Feeds

Government consults on possible £500,000 data breach fines

Hanging, drawing and quartering not an option

Remote control for virtualized desktops

The Information Commissioner's Office (ICO) would have the power to fine organisations up to £500,000 for serious breaches of data protection principles under plans announced this week by the Ministry of Justice.

The consultation, Civil monetary penalties - setting the maximum penalty, asks just one question: whether the proposed maximum fine will provide the ICO with a proportionate sanction to impose on those seriously contravening the data protection principles.

Justice Minister, Michael Wills, said: "We want to ensure that the Information Commissioner's Office has the powers it needs and is able to impose robust penalties on those who commit serious breaches of data protection principles."

The Government decided not to follow the approach of other regulators that have the power to impose a penalty up to 10% of an organisation’s turnover.

"Following discussion with the ICO and consideration of the greater administrative burden involved in operating a turnover-based system, we are consulting only on a fixed maximum amount," says the consultation paper. "However, we consider it desirable that the maximum amount of the penalty should not be higher than the equivalent of 10% of the highest annual turnover of a small company."

The power to impose a civil monetary penalty on data controllers was created by section 144 of the Criminal Justice and Immigration Act 2008, which amends the Data Protection Act of 1988. The power is expected to be in force next April, according to the ICO.

The penalties can only be imposed when certain criteria are met.

  • There has been a "serious contravention" of one of the Act's eight principles; and
  • It has to have been of a kind likely to cause substantial damage or substantial distress and either: o the contravention was deliberate; or o the data controller knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but failed to take reasonable steps to prevent the contravention.

According to the Ministry of Justice, the ICO will exercise its discretion to assess the appropriate level of any penalty it imposes and will publish detailed guidance setting out the criteria it will use and circumstances it will take into consideration.

The consultation closes on 21st December 2009.

The consultation papers can be perused here.

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.