UK proposes £500,000 fine for data breaches

The British government launched a consultation on implementing a maximum penalty of £500,000 for serious breaches of the Data Protection Act.

If the proposals are enacted into law, the Information Commissioner would have the power to issue a “monetary penalty notice” if a company breaks any of the data protection principles.

In draft guidance on how the new proposals would be enforced, the Information Commissioner said a penalty notice would only be used as a punishment where there has been a deliberate or reckless handling of personal data.

The size of the penalty is likely to reflect the financial resources of the offending company, the sector in which it operates and the seriousness of the breach.

The consultation asks whether the fine will provide the Information Commissioner's with a proportionate sanction to impose on those seriously contravening the UK’s data protection principles.

At present, the Information Commissioner only has limited powers to punish offenders of the Data Protection Act. The Government clearly believes that these alone are not appropriate sanctions for serious breaches of the law.

The Government has also proposed introducing two year prison sentences for offences of unlawfully obtaining personal data.

Justice Minister, Michael Wills, said: “The government is committed to ensuring that personal data is handled and processed responsibly and lawfully. We want to ensure that the Information Commissioner's Office has the powers it needs and is able to impose robust penalties on those who commit serious breaches of data protection principles.”

Following discussions with the ICO, the government thinks that a fixed maximum penalty will give the Information Commissioner the flexibility and discretion to deal effectively with a large number and range of data controllers.

Data Protection Act was put into practice in 1998 it gives people the right to know what information is held about them, and sets out rules to make sure that this information is handled properly.

The consultation closes on 21 December 2009.