The UK government has announced that it will not be implementing a data-breach notification law.
Following a recommendation by information commissioner Richard Thomas in July, the government announced in a report on Tuesday that it will not introduce a compulsory data-breach notification law for private-sector organisations.
“After considering the analysis of the experience of the US in the area of data-breach notification legislation, the government is not intending to implement similar legislation to that in operation in the US,” states the Response to the Data Sharing Review Report.
It is already mandatory for public-sector organisations to report any significant actual or potential losses of data to the Information Commissioner’s Office (ICO). Private-sector organisations should report data breaches “as a matter of good practice”, states the report, and the ICO should take into account of any lack of reporting by a private-sector organisation in its enforcement action.
Fines for companies that are found in breach of data-protection laws are to be raised, states the report. The Ministry of Justice is working with the ICO to determine the level of the maximum fine.
Posted by Lyger