Feeds

ICO targets lost laptop breaches under tougher fine regime

Watchdog bares teeth at encryption refuseniks

Intelligent flash storage arrays

The deputy commissioner of the Information Commissioner's Office said that it is no longer a "toothless tiger" and has the resources and resolve to apply enhanced powers to data protection miscreants.

David Smith said increased fines of £500K, introduced in April, for the worse case of privacy breaches would "concentrate minds on getting it right". He stressed that the watchdog would far rather work with organisations towards this than resort to enforcement.

Experienced IT lawyer Dai Davis, of Brooke North, predicted that the increased fines would result in a handful of high-profile enforcement actions while resulting in little real change. He also argued that the ICO lacks the resources to mount a strong legal assault in the event of a corporation contesting a legal action. He cited the enforcement case against Halifax Bank over the use of credit reference agencies that went all the way to the House of Lords and culminated in failure back in the mid 1990s. The ICO avoided legal action for years afterwards.

Smith responded to questions on resources by saying that recent increases in data protection registration fees to £500 for larger firms would finance enforcements while also bankrolling greater use of audits. "We have to be effective. there is provision in legislation for us to ask for greater fees, if necessary," Smith told The Register.

"We are keen to use our new powers but will not act recklessly," he added. Smith added that firms that lost laptops that were not encrypted would be among the prime candidates for enforcement action, predicting a "handful" of cases over coming months.

During a keynote speech at InfoSecurity Europe 2010, Smith cited figures that showed the health service was responsible for almost a third of all reported data breaches in the UK. However, since the scheme is voluntary the picture it presents is incomplete. European legislation means that mandatory breach notification laws will be applied to telecom carriers within 18 months.

"Data protection is a widespread problem not confined to the public sector," Smith commented. Lost data or hardware and stolen data or hardware were the two most common causes of data protection problems. Lack of awareness about data protection, failure to take responsibility and use of legacy systems (such as unencrypted laptops) and policies were among the problems holding back better protection of public data, Smith said.

Smith wants to see mandatory notification in cases where personal data might have been exposed but not in situations where an encrypted laptop was lost, for example. He also wants to see private investigators who used trickery to obtain confidential records jailed. ®

Beginner's guide to SSL certificates

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Big Content outs piracy hotbeds: São Paulo, Beijing ... TORONTO?
MPAA calls Canadians a bunch of bootlegging movie thieves
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
Hungary's internet tax cannot be allowed to set a precedent, says EC
More protests planned against giga-tariff for Tuesday evening
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.