The UK’s data watchdog is to scale back fines for public bodies after admitting that users of services often bear the brunt of the financial punishment.
The Information Commissioner’s Office will continue to issue fines for the most serious cases of data breaches in the public sector, but otherwise it will lean on other powers within its remit such as warnings, reprimands and enforcement notices.
John Edwards, the information commissioner, said he was not convinced that fines levied on the public sector were an effective deterrent.
“[Fines] do not impact shareholders or individual directors in the same way as they do in the private sector but come directly from the budget for the provision of services,” Edwards wrote in an open letter published on Thursday.
“The impact of a public sector fine is also often visited upon the victims of the breach, in the form of reduced budgets for vital services, not the perpetrators. In effect, people affected by a breach get punished twice.”
Edwards said the ICO was launching a two-year trial of the new approach, which will include revealing the scale of the fine that might have been levied in certain cases, in order to warn the commercial sector about the scale of penalty they could expect as a result of similar conduct.
Examples of ICO public sector punishments include a £500,000 fine imposed on the Cabinet Office last December after the postal addresses of the 2020 New Year honours recipients were disclosed online. The largest ever fine imposed by the ICO was a £20m punishment for British Airways following a hack of customer data in 2018
The ICO said that in light of the new approach it had reduced two public sector fines for breaching the data protection act. A potential fine of £784,000 for the Tavistock & Portman NHS foundation trust, for accidentally revealing the email addresses of patients at the adult gender identity clinic, has been reduced to £78,400. The ICO said the trust had taken prompt action over the breach, which occurred because patients had not been bcc’d in the address field for an email inviting them to take part in an artwork competition.
In the second case, the NHS Blood and Transplant Service released an untested code for matching organ donations to patients in 2019. As a result, five patients awaiting livers were not matched with potentially available organs. However, the error was spotted and fixed a week later, with no serious harm caused to the patients affected. The ICO said a fine of nearly £750,000 for the incident has been reduced to a public reprimand.
