Information Commissioner’s Office should use existing powers to penalise data breaches and laptop theft

19 September 2011

The Information Commissioner’s Office (ICO) should focus on dishing out fines for data breaches, including unencrypted laptop theft, rather than calling for prison terms, a top lawyer has claimed.

Writing on Techmeerkat’s Blog, Valerie Surgenor, a partner at the MacRoberts law firm, criticises the ICO for not using its existing powers to impose monetary penalties for serious breaches of the Data Protection Act often enough.

Surgenor’s words follow calls by Information Commissioner Christopher Graham for custodial sentences for people who use stolen data or stolen laptops for personal gain.

However, Surgenor claims that increasing the maximum penalty or providing alternative sentencing powers will only act as a deterrent if these powers are used. She points to the fact that the ICO has only issued monetary penalties in a handful of cases in response to data breaches, including those resulting from the theft of unencrypted laptops containing personal information.

The ICO has had the authority to hand out fines of up to £500,000 for serious breaches of the data protection act since April 2010.

Surgenor goes on to explain that, where fines have been imposed, the penalties imposed have been significantly smaller than the maximum the body can impose and have predominately been issued to public bodies, meaning that public funds have been used to pay for laptop theft and other data breaches.

In February 2011, the Information Commissioner’s Office (ICO) served Ealing Council and Hounslow Council with monetary penalties totalling £150,000, following the theft of two unencrypted laptops. The ICO ruled that the councils had breached the Data Protection Act when the machines, containing details of around 1,700 individuals, were stolen from an employee’s home.

The UK’s expert in managing mobile computing, LapSafe® Products, believes that data breaches incurred as a result of unencrypted laptop theft could be mitigated if physical security restraints, such as security cables and laptop lockdowns, were used more often. Laptop theft can be both costly and dangerous, but using physical laptop security measures to keep mobile devices secure can prevent theft of important data in the first place and avoid costly regulatory fines.

Source: PCPro.co.uk and Techmeerkat.wordpress.com

Back to news