Senior ICO official defends penalties levied on councils for data breaches

A senior official at the Information Commissioner’s Office has defended the substantial penalties levied on local authorities for data protection breaches, and insisted that the regulator does not see the public sector as a soft touch compared to private companies.

So far the only penalties levied by the ICO for such breaches have been imposed on three local authorities and a business, A4e, providing a service to the public through a community legal advice centre. The councils hit by the penalties were Hertfordshire County Council (£100,000), Ealing Council (£80,000) and Hounslow (£70,000).

But in an interview with Local Government Lawyer, Deputy Information Commissioner Graham Smith said: “I can certainly say that there is no kind of policy distinction in the mind of the ICO. [It is not the case that] we are looking for these things in the public sector rather than the private sector – quite the opposite, if anything.”

The ICO’s workload was driven by the complaints it received and when breaches are brought to its attention, he added. The regulator has had powers to impose monetary penalties since April 2010.

Asked whether the penalties could be justified at a time of severe spending cuts and when the substantial amounts involved could for example meet the cost of employing, say, two social workers, Smith argued that this was not comparing like with like.

He added that the penalties would have a significant deterrent effect on other local authorities and public bodies, and that it was important to consider the actual and potential consequences of a loss of sensitive personal information.

In a wide-ranging interview, Smith also:

• Praised local authorities for their improved performance in relation to dealing with freedom of information requests
• Said that those councils and public bodies named and shamed on the ICO’s initial list of organisations to be monitored for delays in responding to requests had raised their game. However, he revealed that other local authorities and public bodies are likely to be included in the list shortly
• Urged local authorities to be more confident in using – in appropriate cases – the Freedom of Information Act’s provisions relating to vexatious complainants
• Expressed concern that local authorities and other public bodies would seek to cut their expenditure on dealing with FOI and data protection, leading to a loss of experience and expertise. This would be a “false economy”, he argued.

To read the interview in full, click here.

Philip Hoult