Feeds

Data loss fines hit £500K from today

Hundredfold increase to scare firms into shape

Providing a secure and efficient Helpdesk

From Tuesday 6 April, the Information Commissioner’s Office (ICO) will get enhanced powers to fine organisations up to £500,000 for serious breaches of the Data Protection Act. Previously the maximum fine was a paltry £5,000.

The tougher measures will be imposed alongside compulsory audit notices to central government departments found culpable for data breaches. The new powers for the UK's privacy watchdog are designed to deal with serious personal data breaches that arise through negligent behaviour. Precautions an organisation had previously applied as well as the circumstances of a breach will be taken into account in deciding a fine.

Revised guidelines (pdf) state that the most severe fines will be imposed in cases where the "data controller has seriously contravened the data protection principles and the contravention was of a kind likely to cause substantial damage or substantial distress".

The enhanced powers for the ICO were approved by parliament three months ago. However a recent survey found that two thirds of 500 city workers (65 per cent) are still blissfully unaware that they could cost their organisation £500K if their actions cause a “deliberate or negligent” breach of personal data. The study, sponsored by Cyber-Ark Software, found that employers are often doing little or nothing to inform workers of important changes in UK data privacy rules.

The survey found that 64 per cent of those quizzed carry customer data on mobile devices, with only 12 per cent using encryption to protect data from prying eyes in the event of a loss. A further 50 per cent of mobile devices are protected only by basic password defences, and 38 per cent store sensitive data without any protection at all.

CyberARk called on firms to develop and apply appropriate security policies to minimise the impact of device loss, which now carries the possibility of much larger fines.

However other security watchers are unconvinced that the increased fines alone will prompt major changes in behaviour by corporates, at least in the short term. That's because far too many organisations still reckon that data breaches are something that happen only to other people, despite reports of data loss stories almost every day.

Chris McIntosh, CEO of Stonewood, said:

Despite the danger to reputation and business that can come from a data loss, it is still a hard truth that many organisations feel they will be one of the fortunate few that remain untouched. As a result, planning for options such as encryption and the correct handling of data is put off for another day.

While this report will be a useful tool to those seeking to convince their organisations to secure data, it does not address the crucial issue of organisations trusting to luck.

Amichai Shulman, chief technology officer with data security specialist Imperva, drew parallels between the enforcement of the DPA and that of the Payment Card Industry Data Security Standards (PCI DSS) imposed on credit card merchants.

"PCI DSS," he explained, "takes the pragmatic approach of defining exactly what has to be done and effectively giving the IT manager a blueprint for their data security plans." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.