You could construe that he would be instructing his employees to act illegally if he was a UK CIO.
I don't think you could construe that at all. While everyone is making great hay about his statement, the truth is that every organization makes the compromises that he mentions. While perhaps duplicating what andrewfong said, if security is supreme-
-there is zero worker mobility. Want to work at home, or bring the laptop on the flight? Security threat.
-there is zero internet connectivity. Want to browse at your desk? No chance.
-email attachments? Filesharing? Heck no.
-users have absolutely no rights on their workstation beyond the most rudimentary.
-application sets are extremely restrictive and vetted.
-Want to work in the conference room? Call the security center to configure the IPSec, MAC and port filtering security to allow you to move your locked down desktop.
And on and on. While quite a few on here seem to present the notion that they comply with all best practices, extraordinarily few do (even the NSA doesn't). And those best practices cost in both productivity, worker enjoyment, and direct expenditures.
It is never, and has never been, as easy as security versus no security. Against a dedicated, resourced foe, just about anyone and everyone is vulnerable.
Sorry, no. He cannot under UK law "accept the risk of a security breach" unless a UK Judge deemed it unreasonable to spend "$10 million to avoid a possible $1 million loss."
A judge may well agree that it is unreasonable but he cannot use the financial loss to the company as the only metric to make that decision.
Both customer data and employee data must be held under these rules.
https://www.gov.uk/data-protection/the-data-protection-act
https://www.gov.uk/personal-data-my-employer-can-keep-about-...
You could construe that he would be instructing his employees to act illegally if he was a UK CIO.