4 ms·

ICO, not ISO. "The Information Commissioner's Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data priv

by _joel 2y ago

ICO, not ISO. "The Information Commissioner's Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. ICO is an executive non-departmental public body, sponsored by the Department for Science, Innovation and Technology." https://www.gov.uk/government/organisations/information-commissioner-s-office https://www.gov.uk/government/organisations/information-comm...

madaxe_again 2y ago
The hell they do. Enforcement action by the IÇO is as rare as hen’s teeth, and when they do enforce, it’s a mild slap on the wrist for large businesses, and “put you out of business” for small businesses. Lose 2,000,000 sets of customer information because you accidentally left it public? Reprimand. Don’t do it again. 1000 spam calls? £100k fine. Go to prison. If you have a U.K. Ltd company, you must pay them their annual fee. Quite the gig they have. Do next to nothing, collect a tax on every business in the country. Electoral commission: 40,000,000 U.K. voter records leaked. No fine. https://ico.org.uk/action-weve-taken/enforcement/the-electoral-commission/ https://ico.org.uk/action-weve-taken/enforcement/the-elector... Random company, 60,000 spam SMS, £120k fine. https://ico.org.uk/action-weve-taken/enforcement/quick-tax-claims-limited-en/ https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c... Make it make sense.
- ksec 2y ago
  I often wonder why on earth is UK suppose to compete in the Global Stage.
  - Winblows11 2y ago
    Interesting so UK cannot impose rules on companies that operate and making billions in revenue in UK because "UK small". But when both a much smaller economy than UK like Australia imposes a rule on big tech like the news law, it is much different in challenging big tech. I saw a post a few weeks ago on HN asking what's the point (in general) of using a UK legal firm when legal firms in US/EU/India exist (!).
- davzie 2y ago
  I was absolute fuming when I got my letter from them demanding I pay them money. I knew I was closing my company down in the coming years and ignored them in the end. It's crazy this is allowed to be honest.
  - akdor1154 2y ago
    What did they allege?
  - usr1106 2y ago
    Well, that's what you get if you lower taxes on businesses. Otherwise some brick and mortar shop might rightfully complain why do I have to pay taxes for regulating companies that ruin my business. Is it public knowledge how much FAANG companies pay?
    - jdietrich 2y ago
      >Is it public knowledge how much FAANG companies pay? The highest tier of fee is £2,900 per year, but you're looking at the wrong regulator - major tech companies invariably use Ireland or Luxembourg as their European headquarters, so most or all of their data processing activities (and subsequent investigation or enforcement) would take place under that jurisdiction.
      - usr1106 2y ago
        That's of course far too cheap for FAANG companies. Doesn't the Ireland trick (mainly for tax evasion) only work for the EU market? I'd assume after Brexit the UK would require local presence?
        jdietrich 2y ago
        >I'd assume after Brexit the UK would require local presence? The UK copied the GDPR wholesale, the EU accepted a reciprocal arrangement based on this, so Brexit hasn't materially changed the situation. https://ico.org.uk/for-organisations/data-protection-and-the-eu/overview-data-protection-and-the-eu/ https://ico.org.uk/for-organisations/data-protection-and-the...
- joe_fishfish 2y ago
  I don’t have a problem with the fines for the spam texters, if anything it should be higher, but not punishing the electoral commission for that is utterly insane.
  - ratherbefuddled 2y ago
    What purpose would punishing the Electoral Commission with a fine serve? It's a public body funded by taxpayer money. They should simply be looking to prevent a re-occurrence and a fine on this type of organisation wouldn't help. Perhaps they should have powers to prosecute executives.
- deleted 2y ago
  [deleted]
- krisbolton 2y ago
  Personally I do wish they would intervene more, but if you consider how broad GDPR/DPA18 is I honestly don't think they can enforce it in the way a normal person would expect. Either it's a legislative issue (i.e., legislate better) or we accept these attempts at "balance". It's usually not the institutions weakness it's the legislation or the framework in which they exist. Consider one example - you "process" (collecting, using, storing, viewing - literally anything) personal data in an electronic system without the latest security patch. Are you breaking GDPR/DPA18? Easily done, especially for sensitive data. "...taking into account the state of the art, the costs of implementation, ... the risk of varying likelihood and severity for the rights .. of natural persons ... the processor shall implement appropaite technical ... measures to ensure a level of security approapite to the risk" (DPA18 Art 32). I imagine a large number of companies flout the above without realising. Especially when processing any information regarding health, criminal offense data, race, religion, philosophical beliefs etc, which is "special category data" and requires strong protections. DPA18 Article 32 "Security of processing" - https://www.legislation.gov.uk/eur/2016/679/article/32 https://www.legislation.gov.uk/eur/2016/679/article/32
