Feeds

Public sector faces hefty fines for data breaches

Councils should scrap sales to database marketers

Build a business case: developing custom apps

UK state-sector organisations could face seven-figure fines for data breaches, according to the review of data sharing ordered by the prime minister.

In a wide-ranging report, which also recommends the scrapping of the edited electoral roll, information commissioner Richard Thomas and Mark Walport, director of medical charity the Wellcome Trust, recommend that the government introduce fines which mirror those made by the Financial Services Authority (FSA) in such circumstances.

The FSA fined Norwich Union £1.26m in December 2007 after fraudsters gained the surrender of the pension funds of 74 customers. It also fined Nationwide Building Society £1m earlier last year after the theft of a laptop which held data on its 11 million customers.

Thomas and Walport said that the details of the fines have yet to be worked out, but added that they should be in place by November. Gordon Brown ordered their review last October – three weeks before HM Revenue and Customs lost data on 25 million people.

Walport conceded that, in the case of public bodies, fines would involve taxpayers' money moving from one organisation to another. But he told GC News: "An organisation that hasn't got the right procedures (and is fined) will be in trouble at the top. A fine isn't everything, but it sends a pretty bad signal."

Thomas added that the fines would have "primarily a deterrent function," and would only be for reckless or deliberate breaches of data. The report says the fine schedule should include "high, but proportionate, maxima related to turnover".

Enforcement notices

Thomas has recently served enforcement notices on HM Revenue and Customs and the Ministry of Defence for their major data breaches, but said these will go forward under the law as it was before May, when his office gained the ability to take civil action for reckless or deliberate breaches of data through an amendment to the Criminal Justice and Immigration Act.

In its other recommendations, Walport and Thomas's report says that the edited electoral role – currently sold by local authorities commercially, holding data on all local voters who have not opted out of it – should be scrapped. The full electoral roll would remain, but as now would only be available for running elections, for political purposes and for credit reference agencies.

The report also says the government should establish a statutory fast-track process for new kinds of state sector data-sharing, although this would be subject to oversight from the information commissioner, a privacy impact assessment and a vote in both houses of Parliament.

The Information Commissioner's Office would become the Information Commission, with several commissioners and new work including the publication of a statutory code of practice on data-sharing. It would receive increased funding, by moving from the flat fees currently paid by data controllers such as government bodies to a multi-tiered system.

Thomas defended the recommendations to strengthen his office, saying that the vast majority of submissions by more than 200 organisations to the review had approved of this.

The report also says that the public should generally be able to see their own data online, rather than having to apply through subject access requests under the Data Protection Act. Walport said this would be beneficial for a variety of reasons in health, despite the sensitivity of the information, as it allows patients to correct errors.

"I think people are generally reassured when they can see their information online," he said, adding that good security equivalent to that used for online banking would be required.

This article was originally published at Kablenet.

Kablenet's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.

The smart choice: opportunity from uncertainty

More from The Register

next story
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.