ICO Needs to Drop Fines and Impose Real Penalties

The Information Commissioner's Office (ICO) should drop its monetary penalties as they have not achieved anything and have not changed bad behaviour.

Speaking to IT Security Guru, privacy consultant Martin Hoskins said the fines are not achieving their purpose.

"If it is not changing behaviours, then it should not be allowed to continue as it is not fit for purpose. I've always been one for getting the chief executive to clean cars in the car park to make them personally accountable because otherwise it is just money and it takes money away from the service users," he said.

"None of us want bad behaviour, but how do we incentivise good behaviour and punish or stop bad behaviour? If it is clear that money has not altered behaviour or achieved behavioural change then they have failed and we should think of something else. How do we achieve good standards and what are they?"

Range of options

In response, an ICO spokesperson said: "The Information Commissioner's Office has a range of enforcement options, including monetary penalty notices of up to £500,000.

"When the breach is a criminal offence the ICO is continuing to call for more effective deterrent sentences, including the threat of prison, to stop the unlawful use of personal information."

The ICO's deputy commissioner and director for data protection David Smith previously said that it was pressing for custodial sentences, which would be "punishing for not doing things properly."

Accountable

Hoskins said that sentences would help as it would make the CEO accountable and stop them from becoming CEO of another company in 12 months time. "They have got to appreciate it is a career limiting measure to preside over a company which deliberately allows poor data handling standards," he said.

"You have got to make them think that something will happen to them. It is about time they were more accountable when things went wrong, and it would affect the next job they would have. We need a policy change, but there is less impact now as fewer people are talking about the fines."

Commenting, Dwayne Melancon, CTO of Tripwire, said: "Implementing fines for irresponsible behaviours relating to breaches seems like it should work, but I don't believe they will make much of a difference because they attempt to address the problem too late in the process. After all, you're penalising people for bad behaviour, but the consequences aren't felt until the horse has already left the barn.

"I'd much rather see an investment in catching problems earlier and creating pressure to develop good habits before a problem happens. Of course, that means an inspection and accreditation program which is much harder to implement and oversee, so I don't see it happening."

Custodial sentences

Melancon said that the proposed move toward custodial sentences could be a good idea as public shaming and business consequences for misbehaving will be noticed and work fairly well in other situations.

"The challenge in all of this is gauging intent and determining the level and source of incompetence. It's one thing to go after someone who's been willfully and knowingly irresponsible, it's quite another to condemn someone who didn't have the data needed to drive different outcomes. Finding the balance so that the consequences are just could be very difficult."

Dan Raywood is editor of IT Security Guru.