Out-Law News | 11 Nov 2009 | 5:50 pm | 1 min. read
The consultation, Civil Monetary Penalties: Setting the maximum penalty, asks just one question: whether the proposed maximum fine will provide the ICO with a proportionate sanction to impose on those seriously contravening the data protection principles.
Justice Minister, Michael Wills, said: "We want to ensure that the Information Commissioner's Office has the powers it needs and is able to impose robust penalties on those who commit serious breaches of data protection principles."
The Government decided not to follow the approach of other regulators that have the power to impose a penalty up to 10% of an organisation’s turnover.
"Following discussion with the ICO and consideration of the greater administrative burden involved in operating a turnover-based system, we are consulting only on a fixed maximum amount," says the consultation paper. "However, we consider it desirable that the maximum amount of the penalty should not be higher than the equivalent of 10% of the highest annual turnover of a small company."
The power to impose a civil monetary penalty on data controllers was created by section 144 of the Criminal Justice and Immigration Act 2008, which amends the Data Protection Act of 1988. The power is expected to be in force next April, according to the ICO.
The penalties can only be imposed when certain criteria are met.
According to the Ministry of Justice, the ICO will exercise its discretion to assess the appropriate level of any penalty it imposes and will publish detailed guidance setting out the criteria it will use and circumstances it will take into consideration.
The consultation closes on 21st December 2009.