  - arkh 2y ago
    > I imagine a large number of companies flout the above without realising. Most companies flout the 101 of GDPR. Do you have a registry of the personal data processes you do? Are you able to hand it in less than 48h after receiving a request for them? Do you do risk assessments when thinking about implementing a new data process? And it's not only about electronic data. Paper files are concerned. Yes it can feel like a lot but if you're handling people's personal data you should not be playing around. And if it's too hard, maybe "just" don't process personal data at all. Before GDPR we were already at a point where people just siphoned and stored people's data "in case it is useful later". Now some legislation is in place to make you think about why and how you get and store this kind of data, putting a price on doing it. It's a plus for the public. Too bad if it does not help sell ads, scams or just abuse people.
- jdietrich 2y ago
  >If you have a U.K. Ltd company, you must pay them their annual fee. Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt. The data protection fee only applies to businesses engaged in higher-risk data processing. The fee for a non-exempt business with turnover of <£632,000 is £40 per year. https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ https://ico.org.uk/for-organisations/data-protection-fee/dat... The primary purpose of ICO enforcement is to ensure compliance. The general principle is that the sanction administered should be of the lowest level necessary to ensure compliance. In your examples, the Electoral Commission suffered a breach due to a chain of vulnerabilities exploited by a sophisticated actor. In response to the ICO investigation, the Electoral Commission implemented a major overhaul of their security procedures including a formal process to manage and monitor patching and MFA. The ICO were satisfied that the EC had come into compliance and would remain compliant, so no fine was applied.
  - madaxe_again 2y ago
    >> Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt In theory only. I was a one man band with zero consumer data handling, and they insisted I pay the fee. Back when I had faith in institutions, I reported some really grievous mishandling of consumer data to them, several times, and they were not remotely interested.
- purple_turtle 2y ago
  > 60,000 spam SMS, £120k fine > 1000 spam calls? £100k fine. Go to prison. sounds just and deserved to me, fine spammers into nonexistence > Quite the gig they have. Do next to nothing Maybe you are right that there are serious problems with them (electoral commission failure should have been punished), but demolishing small scale spammers is already an useful service. I would fund it if I would be able to taking decision. I would be happy to pay 1000 £ if that means that last person who spammed me goes bankrupt and to prison (for say 50 days). > a mild slap on the wrist for large businesses, and “put you out of business” for small businesses first one should be fixed if it is a problem so large spammers are also fined into nonexistence and yes, I support putting their CEO into prison for 50 days if any part of their company does spam
  - madaxe_again 2y ago
    Agreed - my main problem with them is the asymmetry of their enforcement actions. I think the fine for the spammers I gave as an example was just and appropriate, but again and again, if you look at any large organisation, they almost always just get a reprimand, or a fine that’s just a cost of doing business - if they are investigated at all. I reported a large IT supplier who are currently embroiled in a different scandal in the U.K. many years ago, because they were playing fast and loose with medical records. No action, no investigation, nothing.
    - lucianbr 2y ago
      Is there any government anywhere doing uniform fair enforcement? This problem seems to be global. And it's definitely a problem, no argument from me.
- noprocrasted 2y ago
  I absolutely agree that the enforcement is significantly lacking and this "regulator" is useless, but I'm wondering why you are angry that someone got a fine for SMS spam? Some enforcement is still better than no enforcement at all as long as the underlying basis is just, and there should be zero sympathy for spammers out there.

