There is a demonstrable fallacy that data is secure. No one, not governments, not huge corporations, not cloud providers or anyone else can say, with hand on heart, that data is safe.

Aside from innocent human error, even recklessness, there is always the reality of malicious activity.

Data protection standards are illusory. The only effective way to protect data is not to collect and/or hold any. And that flies in the face of the business model of many, many companies.

There is no value in here repeating the many arguments opposing the use of terms and conditions which contain clauses which cannot be severed and which contain rights over data (in all senses) or websites that provide for certain data to be kept confidential after the user requires it - and which, because this happens after the company has collected - and processed information - means that it is passed to third parties before permission is cancelled. It's important to understand the difference between "cancelled" and "revoked."

Everything from government identification details to bank information, from genealogy information to health details and even commercial information is stored on computers. It is all under attack, usually by means of an illegal connection from outside the company.

Let's be clear: what was acceptable data collection 25 years ago is often no longer acceptable.

I'll give an example: 25 years ago when my company was building an e-learning platform, we looked at using biometrics to ensure that staff in banks, etc., taking examinations for money laundering risk training were in fact the registered member of staff. It wasn't our idea: it was several banks which asked how we could be sure that a person did in fact take the exam. We looked at fingerprints using readers, either stand-alone or built into keyboards. It was doable and had additional security benefits such as authorising access to terminals and PCs. In those pre-data protection law days, we had no concerns over storing that data. Today, we would not consider doing it. In fact, no bank took it up because (get this) the cost of replacing all their keyboards with e.g. Cherry, was too high. The latest version costs around USD200 so it's not cheap.

There was another problem: bank etc. staff were not happy with the idea of giving out their fingerprints. It wasn't a security issue, then, it was simply that people had a very different view of privacy.

That sentence encapsulates the central problem in this topic: companies talk about privacy (and how they will erode it while saying they are protecting it) while treating security as a separate topic. In fact, they are inter-related.

Biometrics have moved on: everything from the way a person types through vocal cues (accent, phraseology, intonation, linguistics) through fingerprints, palmprints, iris and retina scans are used by companies who simply do not have a need to collect or store it.

Banks do; a facial recognition program attached to an ATM might prevent ATM abuse. The tech is certainly readily available. But ATMs are the most vulnerable of all a bank's operations and so that is probably undesirable.

The swing, by ordinary people, away from concerns over privacy has led to the voluntary release of highly sensitive information to a vast array of companies around the world. From LinkedIn's "verification" service operated by a third party which requires those forced to use it to accept terms that allow the passing of information to third parties with a note that there is an opt-out later, to "super apps" that include an e-wallet and therefore require a level of identification that a simple car-booking service would not.

The question is simple: who's holding all that identification data and can criminals get it?

The answer is equally simple: all kinds of companies, built by all kinds of people in all kinds of places. And yes. As breach after breach demonstrates, criminals can get pretty much any data from anywhere.

I deal with an online shopping platform that says in its terms and conditions that it will retain payment card information. I objected and told them to delete it. They said they had and if I look at my account information, it's not shown. But when I make a purchase, I'm offered the option to use that card and the number appears. So the company has expressly told me the information has been deleted but there it is, on my screen, every time I place an order. This is what I alluded to earlier: data security fails through human error or recklessness.

If we tie all of this together in a nice package we find that the more security measures are created and enforced, the bigger the incentive for criminals to collect the data upon which those security measures depend. So if your face is the key to your bank account, and your face is on social media or if you walk down a busy street where someone has a small high-resolution camera sitting on a table outside a café, tough. In short, your face is easier to steal than a password, and as we know, they aren't especially secure, are they?