Consumer data thieves to get jail terms, top civil servant warns marketers

Brands need to tighten up their data privacy policies ahead of a sweeping change to EU data protection legislation, as the government looks set to introduce prison sentences for data theft, a data protection conference heard this morning.

David Smith, deputy information commissioner
David Smith, deputy information commissioner

David Smith, the deputy information commissioner, told the Direct Marketing Association’s Data Protection 2014 conference that the Information Commissioner’s Office is working with the government to introduce prison sentences to deter breaches of consumer data privacy.

Referring to the sale of T-Mobile consumer records by rogue former employees in 2009, Smith said: "Only prison sentences are likely to be a deterrent."

Smith also warned delegates of the brand damage that can result from poor handling of data breaches. He pointed out that US discounting giant Target, whose systems were hacked for credit card details and other personal data, had suffered a halving of its profits since the security breach in late 2013. Some 70m customers were affected, with Target’s chief information officer, Beth Jacob, resigning earlier this week.

Proposed changes to the EU Data Privacy Regulations – which currently date from 1998 and are being revised for the internet and social media age - would not impact the UK "for another four or five years", Smith said, but brands needed to be ready.

He said brands such as Microsoft, which "makes a feature of its privacy approach", were to be admired. Smith later told Marketing: "[Google has] done good work on explaining how people’s information is used. Businesses are starting to make privacy a brand differentiator. That’s the modern, up-to-date approach: getting in tune with your customer."

The draft regulation represents a considerable tightening of rules around targeted marketing, including giving consumers the right to have deleted any personal information brands are holding on them.

Smith told Marketing that this so-called "right to be forgotten", which experts believe would make the targeting promised by profile-based services such as BSkyB’s Adsmart more difficult to achieve, is not likely to make the final draft regulation to be voted on by the European Parliament, possibly later this year.

However he said that stricter provisions about the length of time brands may hold consumer data and a strengthening of consumers’ rights to control the use of that data are likely to be included.


Become a member of Campaign

Get the very latest news and insight from Campaign with unrestricted access to, plus get exclusive discounts to Campaign events.

Become a member

What is Campaign AI?

Our new premium service offering bespoke monitoring reports for your company.

Find out more

Looking for a new job?

Get the latest creative jobs in advertising, media, marketing and digital delivered directly to your inbox each day.

Create an alert now

Partner content