by _joel 2y ago

madaxe_again 2y ago

The hell they do. Enforcement action by the IÇO is as rare as hen’s teeth, and when they do enforce, it’s a mild slap on the wrist for large businesses, and “put you out of business” for small businesses. Lose 2,000,000 sets of customer information because you accidentally left it public? Reprimand. Don’t do it again. 1000 spam calls? £100k fine. Go to prison. If you have a U.K. Ltd company, you must pay them their annual fee. Quite the gig they have. Do next to nothing, collect a tax on every business in the country. Electoral commission: 40,000,000 U.K. voter records leaked. No fine. https://ico.org.uk/action-weve-taken/enforcement/the-electoral-commission/ https://ico.org.uk/action-weve-taken/enforcement/the-elector... Random company, 60,000 spam SMS, £120k fine. https://ico.org.uk/action-weve-taken/enforcement/quick-tax-claims-limited-en/ https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c... Make it make sense.

ksec 2y ago
I often wonder why on earth is UK suppose to compete in the Global Stage.
- Winblows11 2y ago
  Interesting so UK cannot impose rules on companies that operate and making billions in revenue in UK because "UK small". But when both a much smaller economy than UK like Australia imposes a rule on big tech like the news law, it is much different in challenging big tech. I saw a post a few weeks ago on HN asking what's the point (in general) of using a UK legal firm when legal firms in US/EU/India exist (!).
davzie 2y ago
I was absolute fuming when I got my letter from them demanding I pay them money. I knew I was closing my company down in the coming years and ignored them in the end. It's crazy this is allowed to be honest.
- akdor1154 2y ago
  What did they allege?
- usr1106 2y ago
  Well, that's what you get if you lower taxes on businesses. Otherwise some brick and mortar shop might rightfully complain why do I have to pay taxes for regulating companies that ruin my business. Is it public knowledge how much FAANG companies pay?
  - jdietrich 2y ago
    >Is it public knowledge how much FAANG companies pay? The highest tier of fee is £2,900 per year, but you're looking at the wrong regulator - major tech companies invariably use Ireland or Luxembourg as their European headquarters, so most or all of their data processing activities (and subsequent investigation or enforcement) would take place under that jurisdiction.
    - usr1106 2y ago
      That's of course far too cheap for FAANG companies. Doesn't the Ireland trick (mainly for tax evasion) only work for the EU market? I'd assume after Brexit the UK would require local presence?
      - jdietrich 2y ago
        >I'd assume after Brexit the UK would require local presence? The UK copied the GDPR wholesale, the EU accepted a reciprocal arrangement based on this, so Brexit hasn't materially changed the situation. https://ico.org.uk/for-organisations/data-protection-and-the-eu/overview-data-protection-and-the-eu/ https://ico.org.uk/for-organisations/data-protection-and-the...
joe_fishfish 2y ago
I don’t have a problem with the fines for the spam texters, if anything it should be higher, but not punishing the electoral commission for that is utterly insane.
- ratherbefuddled 2y ago
  What purpose would punishing the Electoral Commission with a fine serve? It's a public body funded by taxpayer money. They should simply be looking to prevent a re-occurrence and a fine on this type of organisation wouldn't help. Perhaps they should have powers to prosecute executives.
deleted 2y ago
[deleted]
krisbolton 2y ago
Personally I do wish they would intervene more, but if you consider how broad GDPR/DPA18 is I honestly don't think they can enforce it in the way a normal person would expect. Either it's a legislative issue (i.e., legislate better) or we accept these attempts at "balance". It's usually not the institutions weakness it's the legislation or the framework in which they exist. Consider one example - you "process" (collecting, using, storing, viewing - literally anything) personal data in an electronic system without the latest security patch. Are you breaking GDPR/DPA18? Easily done, especially for sensitive data. "...taking into account the state of the art, the costs of implementation, ... the risk of varying likelihood and severity for the rights .. of natural persons ... the processor shall implement appropaite technical ... measures to ensure a level of security approapite to the risk" (DPA18 Art 32). I imagine a large number of companies flout the above without realising. Especially when processing any information regarding health, criminal offense data, race, religion, philosophical beliefs etc, which is "special category data" and requires strong protections. DPA18 Article 32 "Security of processing" - https://www.legislation.gov.uk/eur/2016/679/article/32 https://www.legislation.gov.uk/eur/2016/679/article/32
