Feeds

Public sector faces hefty fines for data breaches

Councils should scrap sales to database marketers

Combat fraud and increase customer satisfaction

UK state-sector organisations could face seven-figure fines for data breaches, according to the review of data sharing ordered by the prime minister.

In a wide-ranging report, which also recommends the scrapping of the edited electoral roll, information commissioner Richard Thomas and Mark Walport, director of medical charity the Wellcome Trust, recommend that the government introduce fines which mirror those made by the Financial Services Authority (FSA) in such circumstances.

The FSA fined Norwich Union £1.26m in December 2007 after fraudsters gained the surrender of the pension funds of 74 customers. It also fined Nationwide Building Society £1m earlier last year after the theft of a laptop which held data on its 11 million customers.

Thomas and Walport said that the details of the fines have yet to be worked out, but added that they should be in place by November. Gordon Brown ordered their review last October – three weeks before HM Revenue and Customs lost data on 25 million people.

Walport conceded that, in the case of public bodies, fines would involve taxpayers' money moving from one organisation to another. But he told GC News: "An organisation that hasn't got the right procedures (and is fined) will be in trouble at the top. A fine isn't everything, but it sends a pretty bad signal."

Thomas added that the fines would have "primarily a deterrent function," and would only be for reckless or deliberate breaches of data. The report says the fine schedule should include "high, but proportionate, maxima related to turnover".

Enforcement notices

Thomas has recently served enforcement notices on HM Revenue and Customs and the Ministry of Defence for their major data breaches, but said these will go forward under the law as it was before May, when his office gained the ability to take civil action for reckless or deliberate breaches of data through an amendment to the Criminal Justice and Immigration Act.

In its other recommendations, Walport and Thomas's report says that the edited electoral role – currently sold by local authorities commercially, holding data on all local voters who have not opted out of it – should be scrapped. The full electoral roll would remain, but as now would only be available for running elections, for political purposes and for credit reference agencies.

The report also says the government should establish a statutory fast-track process for new kinds of state sector data-sharing, although this would be subject to oversight from the information commissioner, a privacy impact assessment and a vote in both houses of Parliament.

The Information Commissioner's Office would become the Information Commission, with several commissioners and new work including the publication of a statutory code of practice on data-sharing. It would receive increased funding, by moving from the flat fees currently paid by data controllers such as government bodies to a multi-tiered system.

Thomas defended the recommendations to strengthen his office, saying that the vast majority of submissions by more than 200 organisations to the review had approved of this.

The report also says that the public should generally be able to see their own data online, rather than having to apply through subject access requests under the Data Protection Act. Walport said this would be beneficial for a variety of reasons in health, despite the sensitivity of the information, as it allows patients to correct errors.

"I think people are generally reassured when they can see their information online," he said, adding that good security equivalent to that used for online banking would be required.

This article was originally published at Kablenet.

Kablenet's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.

Top three mobile application threats

More from The Register

next story
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
APPLE FAILS to ditch class action suit over ebook PRICE-FIX fiasco
Do not pass go, do cough (up to) $840m in damages
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.