The problem that I have is that, as you mentioned, the ICO simply stated : "where encryption software has not been used to protect the data, regulatory action may be pursued". They said they may take action if no encryption has been used. They did not say that no action would be taken if encryption is used. I do not feel comfortable making such a leap and assuming that the reverse is automatic.
In its Opinion 03/2014 on breach notification23, the WP29 (which is the group of EU data protection authorities) explained that a confidentiality breach of personal data that were encrypted with a state of the art algorithm is still a personal data breach, and has to be notified. However, if the confidentiality of the key is intact – i.e., the key was not compromised in any security breach, and was generated so that it cannot be ascertained by available technical means by any person who is not authorised to access it – then the data are in principle unintelligible. Thus, in such specific situation, the breach is unlikely to adversely affect individuals and therefore would not require communication to those individuals.
However, the WP29 stated earlier this month that "However, even where data is encrypted, a loss or alteration can have negative consequences for data subjects where the controller has no adequate backups. In that instance communication to data subjects would be required, even if the data itself was subject to adequate encryption measures."
In light of all of the above, I think it would be a mistake to assume that encryption is the magic formula which will automatically shield an organization from all liability. After all, there are encryption standards which evolve over time. WPA2 – the encryption standard that secures all modern wifi networks – has recently been cracked. SSL and TLS 1.0, which are encryption standards for data transfers, are no longer deemed satisfactory to meet PCI-DSS requirements. I would assume that the ICO would require up to date and appropriate encryption to be used for them not to take any action.
After all, on the link you provided, the ICO writes:
Data controllers should therefore regularly assess whether their encryption keys remain sufficiently large to prevent a brute force or other method of attack. They should also assess the risks and likelihood of an attack given the amount of personal data they hold.
The ICO further states:
Rather than develop a custom algorithm it is recommended that a data controller uses a trusted and verified algorithm.
Accredited products (see ‘Choosing the right software’ below) can provide an assurance of suitability and also permit data controllers to demonstrate a level of compliance with legal obligations. However, it is important to review regularly the products being used due to the nature of technical development over time.
The ICO also writes
However, if the laptop user’s username and password were written on a piece of paper stored alongside the laptop the thief has all the necessary information in order to decrypt the data and gain full access to it, thereby rendering the encryption ineffectual.
Earlier this month, WP29 wrote: "Controllers should also be familiar with the specifics of how their encryption product functions. For instance, a device may be encrypted once it is switched off, but not while it is in stand-by mode. Some products using encryption have “default keys” that need to be changed by each customer to be effective. The encryption may also be considered currently adequate by security experts, but may become outdated in a few years’ time, meaning it is questionable whether the data would be sufficiently encrypted by that product and provide an appropriate level of protection."
I am sure that is what you meant, i.e. that up-to-date encryption standards need to be used and if that is the case, it is likely that no enforcement action would be taken.
However considering the wide range of persons reading this community site, coming from different backgrounds, I think that it is important to stress on these points. Maybe it is just me but I am afraid that people jump on the conclusion "just encrypt everything" without digging deeper and without understanding the above mentioned points. That would probably not fly, even with the ICO. I have heard from too many people that encryption is the silver bullet yet they do not understand that it needs to be up to date or that software vulnerabilities must be patched. And like you said, hashing is not encryption and therefore would not help here.