- arkh 2y ago
  > I imagine a large number of companies flout the above without realising. Most companies flout the 101 of GDPR. Do you have a registry of the personal data processes you do? Are you able to hand it in less than 48h after receiving a request for them? Do you do risk assessments when thinking about implementing a new data process? And it's not only about electronic data. Paper files are concerned. Yes it can feel like a lot but if you're handling people's personal data you should not be playing around. And if it's too hard, maybe "just" don't process personal data at all. Before GDPR we were already at a point where people just siphoned and stored people's data "in case it is useful later". Now some legislation is in place to make you think about why and how you get and store this kind of data, putting a price on doing it. It's a plus for the public. Too bad if it does not help sell ads, scams or just abuse people.
jdietrich 2y ago
>If you have a U.K. Ltd company, you must pay them their annual fee. Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt. The data protection fee only applies to businesses engaged in higher-risk data processing. The fee for a non-exempt business with turnover of <£632,000 is £40 per year. https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ https://ico.org.uk/for-organisations/data-protection-fee/dat... The primary purpose of ICO enforcement is to ensure compliance. The general principle is that the sanction administered should be of the lowest level necessary to ensure compliance. In your examples, the Electoral Commission suffered a breach due to a chain of vulnerabilities exploited by a sophisticated actor. In response to the ICO investigation, the Electoral Commission implemented a major overhaul of their security procedures including a formal process to manage and monitor patching and MFA. The ICO were satisfied that the EC had come into compliance and would remain compliant, so no fine was applied.
- madaxe_again 2y ago
  >> Businesses that only use data for routine purposes like staff administration, accounts and advertising are exempt In theory only. I was a one man band with zero consumer data handling, and they insisted I pay the fee. Back when I had faith in institutions, I reported some really grievous mishandling of consumer data to them, several times, and they were not remotely interested.
purple_turtle 2y ago
> 60,000 spam SMS, £120k fine > 1000 spam calls? £100k fine. Go to prison. sounds just and deserved to me, fine spammers into nonexistence > Quite the gig they have. Do next to nothing Maybe you are right that there are serious problems with them (electoral commission failure should have been punished), but demolishing small scale spammers is already an useful service. I would fund it if I would be able to taking decision. I would be happy to pay 1000 £ if that means that last person who spammed me goes bankrupt and to prison (for say 50 days). > a mild slap on the wrist for large businesses, and “put you out of business” for small businesses first one should be fixed if it is a problem so large spammers are also fined into nonexistence and yes, I support putting their CEO into prison for 50 days if any part of their company does spam
- madaxe_again 2y ago
  Agreed - my main problem with them is the asymmetry of their enforcement actions. I think the fine for the spammers I gave as an example was just and appropriate, but again and again, if you look at any large organisation, they almost always just get a reprimand, or a fine that’s just a cost of doing business - if they are investigated at all. I reported a large IT supplier who are currently embroiled in a different scandal in the U.K. many years ago, because they were playing fast and loose with medical records. No action, no investigation, nothing.
  - lucianbr 2y ago
    Is there any government anywhere doing uniform fair enforcement? This problem seems to be global. And it's definitely a problem, no argument from me.
noprocrasted 2y ago
I absolutely agree that the enforcement is significantly lacking and this "regulator" is useless, but I'm wondering why you are angry that someone got a fine for SMS spam? Some enforcement is still better than no enforcement at all as long as the underlying basis is just, and there should be zero sympathy for spammers out there.