large databases good, small bad

Quoting from todays BCS newsletter "Last year provided plenty of news stories about lost laptops and CDs containing masses of personal data. Confidential data wasn't exposed by corporate systems being compromised by outsiders (foreign or otherwise) but by insiders doing dumb things, like sending unencrypted data in unregistered post."

Whilst it isn't necessarily true that large databases will have well thought out security, in my experience paper systems and small databases don't tend to have very much at all. The exception being where a commodity system, like a primary care health system is replicated. The important thing in security is to have the staff that build systems and control access to data aware of what they need to achieve in terms of data protection, and that is more likly to be achieved in large databases.