Lawyer questions ICO after further fines hit councils

 

Gallery

By Stewart Mitchell

Posted on 8 Feb 2011 at 15:02

An IT lawyer has questioned why the Information Commissioner's Office appears to be targeting only Government bodies with fines.

The ICO today announced its second round of fines since being given the power to dole out financial punishment last year, with Ealing Council and Hounslow Council both slapped with monetary penalties after losing unencrypted laptops containing sensitive personal information.

The fines follow two penalties handed out last year, one to Hertfordshire County Council and another to a largely publicly-funded training company called A4e, while private companies have so far escaped the ICO's wrath.

Perhaps the councils are an easier target than private companies

“They are all councils and an employment company that was publicly funded, so we are looking at public bodies being targeted,” said Valerie M Surgenor, an IT and IP specialist lawyer.

“We need to ask why is this the case when we can see from notices on the ICO website that breaches are also carried out by private companies on a regular basis, but it would appear they don't seem to be getting targeted.”

After the first round of fines last year, PC Pro readers noted that fining councils effectively means taxpayers foot the bill. Surgenor agreed that the source of the money could have a bearing on the perceived bias against organisations with public sector ties.

“We should be asking what's happening and the reasoning behind it – and you could be quite cynical,” she said. ”Perhaps the councils are an easier target than private companies."

“Is it that the money to pay the fine isn't coming out of the directors' pockets?" she said. "It's coming out of somebody else's pot of money - most private companies would fight categorically a monetary penalty.”

She noted that councils are potentially not as well funded and have less access to legal recourse, whether through lawyers able to advise on preventative best practices, or fighting against a fine.

“If the ICO were to target a private organisation it would probably be a larger company, one that uses data on a daily basis as part of its business,” Surgenor said.

“In that case, you're looking at banks and telecommunications companies, and they should have access to data protection lawyers.”

The ICO fined Ealing Council £80,000, and dished out a £70,000 penalty for Hounslow Council over two lost laptops. Neither was encrypted although both were password protected.

A spokesperson for the ICO denied the office was specifically targeting publicly funded organisations, saying: ”We look at each case on its merits – there's no long-term strategy.”