Surely it's grossly negligent behaviour on her employer's behalf?

I voted you up, but I wanted to note that I (we?) have no idea how her department is run, and the negligence could rest as well in her hands as it could in her employer's hands. Another post here said "Blame the IT department for not establishing rigid policies." These sentiments are good, but...

What if the IT department clearly outlined policies for how to store and secure the data? What if the researcher is one of those "This is how I have always done it, and I am ignoring you" types? Given the kinds of data claimed to be on the laptop, it sounds like a personal laptop, not a locked-down IT-given laptop. What if that was the researcher's choice, the intentional ignoring of IT policies in the name of convenience or whatever?

Either way, the article's message is good: back up your important data. Whoever is to blame, the core message obviously bears repeating.

I work in the physics department of a top university. The majority of work people in the department do involves a computer at some stage, from computational physics (likely involving supercomputers and months of compute time) at one end of the spectrum to using Excel as a data store at the other.

We do not have an IT department (we have one or two post-doctoral researchers who keep a couple of servers running for undergraduates).

We do not have IT policies, outside of university-wide intellectual property rules.

There are only personal laptops (in the sense that even though my machine was bought for me, I have full control of it and there is no oversight of how the machine is used).

To the best of my knowledge, this is true of the rest of the university (possibly even worse in other departments).

To add to the anecdotal evidence, I have contacts in the strong IT department of a top university near me. So it could indeed go either way.