Heavier Data Protection Fines Coming

Companies can be fined up to £500,000 should they break data protection laws, as part of new powers unveiled by the Information Commissioner's Office (ICO).

The heavier fines were presented before Parliament earlier this week, before being approved by the Secretary of State for Justice, Jack Straw. The penalties are designed to deter personal data security breaches by urging full compliance with the Data Protection Act.

The £500,000 penalty would be served only in serious breaches of the Act. The ICO said: "When serving monetary penalties, the Information Commissioner will carefully consider the circumstances, including the seriousness of the data breach; the likelihood of substantial damage and distress to individuals; whether the breach was deliberate or negligent and what reasonable steps the organisation has taken to prevent breaches."

The new powers come into force on April 6.

Data Protection Breach

Christopher Graham, Information Commissioner, explained the rationale behind the penalties. He said: "Getting data protection right has never been more important than it is today. As citizens, we are increasingly asked to complete transactions online, with the state, banks and other organisations using huge databases to store our personal details. When things go wrong, a security breach can cause real harm and great distress to thousands of people."

The ICO stressed that any monetary penalties would be "pragmatic and proportionate", and that each data protection breach is dealt with individually taking into account specific circumstances. However, Christopher Graham added: "I will not hesitate to use these tough new sanctions for the most serious cases where organisations disregard the law."

Data Protection Compliance

The new penalties are clearly designed to ensure organisations bolster their data protection compliance procedures. In specifics, the ICO says that for a data breach to attract a monetary penalty they must be satisfied that the breach "was likely to cause damage or distress and it was either deliberate or negligent and the organisation failed to take reasonable steps to prevent it."

For full details of the new penalties, use this link to the ICO's guidance.

Source _ Security International's UK Correspondent

Recent Related News:

Data Protection and Privacy Laws Aren't Protecting People, EU Says