3 ms·

A thousandth of the top-end of their expected profits for 17-18. That'll teach them.

• jstanley 9y ago
  It's not supposed to harm them, it's supposed to make it economically sensible for them (and companies like them) to employ one or two people with the sole responsibility of making sure stuff like this doesn't happen.
  • cmdkeen 9y ago
    And when GDPR comes in that will change to make it even more in their economic interest to take these things seriously. The higher of 20 million Euro or 4% of global turnover is enough to start making company boards ask questions about preparedness and impacts.
  • martinald 9y ago
    I don't agree, the ICO is a total joke and hopefully GDPR will allow them/some other body to give proper fines. There have been cases where spam companies have done 100m SMS/phone calls and got a £100K fine (which they can just prepack away). It's probably a tenth of their telecom cost per call. Just a cost of doing business.
    • Doctor_Fegg 9y ago
      The fact I used to get regularly spammed by the ICO themselves (I edited a magazine on a completely unconnected topic; they insisted on sending press releases that had nothing to do with our subject matter), and they ignored all requests to be removed from their list, has never exactly given me much confidence in them.
    • jfindley 9y ago
      That's a different issue, though. In your example, the company is actively doing something malicious, and accepting the fine for getting caught as part of their costs. Other than the threat of a really huge fine (or worse sanctions), they're unlikely to stop. In this case, it's a company that's not actively trying to be malicious, but rather due to [cost-saving/incompetence] has underfunded IT security to an excessive degree. For them, and others like them, to change their ways it's a lot less self evident that the fine needs to be huge. The fine (and accompanying reputational damage) just needs to be enough to make them, and similar companies, take IT security seriously. Very different situations, really.
  • chris__butters 9y ago
    Hopefully this will impact on their profits a little to make the fine have more of an economic impact so that it creates an example to those who don't take data privacy and security seriously.
  • IshKebab 9y ago
    Yeah but... it's too small to do that. £400k? Hiring two security professionals for 4 years would easily cost that. The average time between fines is more than 4 years, and there's a pretty reasonable chance the security guys would overlook this anyway. £400k is nothing.