Hacker News Reader

Comment by madaxe_again | Hacker News Reader

The hell they do.

Enforcement action by the IÇO is as rare as hen’s teeth, and when they do enforce, it’s a mild slap on the wrist for large businesses, and “put you out of business” for small businesses. Lose 2,000,000 sets of customer information because you accidentally left it public? Reprimand. Don’t do it again. 1000 spam calls? £100k fine. Go to prison.

If you have a U.K. Ltd company, you must pay them their annual fee.

Quite the gig they have. Do next to nothing, collect a tax on every business in the country.

Electoral commission: 40,000,000 U.K. voter records leaked. No fine. https://ico.org.uk/action-weve-taken/enforcement/the-elector...

Random company, 60,000 spam SMS, £120k fine. https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c...

Make it make sense.

View on HN

>If you have a U.K. Ltd company, you must pay them their annual fee.

Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt. The data protection fee only applies to businesses engaged in higher-risk data processing. The fee for a non-exempt business with turnover of <£632,000 is £40 per year.

https://ico.org.uk/for-organisations/data-protection-fee/dat...

The primary purpose of ICO enforcement is to ensure compliance. The general principle is that the sanction administered should be of the lowest level necessary to ensure compliance.

In your examples, the Electoral Commission suffered a breach due to a chain of vulnerabilities exploited by a sophisticated actor. In response to the ICO investigation, the Electoral Commission implemented a major overhaul of their security procedures including a formal process to manage and monitor patching and MFA. The ICO were satisfied that the EC had come into compliance and would remain compliant, so no fine was applied.

>> Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt

In theory only. I was a one man band with zero consumer data handling, and they insisted I pay the fee. Back when I had faith in institutions, I reported some really grievous mishandling of consumer data to them, several times, and they were not remotely interested.

> 60,000 spam SMS, £120k fine

> 1000 spam calls? £100k fine. Go to prison.

sounds just and deserved to me, fine spammers into nonexistence

> Quite the gig they have. Do next to nothing

Maybe you are right that there are serious problems with them (electoral commission failure should have been punished), but demolishing small scale spammers is already an useful service. I would fund it if I would be able to taking decision.

I would be happy to pay 1000 £ if that means that last person who spammed me goes bankrupt and to prison (for say 50 days).

> a mild slap on the wrist for large businesses, and “put you out of business” for small businesses

first one should be fixed if it is a problem so large spammers are also fined into nonexistence

and yes, I support putting their CEO into prison for 50 days if any part of their company does spam

Agreed - my main problem with them is the asymmetry of their enforcement actions. I think the fine for the spammers I gave as an example was just and appropriate, but again and again, if you look at any large organisation, they almost always just get a reprimand, or a fine that’s just a cost of doing business - if they are investigated at all. I reported a large IT supplier who are currently embroiled in a different scandal in the U.K. many years ago, because they were playing fast and loose with medical records. No action, no investigation, nothing.

Is there any government anywhere doing uniform fair enforcement? This problem seems to be global. And it's definitely a problem, no argument from me.

I was absolute fuming when I got my letter from them demanding I pay them money. I knew I was closing my company down in the coming years and ignored them in the end. It's crazy this is allowed to be honest.

What did they allege?

Well, that's what you get if you lower taxes on businesses. Otherwise some brick and mortar shop might rightfully complain why do I have to pay taxes for regulating companies that ruin my business.

Is it public knowledge how much FAANG companies pay?

>Is it public knowledge how much FAANG companies pay?

The highest tier of fee is £2,900 per year, but you're looking at the wrong regulator - major tech companies invariably use Ireland or Luxembourg as their European headquarters, so most or all of their data processing activities (and subsequent investigation or enforcement) would take place under that jurisdiction.

That's of course far too cheap for FAANG companies.

Doesn't the Ireland trick (mainly for tax evasion) only work for the EU market? I'd assume after Brexit the UK would require local presence?

>I'd assume after Brexit the UK would require local presence?

The UK copied the GDPR wholesale, the EU accepted a reciprocal arrangement based on this, so Brexit hasn't materially changed the situation.

https://ico.org.uk/for-organisations/data-protection-and-the...

Yeah, when I got the ICO fee extortion letter, they were put in my total scam category. Even when I realised they had some actual official purpose in collecting fees, I still viewed them as a scam, so they have a PR issue more than anything.

Personally I do wish they would intervene more, but if you consider how broad GDPR/DPA18 is I honestly don't think they can enforce it in the way a normal person would expect. Either it's a legislative issue (i.e., legislate better) or we accept these attempts at "balance". It's usually not the institutions weakness it's the legislation or the framework in which they exist.

Consider one example - you "process" (collecting, using, storing, viewing - literally anything) personal data in an electronic system without the latest security patch. Are you breaking GDPR/DPA18? Easily done, especially for sensitive data. "...taking into account the state of the art, the costs of implementation, ... the risk of varying likelihood and severity for the rights .. of natural persons ... the processor shall implement appropaite technical ... measures to ensure a level of security approapite to the risk" (DPA18 Art 32).

I imagine a large number of companies flout the above without realising. Especially when processing any information regarding health, criminal offense data, race, religion, philosophical beliefs etc, which is "special category data" and requires strong protections.

DPA18 Article 32 "Security of processing" - https://www.legislation.gov.uk/eur/2016/679/article/32

> I imagine a large number of companies flout the above without realising.

Most companies flout the 101 of GDPR.

Do you have a registry of the personal data processes you do? Are you able to hand it in less than 48h after receiving a request for them?

Do you do risk assessments when thinking about implementing a new data process?

And it's not only about electronic data. Paper files are concerned.

Yes it can feel like a lot but if you're handling people's personal data you should not be playing around. And if it's too hard, maybe "just" don't process personal data at all. Before GDPR we were already at a point where people just siphoned and stored people's data "in case it is useful later". Now some legislation is in place to make you think about why and how you get and store this kind of data, putting a price on doing it. It's a plus for the public.

Too bad if it does not help sell ads, scams or just abuse people.

I don’t have a problem with the fines for the spam texters, if anything it should be higher, but not punishing the electoral commission for that is utterly insane.

What purpose would punishing the Electoral Commission with a fine serve? It's a public body funded by taxpayer money.

They should simply be looking to prevent a re-occurrence and a fine on this type of organisation wouldn't help.

Perhaps they should have powers to prosecute executives.

I absolutely agree that the enforcement is significantly lacking and this "regulator" is useless, but I'm wondering why you are angry that someone got a fine for SMS spam? Some enforcement is still better than no enforcement at all as long as the underlying basis is just, and there should be zero sympathy for spammers out there.

I often wonder why on earth is UK suppose to compete in the Global Stage.

Interesting so UK cannot impose rules on companies that operate and making billions in revenue in UK because "UK small". But when both a much smaller economy than UK like Australia imposes a rule on big tech like the news law, it is much different in challenging big tech.

I saw a post a few weeks ago on HN asking what's the point (in general) of using a UK legal firm when legal firms in US/EU/India exist (!).

Reply on news.ycombinator.com