ICO set to issue fewer public sector fines to avoid ‘data breach victims being punished twice’

Written by Suzannah Brecknell on 1 July 2022 in News

Penalties for public bodies often impact services – rather than shareholders – according to commissioner John Edwards

Credit: Nick Youngson/CC BY-SA 3.0/Pix4free.org

The Information Commissioner’s Office has set out plans to improve the way it works with public sector bodies, focusing on raising standards and sharing good practice while reducing the impact of fines.

In an open letter, commissioner John Edwards said that the ICO will “still call out non-compliance and take robust enforcement action where necessary, but in future our primary focus will be on raising data protection standards across the board and preventing harms from occurring in the first place".

The new approach, to be trialled over the next two years, will see the ICO issue fines to public authorities in only the most serious cases. Instead, the watchdog will make greater use of wider powers such as warnings, reprimands and enforcement notices when a public body is found to have breached data protection rules.

“I am not convinced large fines on their own are as effective a deterrent within the public sector,” Edwards wrote. “They do not impact shareholders or individual directors in the same way as they do in the private sector but come directly from the budget for the provision of services. The impact of a public sector fine is also often visited upon the victims of the breach, in the form of reduced budgets for vital services, not the perpetrators. In effect, people affected by a breach get punished twice.”

Related content

Under the new approach, if the ICO considers giving a fine for a particular breach but decides against doing so, it will indicate this in its decision notice. This will include publishing the size of the fine the case would have attracted, with the aim of informing the wider economy about the levels of penalty others can expect from similar conduct.

Edwards said the new approach will “include working proactively with senior leaders across the public sector to encourage compliance, prevent harms before they occur and learn lessons when things have gone wrong”.

But, he added, the ICO “cannot do this on our own”, and he called for “accountability to deliver these improvements on all sides”.

To support this change, the Cabinet Office and Department for Digital, Culture, Media and Sport have agreed to create a cross-government senior leadership group to encourage compliance with high data protection standards. The ICO will also engage with the devolved administrations and the wider public sector to determine the most effective way to deliver improvements in these areas.

This revised approach is the first of several new initiatives that will be set out in the coming weeks as part of ICO25 – the ICO’s new three-year strategic vision – to empower organisations to innovate while using people’s data responsibly.


About the author

Suzannah Brecknell is editor of PublicTechnology sister publication Civil Service World, where this story first appeared. She tweets as @SuzannahCSW.

Share this page




Please login to post a comment or register for a free account.

Related Articles

ICO chief: “We are not ‘going easy’ on government”
29 November 2022

Commissioner claims that fining public bodies simply creates a ‘money-go-round’

EXCL: Cabinet Office alerted to data breach – and fails to respond for 10 days
25 November 2022

Personal details of civil servant and supplier exposed by inadequately redacted document, discovered by PublicTechnology

Cabinet Office fine over honours data breach slashed by 90% as ICO considers ‘current economic pressure’
3 November 2022

Regulator says that, while the original £500k penalty was proportionate, the reduced punishment signals changing approach to public sector

Courts workers confirm nine-day strike over IT issues
11 October 2022

PCS Union announces rescheduled industrial action in protest at problems caused by Common Platform system