Feeds

Public sector faces hefty fines for data breaches

Councils should scrap sales to database marketers

Choosing a cloud hosting partner with confidence

UK state-sector organisations could face seven-figure fines for data breaches, according to the review of data sharing ordered by the prime minister.

In a wide-ranging report, which also recommends the scrapping of the edited electoral roll, information commissioner Richard Thomas and Mark Walport, director of medical charity the Wellcome Trust, recommend that the government introduce fines which mirror those made by the Financial Services Authority (FSA) in such circumstances.

The FSA fined Norwich Union £1.26m in December 2007 after fraudsters gained the surrender of the pension funds of 74 customers. It also fined Nationwide Building Society £1m earlier last year after the theft of a laptop which held data on its 11 million customers.

Thomas and Walport said that the details of the fines have yet to be worked out, but added that they should be in place by November. Gordon Brown ordered their review last October – three weeks before HM Revenue and Customs lost data on 25 million people.

Walport conceded that, in the case of public bodies, fines would involve taxpayers' money moving from one organisation to another. But he told GC News: "An organisation that hasn't got the right procedures (and is fined) will be in trouble at the top. A fine isn't everything, but it sends a pretty bad signal."

Thomas added that the fines would have "primarily a deterrent function," and would only be for reckless or deliberate breaches of data. The report says the fine schedule should include "high, but proportionate, maxima related to turnover".

Enforcement notices

Thomas has recently served enforcement notices on HM Revenue and Customs and the Ministry of Defence for their major data breaches, but said these will go forward under the law as it was before May, when his office gained the ability to take civil action for reckless or deliberate breaches of data through an amendment to the Criminal Justice and Immigration Act.

In its other recommendations, Walport and Thomas's report says that the edited electoral role – currently sold by local authorities commercially, holding data on all local voters who have not opted out of it – should be scrapped. The full electoral roll would remain, but as now would only be available for running elections, for political purposes and for credit reference agencies.

The report also says the government should establish a statutory fast-track process for new kinds of state sector data-sharing, although this would be subject to oversight from the information commissioner, a privacy impact assessment and a vote in both houses of Parliament.

The Information Commissioner's Office would become the Information Commission, with several commissioners and new work including the publication of a statutory code of practice on data-sharing. It would receive increased funding, by moving from the flat fees currently paid by data controllers such as government bodies to a multi-tiered system.

Thomas defended the recommendations to strengthen his office, saying that the vast majority of submissions by more than 200 organisations to the review had approved of this.

The report also says that the public should generally be able to see their own data online, rather than having to apply through subject access requests under the Data Protection Act. Walport said this would be beneficial for a variety of reasons in health, despite the sensitivity of the information, as it allows patients to correct errors.

"I think people are generally reassured when they can see their information online," he said, adding that good security equivalent to that used for online banking would be required.

This article was originally published at Kablenet.

Kablenet's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
HBO shocks US pay TV world: We're down with OTT. Netflix says, 'Gee'
This affects every broadcaster, every cable guy
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
French 'terror law' declares WAR on the INTERNET itself, say digi-rights folks
Liberté, Égalité, Fraternité: Two out of three ain't bad
SCREW YOU, EU: BBC rolls out Right To Remember as Google deletes links
Not even Google can withstand the power of Auntie
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.