How Effective Are Fines in Enforcing Privacy?

Abstract

Little, if any, research has been carried out on the effectiveness of fines, despite their being increasingly used by regulators. This chapter will look at monetary penalties, how regulatory authorities decide on the size of a fine, what factors influence that decision and how much information about this is provided to data controllers. Particular attention will be paid to the practice of the UK regulator, the Information Commissioner’s Office, which has considerable, albeit recent, experience in levying fines, mainly but not exclusively for security breaches. The chapter will consider available information on the impact of fines in the data controller community, for example, the practices of the UK health and local government authorities. The chapter will consider whether regulators should pay more attention to uniformity and consistency in the severity of fines and when to levy them, and in doing so will consider pan-EU co-operation in fining international data controllers. Apart from the deterrent effect, what other purposes could fines fulfil? For example, to what extent should fines be used to fund data protection regulation? Where data subjects have suffered damage or loss, should the fine ensure those individuals are recompensed for the damage they have suffered? The chapter also considers alternatives to fines, and in what circumstances these may be more effective in enforcing privacy rights.