Public sector faces hefty fines for data breaches
Councils should scrap sales to database marketers
UK state-sector organisations could face seven-figure fines for data breaches, according to the review of data sharing ordered by the prime minister.
In a wide-ranging report, which also recommends the scrapping of the edited electoral roll, information commissioner Richard Thomas and Mark Walport, director of medical charity the Wellcome Trust, recommend that the government introduce fines which mirror those made by the Financial Services Authority (FSA) in such circumstances.
The FSA fined Norwich Union £1.26m in December 2007 after fraudsters gained the surrender of the pension funds of 74 customers. It also fined Nationwide Building Society £1m earlier last year after the theft of a laptop which held data on its 11 million customers.
Thomas and Walport said that the details of the fines have yet to be worked out, but added that they should be in place by November. Gordon Brown ordered their review last October – three weeks before HM Revenue and Customs lost data on 25 million people.
Walport conceded that, in the case of public bodies, fines would involve taxpayers' money moving from one organisation to another. But he told GC News: "An organisation that hasn't got the right procedures (and is fined) will be in trouble at the top. A fine isn't everything, but it sends a pretty bad signal."
Thomas added that the fines would have "primarily a deterrent function," and would only be for reckless or deliberate breaches of data. The report says the fine schedule should include "high, but proportionate, maxima related to turnover".
Thomas has recently served enforcement notices on HM Revenue and Customs and the Ministry of Defence for their major data breaches, but said these will go forward under the law as it was before May, when his office gained the ability to take civil action for reckless or deliberate breaches of data through an amendment to the Criminal Justice and Immigration Act.
In its other recommendations, Walport and Thomas's report says that the edited electoral role – currently sold by local authorities commercially, holding data on all local voters who have not opted out of it – should be scrapped. The full electoral roll would remain, but as now would only be available for running elections, for political purposes and for credit reference agencies.
The report also says the government should establish a statutory fast-track process for new kinds of state sector data-sharing, although this would be subject to oversight from the information commissioner, a privacy impact assessment and a vote in both houses of Parliament.
The Information Commissioner's Office would become the Information Commission, with several commissioners and new work including the publication of a statutory code of practice on data-sharing. It would receive increased funding, by moving from the flat fees currently paid by data controllers such as government bodies to a multi-tiered system.
Thomas defended the recommendations to strengthen his office, saying that the vast majority of submissions by more than 200 organisations to the review had approved of this.
The report also says that the public should generally be able to see their own data online, rather than having to apply through subject access requests under the Data Protection Act. Walport said this would be beneficial for a variety of reasons in health, despite the sensitivity of the information, as it allows patients to correct errors.
"I think people are generally reassured when they can see their information online," he said, adding that good security equivalent to that used for online banking would be required.
This article was originally published at Kablenet.
Kablenet's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.