13/05/2008 - Headlines - Security
New rules allow 'substantial fines' for data breaches
Organisations will now face "substantial fines" for breaching data protection regulations, following a last minute amendment to new legislation.The Criminal Justice and Immigration Act has received Royal Assent creating tough new sanctions for privacy watchdog, the Information Commissioner’s Office (ICO). Under existing legislation the ICO only has powers to issue an enforcement notice against organisations in breach of the Data Protection Act (DPA).
The move followed a defeat for the Government in the House of Lords. Last month the Conservatives and Liberal Democrats tabled an amendment to the Criminal Justice and Immigration Bill calling for stronger sanctions for intentionally or recklessly disclosing information.
Defeated by four votes in the Lords, the Government chose to introduce its own amendment giving the ICO the power to impose fines on organisations that deliberately or recklessly commit serious breaches of the Data Protection Act.
Deputy Information Commissioner, David Smith, said: "The prospect of substantial fines for deliberate or reckless breaches of the data protection principles will act as a strong deterrent and help ensure that organisations take their data protection obligations more seriously."
'Data protection matters'
Mr Smith added: "This new power will enable some of the worst breaches of the Data Protection Act to be punished.
"The fact that strengthening the Data Protection Act has cross party support demonstrates the growing consensus on importance of effective data protection."
The move was spurred on by a number of high profile data losses occurring in both the public and private sectors, in particular the HMRC's loss of 25 million people's details on two CDs. However, it was not anticipated that the Government would act so quickly.
Dr Chris Pounder, an information law specialist at Pinsent Masons said: "The new powers were not expected. I suspect they've come as a surprise to the Information Commissioner as well."
He added that some details of the new powers had yet to be published, and that the Secretary of State would still need to define a maximum penalty in regulations.