🤔 In yesterday's lecture on "Business Administration for Privacy Professionals" at Nyenrode Business University, I discussed with my students why fines are not a very effective way to prevent stupidities, like in this case (publishing the personal data of all police personnel in a spreadsheet in a response to a FOIA request) in the future.
If a business is fined, that fine is typically "priced away", either by reducing the shareholders' RoI (which is only noticeable if the profit is low) or by raising the cost of its goods or services (which is noticeable only if the price and/or the amount of sold goods or services is low).
If a government organization is fined, the money never leaves the government. It flows back into the Treasury and is available for the distribution of public goods and services, which in theory could mean that the government agency that was fined gets its money back.
If a non-profit organization, like a hospital or educational institution, is fined, that just feels uneasy given their business. It is money taken away from curing people or teaching children. So, those fines are often reduced by the courts.
👉 The Rationalist approach to compliance ("non-compliance must be punished") works best within the organization through compliance controls like Disciplinary Measures and Redress (incl. compensation for damages). In addition, of course, to preventative controls like Policies/Procedures, Monitoring/Audit and Training/Awareness. This helps preventing stupidities like the ones in this case.
(By the way, my students will hopefully recognize that the FOIA department is a 'machine bureaucracy', so the control Policies and Procedures, supplemented with training on those policies and procedures, works best in this case).
👉 Supervisory authorities should mainly base the execution of their powers on the Normative approach to compliance ("non-compliance must be managed"), as it is far more effective than a fine. A good example is the US FTC in the Eli Lilly e-mail case, in which the company send an e-mail related to its Prozac product with all of the 667 recipients in the To-field instead of the BCC field. (https://lnkd.in/e3xTik7n). The FTC ordered the company to establish a privacy and security compliance program with mandatory reports to the FTC for 20 years, which skyrocketed the compliance efforts in the company. An effect that a fine would never have achieved.
John Edwards
Information Commissioner's Office
![View organization page for Information Commissioner's Office, graphic]()
🆕 We have fined Police Service Northern Ireland (PSNI) £750,000 for exposing the personal information of its entire workforce, leaving many fearing for their safety.
Our investigation was assisted by complaints from people who provided candid insights into the anxiety and distress the breach had caused.
John Edwards, UK Information Commissioner, said:
“I cannot think of a clearer example to prove how critical it is to keep personal information safe. It is impossible to imagine the fear and uncertainty this breach – which should never have happened –- caused PSNI officers and staff. Let this be a lesson learned for all organisations.”
Read more about our action: https://lnkd.in/e_EcvMRE
❓ What happened?
On 3 August 2023, PSNI received two freedom of information requests asking for information such as the number of officers at each rank and number of staff at each grade.
The information was downloaded as an Excel file with a single worksheet from PSNI’s human resources management system. The data included: surnames and first name initials, job role, rank, grade, department, location of post, contract type, gender and PSNI service and staff number.
🔎 Simple steps to prevent the breach
We found that PSNI could have prevented the serious breach which resulted in the personal information of all 9,483 PSNI officers and staff being exposed on the internet.
Our advice to all organisations is check, challenge and change your disclosure procedures to ensure you protect people’s personal information.
Read about the fine in full: https://lnkd.in/ebECTJZq
📲 How was the fine calculated?
We are aware of the current financial position at PSNI, and not wishing to divert public money from where it is needed, we applied our public sector approach when setting the fine. Had we not done this, the fine would have been £5.6 million.
Read about our public sector approach: https://lnkd.in/eDaW6-Bc
Read our open letter from the UK Information Commissioner to public authorities: https://lnkd.in/ei6s6KBH
-
![No alternative text description for this image]()
Disability Law Attorney representing individuals seeking Social Security Disability Benefits, Frequent Lecturer on Disability Issues, Former Attorney For Social Security Administration.
7moIt’s our job to help them help us. How? By writing a simple straight forward brief setting out exactly why our client is disabled with a brief summary of the medical record which supports our theory of the case. It’s necessary to know the entire record. Does this sound too simplistic? After four decades of representing claimants I can assure you that the preparation and brief are the key components of success. For me, the hearing is the easy part.