Even though the Data Protection Act 1998 (DPA) has now been in force for over a decade, the security of data continues to be a hot topic, with many organisations still looking to strengthen their practices in relation to data sharing. Interest in this area has been emphasised by the recent series of heavy fines imposed by the Information Commissioner's Office (1C0) for serious breaches of the DPA. For example, Surrey County Council was fined £120,000 for emailing sensitive personal data to the wrong recipients on three occasions.