Stricter UK cyber duties on online accounts and data explored

The potential reforms were alluded to in a ‘call for information’ published by the UK Home Office – the first step in what the department is calling a new ‘Cyber Duty to Protect programme’.

The call for information seeks views on “potential government intervention to reduce the burden of cybersecurity from the citizen and encourage organisations to further protect users’ accounts and personal data”.

The Home Office is exploring options for intervention after data published earlier this summer by the Office for National Statistics (ONS) revealed that there had been an estimated 89% increase in computer misuse offences in the year ending March 2022, with an estimated 158% increase in unauthorised access to personal information offences, such as hacking. In total, the ONS said there had been an estimated 1.6 million computer misuse offences in the year ending March 2022.

Priti Patel, UK home secretary, said: “We believe measures may be needed in particular to address the large volume of cyber crimes committed by criminals with a relatively low level of technical sophistication. Accordingly, the Home Office is seeking information to inform the development of proposals to further reduce cyber crime, and the offences facilitated by it.”

“This work will explore measures to reduce the burden on citizens for cyber security, including the application by organisations of secure-by-default principles to protect user accounts and information. It will also examine whether to supplement requirements in data protection legislation to ensure that providers of online services and accounts, as well as processors and holders of UK citizens’ personal data, exercise an appropriate and proportionate degree of responsibility for the protection required of the data and access to it,” it said.

The Home Office’s call for information paper does not contain firm proposals for reform, but views are invited on a range of issues, including where businesses and other stakeholders think responsibility for ensuring better protection of personal data should lie, and on the use of “enhanced authentication solutions”, such as multi-factor or two-factor authentication.