ICO supports prison sentences for serious breaches

In a response to an MoJ call for evidence, the ICO says it supports prison sentences for serious breaches of the Data Protection Act.


The most serious breaches of the Data Protection Act should carry with them the threat of imprisonment, according to information commissioner Christopher Graham.

In the Information Commissioner's Office (ICO) response to a Ministry of Justice call for evidence on the effectiveness of the European Data Protection Directive and the Data Protection Act (DPA), the watchdog said prison sentences should be a deterrent against breaking the law.

"It is widely evidenced that the greatest threat to information security in organisations is individuals, yet the DPA only provides for a fine for those individuals who knowingly or recklessly obtain or disclose personal data, or procure someone else to do this for them," the body said.

"The information commissioner considers that the trade in personal information justifies the possibility of a custodial sentence for the most serious offences."

Advertisement - Article continues below
Advertisement - Article continues below

Currently, individuals who breach the DPA can be issued with a 5,000 in the Magistrates Court, or an unlimited fine in the High Court.

Introduction of prison sentences was agreed on in 2008, but no one has been punished with a custodial sentence to date.

The response also noted the commissioner's support for enforced notification, again for more serious breaches.

"Although there is currently no legal obligation on data controllers to report breaches of security which result in loss, release or corruption of personal data, the information commissioner believes serious breaches should be brought to the attention of his office," the ICO said.

However, if disclosure does become a requirement, there needed to be a better definition of what constitutes a serious breach "on the basis of risk," the body suggested.

"If all security breaches are to be notified, this could create the potential for huge and disproportionate administrative burdens for both businesses who have to notify breaches regardless of their seriousness, and for the regulator who has to administer those breach notifications," the watchdog added.

Advertisement - Article continues below

"This could divert scarce resources from other, more effective regulatory activity."

Response to a response

Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group, said the ICO's response was a safe one and it offered nothing "innovative."

The only area where Room saw the ICO coming unstuck was in the watchdog's call for direct regulation of data processors.

Advertisement - Article continues below

"My main reason for saying that is that I think the regime works alright. I don't think it needs to change," he told IT PRO.

Room did agree, however, with the commissioner's call for the amendment to section 13 of the DPA, which would give people rights to pursue compensation claims for distress, regardless of whether they had suffered financial loss.

Advertisement - Article continues below

"The amendment to section 13, it seems an inevitable outcome," he said.

"The problem for the Government is that if they resist that change then they are putting themselves on the wrong side of the debate, they are arguing the losing position. They are also putting themselves on the opposite side to the UK citizen, or the voter."

Room also said the commissioner was wrong to not call for greater financial powers.

"This is where I feel the commissioner is not serving data protection well," he added.

"Half a million pound fine, I know as a fact from what people have told me, they consider it to be a joke and they are not factoring it in."

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Information Commissioner

What is the Information Commissioner’s Office (ICO)?

5 Sep 2019
data protection

Bounty fined by ICO for unlawfully sharing member data

15 Apr 2019

Most Popular


How to use Chromecast without Wi-Fi

5 Feb 2020

The top ten password-cracking techniques used by hackers

10 Feb 2020
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020