News: ICO to Fine Companies £500,000 For Serious Data Breaches

From Panopticon Blog: The Information Commissioner is to get powers to deliver civil penalty notices on a data controller for a serious contravention of the data protection principles if the contravention is:

1) Deliberate or reckless
2) Of a sort that is likely to cause substantial damage or distress

The post makes two criticisms: first, the proposed cap of £500,000, as large as it might seem, compares less favourably with other regulator's powers to fine up to 10% of an organisations turnover. Second, as the government ultimately pays for many of the organisations in question, imposing large fines may have 'a slightly unreal quality to it'.

Saving Privacy

An interesting piece in today's Times by Nigel Shadbolt, who is a professor of AI at Southampton University. He argues that advances in technology are eroding privacy at an alarming rate. In response he proposes nine measures.

1. The commissioning of a report on privacy similar to Baroness Warnock's on fertilisation and embryology.
2. Oblige government and private companies to inform the public in the event of data breaches.
3. All government departments controling large databases to appoint a 'privacy officer'.
4. Written procedures to manage, monitor and report on the accuracy of the personal data held.
5. Regular auditing of government departments to ensure compliance with the Data Protection Act, the results of which would be published.
   
6. Routine open access to government data on schools, health, transport and commerce.
7. All Freedom of Information Act requests and results to be made available in web accessible formats.
8. Insist on proportionality in cases of surveillance.
9. Rule employer use of social networking information as inappropriate.

Are some of these too elaborate to be practical? Or is it rather that surveillance done justly, or centralising information justly, requires much more effort than is being spent at the moment?

Should Local Councils have Surveillance Powers?

I should now be able to return to regular posting (and get round to responding to the comments some of you have left). Today I have two stories involving Burnley Borough Council's use of Surveillance.

First a recent story from the Sunday Times. Apparently they mounted a "direct surveillance operation" against an employee they suspected of using the shower while clocked in.

There have been loads of stories like this over the last few years, and I can't find anybody who defends surveillance for uses like these - reading the newspapers you might get the impression that there's widespread consensus that local councils should not be engaged in surveillance at all.

But the stories keep coming. Presumably the councils doing this think they are doing the right thing, and that they are acting in a proportionate manner - how can there be such a big gap between their view and the widespread public condemnation?

The second story concerns a case which would be easier to defend but I'd be fascinated to hear some responses to the case: a few years back they caught someone flytipping through use of covert CCTV. The cameras covered public space, and surely nobody would object if the dumper had been caught as the result of, say, a chance eyewitness.

So is this a form of surveillance councils should be engaged in? Or is this still inappropriate and disproportionate?