Companies that fail to keep personal data safe risk long-lasting reputational damage that can impact on the future success of the business, according to the data protection watchdog, the Office of the Information Commissioner (ICO).
Information Commissioner Christopher Graham was speaking at the Advertising Association’s leadership summit on Thursday, January 28. ICO fines of up to £500,000 for breaching the Data Protection Act are a powerful deterrent, but the negative impact created by media coverage of a penalty can have a greater impact than the fine itself, he suggested.
He said: “Companies that play fast and loose with people’s personal information risk the wrath of the ICO and that means A heavy fine is bad enough, but the time, energy and money it takes to rebuild customer confidence can be as severe a punishment as the fine itself.”
A YouGov poll was commissioned by the ICO to mark European Data Protection Day. It showed 20 per cent of people would definitely stop using a company’s services after hearing news of a data breach, while 57 per cent would consider stopping. Only eight per cent said the coverage would make no difference and 14 per cent said they didn’t know.
Mr Graham said: “The knock on effect of a data breach can be devastating for a company. Getting hit with a fine is one thing, but when customers start taking their business – and their money – elsewhere, that can be a real body blow.”
Some 95 per cent of people polled by YouGov said it was very or fairly important that companies were clear from the outset about how their personal information would be used. And 94 per cent deemed it very or fairly important that their information was not shared with other companies.
Mr Graham said: “It is clear that people care about what happens to their personal information. Getting it right is not only an obligation under law, but it should be central to an organisation’s reputation management.”
The ICO has meanwhile launched a self-assessment tool for small and medium sized organisations (SMEs) to assess their compliance with the Data Protection Act. The toolkit provides links to guidance and further information, and will generate a rating based on responses.
Visit https://ico.org.uk/for-organisations/improve-your-practices/data-protection-self-assessment-toolkit/.
