.”

Read: Happy bday 2 u: text messaging turns 20