Secure USB Drive

It’s been talked about for some time, but now the UK’s information watchdog, the Information Commissioner’s Office, will soon be able to penalize companies that are proven to have acted recklessly or maliciously with personal data.

From April 2010, the ICO will be able to fine companies up to £500,000 (over $800,000) for serious data security breaches. The size of the fine will be linked to size and finances of the organisation at fault, the problems the breach has caused and if it was accidental or deliberate.

This is a significant step up in the ICO’s powers, which were previously limited to public warnings to “name and shame” organisations at fault. Although these were accompanied by signed undertakings that companies would apply new data security measures, such as mandatory encryption of data on removable storage media, the ICO could not previously apply specific penalties.

With impending EU legislation, and many US states adopting versions of the California SB 1386 disclosure laws, organizations found guilty of negligent data handling can expect penalties to increase – so now is a good time to review data security strategies.