New data protection fines jump to £500,000
The Information Commissioner’s Office is getting tougher over data security with the imposition of fines of up to half a million pounds for serious breaches, something which could prove costly for careless marketeers.
“The Information Commissioner’s Office (ICO) will be able to order organisations to pay up to £500,000 as a penalty for serious breaches of the Data Protection Act,” said an ICO statement. “The ICO has produced statutory guidance about how it proposes to use this new power, which has been approved by the Secretary of State for Justice, and has been laid before Parliament this week.”
The size of the fine will be determined after an investigation to assess the gravity of the breach and will also be based on the the size and finances of the organisation at fault, whether the breach was accidental or deliberate, and how much distress the leak of information caused.
“The Information Commissioner will take a pragmatic and proportionate approach to issuing an organisation with a monetary penalty,” the ICO statement said. “Factors will be taken into account including an organisation’s financial resources, sector, size and the severity of the data breach, to ensure that undue financial hardship is not imposed on an organisation.”
“Getting data protection right has never been more important than it is today. As citizens, we are increasingly asked to complete transactions online, with the state, banks and other organisations using huge databases to store our personal details,” said Information Commissioner Christopher Graham. “When things go wrong, a security breach can cause real harm and great distress to thousands of people.”
“These penalties are designed to act as a deterrent and to promote compliance with the Data Protection Act. I remain committed to working with voluntary, public and private bodies to help them stick to the rules and comply with the Act. But I will not hesitate to use these tough new sanctions for the most serious cases where organisations disregard the law.”
The original Act came into force in 1984. Under the most recent Act of 1998, data can only be used for the purposes for which it is collected and cannot be given to others without the consent of the individual. Everybody has the right to see information that is held about them, with the exception of crime-related data.
The cost of data breaches is already staggeringly high for UK businesses; last year the average breach cost £1.7 million, or £60 for each identity lost. If the ICO’s bite turns out to be as big as its bark, this cost could exceed £2 million; a huge expense at a time when businesses and public sector bodies can ill afford to waste money.

































