Information Commissioner's Office

The Information Commissioner's Office (ICO, stylised as "ico.") is the independent regulatory office dealing with data protection and privacy issues in the UK. It is sponsored by the Ministry of Justice. In 2011/12 it employed 350 people, dealt with 12,985 cases concerning data protection, 7095 concerning privacy and electronic communications regulations, 4633 concerning freedom of information, and conducted 15 prosecutions. It has a budget for 2012/13 of £19,695,100[1]. The current Information Commissioner and Chief Executive of ICO is Elizabeth Denham, replacing Christopher Graham[2] in July 2016.

All organisations that process personal information must register with the ICO in accordance with the Data Protection Act, with exemptions only for organisations that do very simple processing.

Remit

The ICO is responsible for and enforces:

Powers

The ICO has a number of tools at its disposal in order to achieve its aims and ensure compliance. Amongst these it has the ability to:

  • Serve Information Notices - to request specified information to be provided to the ICO in a set time period
  • Issue undertakings - commit organisations to taking steps to improve data protection practices
  • Serve enforcement notices, 'stop now' orders - to require organisations where there has been a breach to take steps to come into compliance with the law
  • Conduct assessments/audits - to assess the practices of organisations, both voluntarily and compulsorily (for data protection purposes)
  • Issue monetary penalty notices - to require organisations up to £500,000 for serious breaches, as of 2010 onwards
  • Prosecute criminal offences
  • Report to parliament matters of concern[4]

Notable Recent Cases

Southampton Intra-Taxi Surveillance

Following pressure from civil liberties group Big Brother Watch, Southampton Council was in July 2012 ordered to cease recording audio and video of conversations in taxis[5]. The council has until 1st of November to comply with the enforcement notice, and is appealing the decision. The policy is defended on the grounds that it is a necessery measure to ensure the safety of both drivers and passengers, but Christopher Graham argued that it violated the reasonable expectation of privacy of both passengers and drivers[6]. A similar scheme was proposed in Oxford in 2011, which again was dropped after opposition from Big Brother Watch[7]

Tesco Security Failings

The ICO is as of August 2012 making enquiries with Tesco[8] as to its alleged improper handling and storage of online customers' data; these include potentially storing user passwords in plaintext[9] (as opposed to securely encrypting them) and their use of severely out-dated software. The problems came to light after investigation by blogger Troy Hunt[10].

Local Authority Violations

In February 2012, the ICO found that 5 local authorities - Basingstoke & Deane, Brighton & Hove, Dacorum, Bolton and Craven District Council - were in breach of the Data Protection Act by failing to protect personal information. They have since given commitments to ensure all data stored remains secure, and that portable devices containing personal information will be encrypted[11].

Devon Torbay Care Trust Security Breach

The ICO handed down a £175,000 fine in August 2012 to the Devon Torbay Care Trust, after it published online the personal details of more than 1,000 staff members[12]. It was unintentionally published online in the form of a spreadsheet, and was accessed 300 times in the five months that it remained up before the authorities were notified of its existence by a member of the public.

Sony PlayStation Network intrusion

Sony has been fined £250,000 in January 2013 for the breach of customer details following a 2011 intrusion.[13][14]

Criticism

The Information Commissioner's Office has come under considerable criticism for what is perceived to be its inadequate enforcement of the Data Protection Act, itself held to be a flawed piece of legislation. For more information, see Data Protection Act#Criticism. See also UK Cookie Law recommendations.

Links

Annual Reports

References

  1. ↑ Key facts, ICO
  2. ↑ Organisational Structure, ICO
  3. ↑ Who we are, ICO
  4. ↑ Taking action - data protection, ICO
  5. ↑ Council ordered to stop unlawful recording of taxi passengers’ conversations, ICO (webarchive)
  6. ↑ Now Southampton Council faces action for audio taxi recording, Big Brother Watch
  7. ↑ Oxford drops always-on audio taxi recording, Big Brother Watch
  8. ↑ Tesco web security 'flaw' probed by UK data watchdog, BBC News, 2012-08-20
  9. ↑ Plain Text Password Storage Is But One of Tesco Online's Possible Security Holes, Gizmodo UK, 2012-07-30
  10. ↑ Lessons in website security anti-patterns by Tesco, 2012-07-30
  11. ↑ Five more councils breach Data Protection Act, Guardian, 2012-02-10
  12. ↑ Information Commissioner’s Office fines NHS trust £175,000 for ‘serious’ security breach
  13. ↑ Crap security lands Sony £250k fine for PlayStation Network hack, 2013-01-24
  14. ↑ Dear ICO: disclose Sony’s hash algorithm!, 2013-01-24, Light Blue Touchpaper
Retrieved from "https://wiki.openrightsgroup.org/w/index.php?title=Information_Commissioner%27s_Office&oldid=47702"