Public Service - Data breach regulations running late

The Information Commissioner's Office (ICO) has missed a March deadline to bring in new data protection powers.

According to The Register, the ICO was due to gain the power to fine organisations who lose personal data. To introduce the regulations, the Ministry of Justice (MoJ) must publish secondary legislation. So far, the department has refused to reveal when this will happen or why it missed the target.

An MoJ spokesman said: "The Criminal Justice and Immigration Act 2008 amended the Data Protection Act and introduced a power for the Information Commissioner to impose civil monetary penalties on data controllers that knowingly or recklessly commit serious contravention of the data protection principles (including security).

"We are committed to bringing these provisions into force as soon as possible."

Most of the ICO's European equivalents already have the power to fine organisations who lose personal data.

Changes to the Data Protection Act were pushed forward after a large number of data losses revealed by the public sector in 2008. The revelations first began after HM Revenue and Customs (HMRC) lost two discs that contained 25 million child benefits records.

An ICO spokeswoman said it had submitted to the Ministy of Justice's consultation on the powers, and was awaiting the outcome.