Feeds

Public sector faces hefty fines for data breaches

Councils should scrap sales to database marketers

Security for virtualized datacentres

UK state-sector organisations could face seven-figure fines for data breaches, according to the review of data sharing ordered by the prime minister.

In a wide-ranging report, which also recommends the scrapping of the edited electoral roll, information commissioner Richard Thomas and Mark Walport, director of medical charity the Wellcome Trust, recommend that the government introduce fines which mirror those made by the Financial Services Authority (FSA) in such circumstances.

The FSA fined Norwich Union £1.26m in December 2007 after fraudsters gained the surrender of the pension funds of 74 customers. It also fined Nationwide Building Society £1m earlier last year after the theft of a laptop which held data on its 11 million customers.

Thomas and Walport said that the details of the fines have yet to be worked out, but added that they should be in place by November. Gordon Brown ordered their review last October – three weeks before HM Revenue and Customs lost data on 25 million people.

Walport conceded that, in the case of public bodies, fines would involve taxpayers' money moving from one organisation to another. But he told GC News: "An organisation that hasn't got the right procedures (and is fined) will be in trouble at the top. A fine isn't everything, but it sends a pretty bad signal."

Thomas added that the fines would have "primarily a deterrent function," and would only be for reckless or deliberate breaches of data. The report says the fine schedule should include "high, but proportionate, maxima related to turnover".

Enforcement notices

Thomas has recently served enforcement notices on HM Revenue and Customs and the Ministry of Defence for their major data breaches, but said these will go forward under the law as it was before May, when his office gained the ability to take civil action for reckless or deliberate breaches of data through an amendment to the Criminal Justice and Immigration Act.

In its other recommendations, Walport and Thomas's report says that the edited electoral role – currently sold by local authorities commercially, holding data on all local voters who have not opted out of it – should be scrapped. The full electoral roll would remain, but as now would only be available for running elections, for political purposes and for credit reference agencies.

The report also says the government should establish a statutory fast-track process for new kinds of state sector data-sharing, although this would be subject to oversight from the information commissioner, a privacy impact assessment and a vote in both houses of Parliament.

The Information Commissioner's Office would become the Information Commission, with several commissioners and new work including the publication of a statutory code of practice on data-sharing. It would receive increased funding, by moving from the flat fees currently paid by data controllers such as government bodies to a multi-tiered system.

Thomas defended the recommendations to strengthen his office, saying that the vast majority of submissions by more than 200 organisations to the review had approved of this.

The report also says that the public should generally be able to see their own data online, rather than having to apply through subject access requests under the Data Protection Act. Walport said this would be beneficial for a variety of reasons in health, despite the sensitivity of the information, as it allows patients to correct errors.

"I think people are generally reassured when they can see their information online," he said, adding that good security equivalent to that used for online banking would be required.

This article was originally published at Kablenet.

Kablenet's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
Drag queens: Oh, don't be so bitchy, Facebook! Let us use our stage names
Handbags at dawn over free content ad network's ID policy
Heavy VPN users are probably pirates, says BBC
And ISPs should nab 'em on our behalf
Italy's High Court orders HP to refund punter for putting Windows on PC
Top beaks slam bundled OS as 'commercial policy of forced distribution'
Former Bitcoin Foundation chair pleads guilty to money-laundering charge
Charlie Shrem plea deal could still get him five YEARS in chokey
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.