Venyu Blog

On April 6, 2010, when the enforcement and remedies portion of the UK government’s Data Protection Act became law it became eminently clear that our parliamentary progenitors across the pond know how to deal with and deter companies from letting their guard down. With the ability to fine companies up to half a million pounds (or about $750,000) per event for businesses that break its provisions, the law gets right to the heart of where it hurts these organizations the most, namely their wallets.

The Information Commissioner’s Office (ICO) was first granted the power to issue the large penalty in January. Fines will be issued if the ICO judges there has been a serious breach that was likely to cause damage or distress. Examples include when financial data is lost and an individual becomes the victim of identity fraud, or if data is stolen and an individual suffers worry and anxiety.

As the news article points out, however, the penalties could have been worse. In fact, a whole lot worse. In November, in response to a government consultation that a penalty of two years’ jail time should be set as the maximum, Christopher Graham, the Information Commissioner, said,  ”In many cases a fine alone will be looked on by the offender as little more than a business expense or simply as a risk worth taking.”

The article further makes note that at least 70% of UK organizations suffered a data breach in 2009 and that the addition of a half million pound fine, according to a data encryption marketing director, “should in theory provide enough of a financial deterrent for organizations reluctant to invest in their security strategies.”

This news got me to wondering how long any of the US-based companies that have suffered data breaches over the last year alone, some through no fault of their own and some otherwise, could make it in the UK without running headlong (and pockets-deep) into these fines.

At the end of the day for us, like our UK counterparts, protecting (or not protecting) customer data all comes down to the cost of doing business, right?