An update on the ICO's monetary penalty consultation - recent draft guidance has set the maximum penalty for serious breaches of the Data Protection Act at £500k. The ICO believes this is a proportionate sanction for serious contraventions of the data protection principles, and has stated that the possibility of a monetary penalty 'should act as an encouragement towards compliance, or at least as a deterrent against non-compliance' on the part of data controllers.
The guidance states that, following an investigation to determine whether there has actually been such a contravention, the Commissioner will determine whether a monetary penalty is appropriate and the amount of that penalty firstly based on the underlying aim of the measures to promote compliance with the DPA and then based on the circumstances of the particular breach. Factors including the nature of the data, the number of people affected by the breach, whether it was a one-off incident or part of a series, the duration and extent, whether the breach was deliberate and the steps taken by the data controller to prevent such an incident may all be taken into account.
Interestingly, the Commissioner will also consider the size and financial and other resources of the data controller in determining the amount of monetary penalty, and it seems that a data controller with substantial financial resources is likely to attract a higher penalty than one with limited resources for a similar contravention. So large organisations should beware - it would seem that once the 'serious' threshold is crossed in relation to the breach, financial resources may 'proportionately' affect the size of the fine (sorry, monetary penalty) imposed.
The consultation period ends on 21 December this year, and as yet there is no definitive information as to when these measures will be implemented - though the Commissioner has made his eagerness to use the powers public knowledge.
Incidentally, a slight inadvertent slip in Part 4 of the draft guidance - '...whether liability to pay the fine will fall on individuals...'