Privacy watchdog fails on fines for data protection breaches

More than 2.8 million pounds uncollected in annual fines by ICO

Koala asleep on tree

ICO and fines

Britain’s personal data watchdog has failed to collect millions in fines for breaches of the Data Protection Act (DPA).

The Information Commissioners Officer (ICO) is responsible for enforcing the DPA and new GDPR regulations, which come into force today (25 May 2018). Figures obtained through Freedom of Information requests by me show:

The total sum of fines issued under the Data Protection Act 1998 (DPA) and Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) for each of the last three financial years is:

2015-16 – £2,529,250

2016-17- £3,556,100

2017-18 – £4,809,700

But how much of this was actually received?

2015-16 – £748,100

2016-17 – £1,938,600

2017-18 – £1,923,655

So, in the most recent year, for example the ICO has failed to collect more than 60% of the fines it has imposed, for a total of more than 2.8 million pounds.

Whilst the total of fines has been increasing, the collection rate has been decreasing. The ICO is keen to point out that there are several factors that have an impact on the difference between the total amount fined and the total amount paid for each financial year.

GDPR means more cash for the ICO

According to the law, companies and other organisations must register with the ICO and pay an annual fee for the privilege. I uncovered how the ICO will benefit financially from the new GDPR rules. Last year (2017/18) £21,299,976 was raised in data protection fees income. The projected data protection fee income for this year (i.e. financial year 2018/19) is £32,341,250. This represents an uplift of £11,041,274.

74% of the ICO’s income will be spent on salaries, that’s a massive £24,983,045 for around 400 staff!

I contacted the 31 other countries bound by the EU law regarding the data protection registration and asked them if they charged a fee. 15 responded to say that they did not.

Support for businesses from the ICO lacking

Although generally good news for consumers (Ten ways GDPR will help consumers) the ICO faces widespread criticism of its handling of the new GDPR legislation. Despite the massive hike in projected income and increase in staff, big business and sole traders alike are frustrated by the lack of support and consistent advice on the new data privacy law.

old fashioned dusty switchboardWe are all seeing an increase of emails requesting consent to keep recipients on their mailing list which are unnecessary where they already have our permission. Laura Light, blogger at savings4savvymums is one of many sole traders who is frustrated by all the conflicting advice. “I was on the phone last week asking about opt-ins to then be told by a different advisor the info I was told was wrong! They need to get their facts straight and stick to them. How on earth can anyone be expected to get it right when the ICO doesn’t even know what’s right?”

Naomi Willis was left on hold for 1 hour 4o minutes before being cut off and then again for nearly two hours when she rung the ICO. To say nothing of the ICO website being down for most of the day yesterday!

Why is a registration fee for data protection needed?

Naomi from Skint Dad, a small business, questions the need for a fee: “The whole idea of GDPR is that everyone should be doing it. I don’t therefore understand why most need to pay a fee to the ICO. Having a fee is just putting people off from following the new legislation. It’s not like the money has gone on any support!”

And as mentioned above – other countries undertaking the same work are not charging. Why?

Jumping on the GDPR bandwagon

There appears to be an increase in companies seeking to capitalise on the confusion too. Naomi has noticed that people with no legal background who appear to have read (some of) the guidelines are offering very expensive advice to people and organisations who are wrongly panicking about being fined. Willis worries for next week and beyond “I think it will be worse from next Tuesday as these people will become parasites, just looking at websites with no privacy policy, then trying to hard sell them generic policies that aren’t fit for purpose.”

GDPR causing unnecessary costs for small organisations

The cost of GDPR is hitting business across the board, especially in the not-for-profit sector. Already strapped for cash schools and local authorities must spend thousands of pounds on privacy staff and external advice but are not being given any extra funding to do so.

While most privacy policies are written in dry legal language, some small businesses have taken a novel approach to these documents. For example, the website WritersHQ has created a witty explanation for every area of GDPR full of choice language in its Privacy Policy. The popularity of the policy, which has been shared widely on social media, is perhaps a reflection of how small businesses feel about GDPR! Marianne Chua is a wedding photographer whose Privacy Policy takes a humorous sarcastic slant. For example “I’m happy to show you the information I have on you, and unsurprisingly it’ll probably be exactly the things you’ve told me because sadly I am neither a spy nor a mind reader.”

ICO and protection irony

ICO is making sole traders postal addresses public! For most sole traders this is their home address making them vulnerable to a number of issues. The ICO does not have to make these home addresses public. But, the ICO said ““Even though it is no longer a legal requirement under the GDPR, the ICO will continue to publish a register of data controllers because we recognise there is a public interest in transparency and accessibility. It is important that data subjects have a clear way to contact data controllers and to exercise their legal rights. Being a data controller represents responsibilities, one of which is to be easily accessible to data subjects. We will be publishing the postal addresses of data controllers, including sole traders. We will not be asking for consent to do so but we will be advising them that they can provide a PO Box address instead if they wish to do so.”

ICO and glass houses..

I think Naomi sums it up perfectly. “Information we need to provide must be “concise, transparent, intelligible and easily accessible” but the ICO seem to be having a hard job of doing this themselves! What I’ve seen from them is long winded, full of holes, late and the information on their site goes around in circles, let alone having a chance to speak to a human for support!”

