Feeds

Data loss fines hit £500K from today

Hundredfold increase to scare firms into shape

Designing a Defense for Mobile Applications

From Tuesday 6 April, the Information Commissioner’s Office (ICO) will get enhanced powers to fine organisations up to £500,000 for serious breaches of the Data Protection Act. Previously the maximum fine was a paltry £5,000.

The tougher measures will be imposed alongside compulsory audit notices to central government departments found culpable for data breaches. The new powers for the UK's privacy watchdog are designed to deal with serious personal data breaches that arise through negligent behaviour. Precautions an organisation had previously applied as well as the circumstances of a breach will be taken into account in deciding a fine.

Revised guidelines (pdf) state that the most severe fines will be imposed in cases where the "data controller has seriously contravened the data protection principles and the contravention was of a kind likely to cause substantial damage or substantial distress".

The enhanced powers for the ICO were approved by parliament three months ago. However a recent survey found that two thirds of 500 city workers (65 per cent) are still blissfully unaware that they could cost their organisation £500K if their actions cause a “deliberate or negligent” breach of personal data. The study, sponsored by Cyber-Ark Software, found that employers are often doing little or nothing to inform workers of important changes in UK data privacy rules.

The survey found that 64 per cent of those quizzed carry customer data on mobile devices, with only 12 per cent using encryption to protect data from prying eyes in the event of a loss. A further 50 per cent of mobile devices are protected only by basic password defences, and 38 per cent store sensitive data without any protection at all.

CyberARk called on firms to develop and apply appropriate security policies to minimise the impact of device loss, which now carries the possibility of much larger fines.

However other security watchers are unconvinced that the increased fines alone will prompt major changes in behaviour by corporates, at least in the short term. That's because far too many organisations still reckon that data breaches are something that happen only to other people, despite reports of data loss stories almost every day.

Chris McIntosh, CEO of Stonewood, said:

Despite the danger to reputation and business that can come from a data loss, it is still a hard truth that many organisations feel they will be one of the fortunate few that remain untouched. As a result, planning for options such as encryption and the correct handling of data is put off for another day.

While this report will be a useful tool to those seeking to convince their organisations to secure data, it does not address the crucial issue of organisations trusting to luck.

Amichai Shulman, chief technology officer with data security specialist Imperva, drew parallels between the enforcement of the DPA and that of the Payment Card Industry Data Security Standards (PCI DSS) imposed on credit card merchants.

"PCI DSS," he explained, "takes the pragmatic approach of defining exactly what has to be done and effectively giving the IT manager a blueprint for their data security plans." ®

Securing Web Applications Made Simple and Scalable

More from The Register

next story
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.