Lax security will cost firms dear, ICO warns

Firms face hefty fines for failing to protect data

The Information Commissioner's Office (ICO) today warned data controllers that it would soon be taking tougher action to curb what it called unacceptably high levels of data theft.

Speaking at an event for data controllers, deputy information commissioner David Smith said that of 711 reports about security breaches sent to the ICO in the past two years, 231 were related to theft.

Smith urged firms to tighten up their security measures and practices, warning them that failure to do so would mean risking hefty fines.

“Since November 2007, we have taken action against 54 organisations for the most reckless breaches... These breaches would trigger a significant fine for organisations were they to occur after the introduction of monetary penalties in 2010," he said.

"We are keen to encourage organisations to achieve better data protection compliance and we expect that the prospect of a significant fine for reckless or deliberate data breaches will focus minds at board level.”

The ICO is also looking to extend its role as an auditor, in a move that should encourage greater adherence to its rules.

Mick Gorrill, the assistant commissioner with responsibility for investigations, added, “People’s data has a value. Many breaches are avoidable and are often the result of poor management processes."