Time perhaps for the ICO to get its own house in order before it starts looking at fining businesses?

Someone shouting into tin can with string. Text privacy watchdog fails on fines for data protection breaches and support on GDPR[1] A spokesperson for the ICO said that “If the Commissioner receives full payment of the monetary penalty within 28 calendar days of the notice being sent, the Commissioner will reduce the monetary penalty by 20%. Secondly, ongoing or successful appeals against a CMP will delay, or negate, the amount of CMP to be paid. In some cases, appeals to the FTT can lead to the reduction in the amount organisations are required to repay. In addition, each monetary penalty notice issued will define a timeframe in which the CMP should be paid, which will be a period of at least 28 calendar days beginning the first day after the monetary penalty notice has been served. Therefore, in more recent cases, although a monetary penalty notice has been issued, payment may not yet have been made.”

Ten ways GDPR will help consumers

Sara Williams Debt camel guest post on The Complaining Cow

This is a guest post by Sara Williams, an adviser at Citizens Advice who has her own website Debt Camel where she blogs about everything to do with debt and credit ratings. She also guest posted Everything you need to know about Payday loans and Bright ideas for complaining about Brighthouse (& avoiding them in the first place!)

All you need to know about the General Data Protection Regulations

In a month’s time, On 25th May 2018 the General Data Protection Regulation (GDPR) comes into force in Britain and the rest of the EU. This a major change to the rules governing how organisations manage personal data about their customers and employees.

I think it’s all good for consumers. Your existing rights under the Data Protection Act are being clarified and extended, not restricted or watered down, and some dubious marketing practices will now be clearly banned.

What personal information is covered?

The EU GDPR website says this:

“Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.”

Lot of coloured @ buttons

What organisations are covered?

The new regulations apply to all organisations that process or hold data for people living in the UK. This isn’t just companies, it also includes government departments, your local authority, charities, schools, hospitals and GPs. And the organisations don’t have to be based in the UK – it also applies to Google, Amazon, Facebook etc.

Coloured files in cabinet with name labels text "What the new GDPRs mean for consumers

Ten ways GDPR will help consumers

1) The GDPR Right of Access means that organisations will no longer be able to charge £10 when you ask them to provide some or all the personal information they hold about you. This is also called making a Subject Access Request. People don’t like paying £10 if they are unsure what they will get, so no fee is good news.

2) You can also access information about your children or someone for whom you have a Lasting Power of Attorney.

3) Before GDPR, credit data was treated differently with the three Credit Reference Agencies (CRA), Experian, Equifax and Call Credit. They are currently allowed to charge you £2 for a copy of your statutory credit report – but GDPR will apply to them to so this will become free. If you have been having a dispute with a lender, say about a default date that they have added, being able to check all three CRA reports without a charge will be very helpful.

4) Organisations will now have to get your explicit consent to adding you to a mailing list. This means you making a positive decision e.g. by ticking a box. The box can’t be pre-ticked online so you may not spot it. And it can’t be misleadingly worded in the negative “Tick here if you do not want to receive information”.

Organisations also have to be clear why they are gathering information from you and what they will use it for. So if they offer a free information booklet or are giving away money off coupons, this doesn’t mean that they can automatically add you to their mailing list – you have to clearly agree to that.

5) Organisations can’t share or sell your personal information unless you explicitly consent to this. No longer can this buried away in the Terms & Conditions. I can’t think why anyone would ever actually want to consent!

6) The GDPR Right To Object means you have to be given an easy to way to change your mind and opt out of marketing communications in future, both by email and by post.

7) The GDPR Right to Rectification means that an organisation must correct inaccurate data without delay.

8) The GDPR Right to Erasure means you may have a right to get your personal data deleted. This depends on why that data is being held. If it is just for marketing, it should be deleted when you ask for this. But a bank which has given you a loan or a shop that sold you a washing machine will have legitimate reasons to retain this information for a period.

9) Personal data breaches have to be notified to the supervisory authority (typically the ICO) within 72 hours unless they are minor, in which case they have to be documented, including the reason for not reporting them. This would include when personal information is sent to the wrong person, if a laptop containing personal data is left on a train or stolen, or if a hacker managed to download or alter personal data. High risk breaches have to be notified to the persons whose data has been affected without undue delay.

10) An organisation can face fines of up to €20million (£17million in the UK) or 4% of their annual global turnover, whichever is larger. Ouch! That is a huge amount more than the current maximum fine of £500,000 under the old Data Protection Act.

I have only highlighted some points here. The ICO site has lots of information about personal data situations. If you want to know how your personal information should be handled and how to raise a concern, look at the ICO’s “For The Public” page. That has lots of details, including how to make a Subject Access Request and links to specific situations from criminal records to the use of drones. Where necessary, those pages will all be updated when GDPR goes live on May 25th.

Will this really make a difference?

The ICO says:

“…it’s scaremongering to suggest that we’ll be making early examples of organisations for minor infringements or that maximum fines will become the norm.”

But the fact that huge penalties will be possible is causing many organisations to take GDPR very seriously.

If this means that firms are more careful with our information, they only hold what is actually needed, the nuisance of unwanted marketing is reduced and it’s easier to get problems resolved then GDPR will be a positive help to British consumers.