"The Information Commissioner's Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. ICO is an executive non-departmental public body, sponsored by the Department for Science, Innovation and Technology." https://www.gov.uk/government/organisations/information-comm...
Enforcement action by the IÇO is as rare as hen’s teeth, and when they do enforce, it’s a mild slap on the wrist for large businesses, and “put you out of business” for small businesses. Lose 2,000,000 sets of customer information because you accidentally left it public? Reprimand. Don’t do it again. 1000 spam calls? £100k fine. Go to prison.
If you have a U.K. Ltd company, you must pay them their annual fee.
Quite the gig they have. Do next to nothing, collect a tax on every business in the country.
Electoral commission: 40,000,000 U.K. voter records leaked. No fine. https://ico.org.uk/action-weve-taken/enforcement/the-elector...
Random company, 60,000 spam SMS, £120k fine. https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c...
Make it make sense.
Is it public knowledge how much FAANG companies pay?
The highest tier of fee is £2,900 per year, but you're looking at the wrong regulator - major tech companies invariably use Ireland or Luxembourg as their European headquarters, so most or all of their data processing activities (and subsequent investigation or enforcement) would take place under that jurisdiction.
Doesn't the Ireland trick (mainly for tax evasion) only work for the EU market? I'd assume after Brexit the UK would require local presence?
The UK copied the GDPR wholesale, the EU accepted a reciprocal arrangement based on this, so Brexit hasn't materially changed the situation.
https://ico.org.uk/for-organisations/data-protection-and-the...
They should simply be looking to prevent a re-occurrence and a fine on this type of organisation wouldn't help.
Perhaps they should have powers to prosecute executives.
Consider one example - you "process" (collecting, using, storing, viewing - literally anything) personal data in an electronic system without the latest security patch. Are you breaking GDPR/DPA18? Easily done, especially for sensitive data. "...taking into account the state of the art, the costs of implementation, ... the risk of varying likelihood and severity for the rights .. of natural persons ... the processor shall implement appropaite technical ... measures to ensure a level of security approapite to the risk" (DPA18 Art 32).
I imagine a large number of companies flout the above without realising. Especially when processing any information regarding health, criminal offense data, race, religion, philosophical beliefs etc, which is "special category data" and requires strong protections.
DPA18 Article 32 "Security of processing" - https://www.legislation.gov.uk/eur/2016/679/article/32
Most companies flout the 101 of GDPR.
Do you have a registry of the personal data processes you do? Are you able to hand it in less than 48h after receiving a request for them?
Do you do risk assessments when thinking about implementing a new data process?
And it's not only about electronic data. Paper files are concerned.
Yes it can feel like a lot but if you're handling people's personal data you should not be playing around. And if it's too hard, maybe "just" don't process personal data at all. Before GDPR we were already at a point where people just siphoned and stored people's data "in case it is useful later". Now some legislation is in place to make you think about why and how you get and store this kind of data, putting a price on doing it. It's a plus for the public.
Too bad if it does not help sell ads, scams or just abuse people.
Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt. The data protection fee only applies to businesses engaged in higher-risk data processing. The fee for a non-exempt business with turnover of <£632,000 is £40 per year.
https://ico.org.uk/for-organisations/data-protection-fee/dat...
The primary purpose of ICO enforcement is to ensure compliance. The general principle is that the sanction administered should be of the lowest level necessary to ensure compliance.
In your examples, the Electoral Commission suffered a breach due to a chain of vulnerabilities exploited by a sophisticated actor. In response to the ICO investigation, the Electoral Commission implemented a major overhaul of their security procedures including a formal process to manage and monitor patching and MFA. The ICO were satisfied that the EC had come into compliance and would remain compliant, so no fine was applied.
In theory only. I was a one man band with zero consumer data handling, and they insisted I pay the fee. Back when I had faith in institutions, I reported some really grievous mishandling of consumer data to them, several times, and they were not remotely interested.
> 1000 spam calls? £100k fine. Go to prison.
sounds just and deserved to me, fine spammers into nonexistence
> Quite the gig they have. Do next to nothing
Maybe you are right that there are serious problems with them (electoral commission failure should have been punished), but demolishing small scale spammers is already an useful service. I would fund it if I would be able to taking decision.
I would be happy to pay 1000 £ if that means that last person who spammed me goes bankrupt and to prison (for say 50 days).
> a mild slap on the wrist for large businesses, and “put you out of business” for small businesses
first one should be fixed if it is a problem so large spammers are also fined into nonexistence
and yes, I support putting their CEO into prison for 50 days if any part of their company does spam
I saw a post a few weeks ago on HN asking what's the point (in general) of using a UK legal firm when legal firms in US/EU/India exist (!).