A Parliamentary ambush has handed new powers to the Information Commissioner’s Office (ICO) allowing the privacy watchdog to impose fines on organisations that “deliberately or recklessly” violate the Data Protection Act.
The new powers were created by an opposition amendment to the Criminal Justice and Immigration Act, which received Royal Assent on 9 May.
Following recent data losses by Whitehall departments, the government had set in train a review of the data protection penalty regime. But when the Criminal Justice and Immigration bill reached the House of Lords, Liberal Democrat Lady Miller put forward an amendment to make reckless data loss a criminal offence, which won cross-party support. When the bill reached the Commons, the amendment was agreed in principle, but the sanction changed to a civil offence before the bill was passed.
As a result, the Criminal Justice Act changes now constitute part of the Data Protection Act.
Dr Chris Pounder, an information law specialist at Pinsent Masons and contributor to its Out-law.com site, explained that the new powers were not expected, adding: “I suspect they’ve come as a surprise to the Information Commissioner as well.”
The new powers enable the Information Commissioner to serve a “monetary penalty notice” on a data controller who breaches the act if the regulator is satisified that the offence was deliberate or that the data controller knew, or ought to have known, of the contravention risk, and failed to take reasonable steps to prevent the breach.
Deputy Information Commissioner David Smith commented in an official release: “The prospect of substantial fines for deliberate or reckless breaches of the Data Protection Principles will act as a strong deterrent and help ensure that organisations take their data protection obligations more seriously.
“This new power will enable some of the worst breaches of the Data Protection Act to be punished. By demonstrating that the law is being taken seriously tougher sanctions will help to reassure individuals that data protection matters and give them confidence that organisations have no choice but to handle personal information properly.”
The actual guidelines for the penalty regime have yet to be published by the government, said Pounder.
The text of the amended Criminal Justice and Immigration Act can be downloaded from the Parliament website (99kb PDF).
