Feeds

ICO slates local authorities on data protection compliance

Graham: You've been 'very bad'. Bend over

Combat fraud and increase customer satisfaction

The Information Commissioner has called for the commencement of the custodial element of the section 55 offences and expressly criticised data protection compliance by local authorities as being “very bad”.

He also criticised data controllers, especially in banks and financial services, as being uncooperative in relation to consensual data protection audits. He also anticipates that agreement over the text of a forthcoming data protection directive will be protracted and will take “years”.

These points were made in a wide ranging questioning by the House of Commons Justice Select Committee at a hearing yesterday.

The Commissioner made an impassioned plea for Parliament and government to commence the custodial element of the section 55 offence in order to make sure the panoply of the legal penalties would be available to the courts. Currently, the Commissioner complained that because a fine was the only penalty that could be imposed, this meant that other non-custodial penalties were unavailable to the courts (eg, community service orders).

This emphasis on non-custodial sentences is politically adroit. First, it does not involve custodial sentences, as the government wants to reduce the prison population. Secondly, the Commissioner is reminding Parliament that it can separate the issue of generally strengthening the section 55 offence, from the specific Special Purpose problems which can be properly left to the Leveson Inquiry (into phone hacking by journalists).

The Commissioner also revealed that the government is thinking of making the section 55 offence a “recordable offence”. This would mean that anyone prosecuted under the Act would have an entry on the DNA database for their lifetime. The Commissioner also noted that even under the current arrangements, the fine is a maximum £5,000, the going rate is about £100 to £150 per offence. This level of fine, he stated, was no deterrent at all.

The Commissioner stated that he has no powers of audit except in limited circumstances and made a plea for a general power of inspection in circumstances where there was reasonable cause to believe that data protection compliance was deficient. Currently only one in five data controllers agree to a consensual audit; the Commissioner strongly suggested that the financial services sector would be a focus if such powers were granted.

The Commissioner expressly pointed to the offence involving a Barclays Bank employee. The offence deals with the Section 55 prosecution of a bank employee, married to a person prosecuted for a sexual offence. The perpetrator's spouse accessed the financial records of the victim to check on the victim's spending habits). In this context, he expressly regretted that private sector data controllers are "backwards in coming forward" to volunteer for a data protection audit. The Commissioner said he could not understand why the offer of a “free audit” was rejected by 80 per cent of data controllers; in the context of the high street banks, the Commissioner called this stance “short sighted”.

The Commissioner recommended that “mystery shoppers” should be employed, especially in the area of disclosure. So if your organisation is employing penetration testing in relation to its security compliance, it might be useful to check whether disclosure procedures form part of those tests.

In relation to the forthcoming new text of the Directive, the Commissioner:

  • expected it to be published in November or December;
  • used the term “Framework Directive” – this implies that there will not be a Regulation to implement any new data protection rules;
  • wanted a “principle based” approach – this would mean that in any new legislation, the Commissioner would have more flexibility in relation to interpretation and enforcement of those principles in the light of technological developments;
  • focused on the Accountability Principle as being especially important – this Principle would firmly embed data protection into information governance structures;
  • expected that it would contain a power of inspection and audit;
  • expected that the negotiations over the text would take “years”; and
  • is holding a conference in the Spring to engage with data protection stakeholders.

Links

See the ICO’s evidence session video here (first 30 mins deal with DP).

More on the Leveson Inquiry into hacking here.

This story originally appeared at HAWKTALK, the blog of Amberhawk Training Ltd.

SANS - Survey on application security programs

More from The Register

next story
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
Jack the RIPA: Blighty cops ignore law, retain innocents' comms data
Prime minister: Nothing to see here, go about your business
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.