Feeds

Government consults on possible £500,000 data breach fines

Hanging, drawing and quartering not an option

Internet Security Threat Report 2014

The Information Commissioner's Office (ICO) would have the power to fine organisations up to £500,000 for serious breaches of data protection principles under plans announced this week by the Ministry of Justice.

The consultation, Civil monetary penalties - setting the maximum penalty, asks just one question: whether the proposed maximum fine will provide the ICO with a proportionate sanction to impose on those seriously contravening the data protection principles.

Justice Minister, Michael Wills, said: "We want to ensure that the Information Commissioner's Office has the powers it needs and is able to impose robust penalties on those who commit serious breaches of data protection principles."

The Government decided not to follow the approach of other regulators that have the power to impose a penalty up to 10% of an organisation’s turnover.

"Following discussion with the ICO and consideration of the greater administrative burden involved in operating a turnover-based system, we are consulting only on a fixed maximum amount," says the consultation paper. "However, we consider it desirable that the maximum amount of the penalty should not be higher than the equivalent of 10% of the highest annual turnover of a small company."

The power to impose a civil monetary penalty on data controllers was created by section 144 of the Criminal Justice and Immigration Act 2008, which amends the Data Protection Act of 1988. The power is expected to be in force next April, according to the ICO.

The penalties can only be imposed when certain criteria are met.

  • There has been a "serious contravention" of one of the Act's eight principles; and
  • It has to have been of a kind likely to cause substantial damage or substantial distress and either: o the contravention was deliberate; or o the data controller knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but failed to take reasonable steps to prevent the contravention.

According to the Ministry of Justice, the ICO will exercise its discretion to assess the appropriate level of any penalty it imposes and will publish detailed guidance setting out the criteria it will use and circumstances it will take into consideration.

The consultation closes on 21st December 2009.

The consultation papers can be perused here.

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Providing a secure and efficient Helpdesk

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.