Were the Lords right to criticise the UK’s fraud reporting system?
The likelihood of breach reporting obligation being implemented in the UK at this time is quite low because of the preferred approach by the ICO to education rather than enforcement. This was particularly evident with the 12 Undertakings signed by high profile financial services firms earlier this year. However, within the financial services sector, generally the penny hasn’t dropped that the ICO can pass cases over to the Financial Services Authority for enforcement action. The FSA is publically stated that they will be reviewing the area of data security as part of their inspection visits on firms. Unlike the ICO, the FSA has unlimited fining powers and this was illustrated with the fine of GBP980k being imposed on Nationwide Building Society. This is a significant difference to the level of fining that can be imposed by the ICO. In effect, there is a new data protection enforcer in the financial services area, and it is the FSA, so affected firms need to watch out, especially as the
