The Information Commissioner’s Office (ICO) has announced that as part of its new three-year strategic vision it will take a more lenient approach to public sector organisations.
This new strategy will see the ICO reduce the potential economic impact that GDPR fines have on the public sector and focus more on promoting good data security practice. This will be trialled over the next two years.
Public sector needs to invest in cyber defences
This step makes sense. The public sector is restricted with the amount of budget it is able to spend. Therefore, if a department is breached and fined one of the eye watering amounts the ICO has been issuing, it hugely restricts what that department is able to spend on front-line services but also in further investment in protecting its data.
Indeed, huge fines mean that public sector organisations are likely to be at more risk of further breaches with the lack of investment they are then able to make to their cyber defences.
The hugely sensitive data that most public sector organisations hold mean that they are a prime target for cyber criminals. Indeed, we have seen throughout the last three years cyber criminals have upped their efforts to target public sector organisations. Not only have they increased the number of attacks but also the level of sophistication. This means that public sector organisations need to be looking at increasing the levels of the cyber defences, rather than finding money for huge fines issued by the ICO.
This makes the ICO’s decision to remove the threat of fines a good one, but that does not mean that the sector can relax its standards when it comes to cyber protection.
ICO alternatives to public sector fines
Instead of immediately issuing fines the ICO will look to increase warnings, reprimands and enforcement notices. Fines are still a possibility, but only in the most serious cases. It has also said that a number of existing fines against public sector organisations will be reduced, in some cases by up to 90 percent.
The key for the ICO and public sector organisations is that there is no relaxation on the investment and implementation of cyber defences.
The ICO has committed to working more closely with the public sector to encourage compliance with data laws and an increasingly complex regulatory landscape. Reducing the likelihood of a data breach is obviously the best way for organisations to remain compliant, therefore the need for new strategies and investment in cyber defences have to come hand-in-hand with the ICO’s new approach.
Zero-trust approach in the public sector
With the threat from cyber criminals increasing in sophistication all of the time the need for those within public sector organisations to think more carefully about potential threats is critical.
Taking a zero-trust approach can mean that the attempts by cyber criminals to gain access via malicious links or fake emails are negated. By ensuring nothing is taken on face value individuals within the public sector can make better decisions when it comes to opening potentially malicious emails.
Zero-trust wraps layered proactive, AI-powered around every user and every element of an organisation’s infrastructure.
Internal processes and the industrialisation of GDPR processes
A trend we have seen from the ICO over the past few months is that it is not just focusing on organisations that have suffered a high-profile breach, but increasingly those with poor internal processes. This means that those who believe that they are safe from scrutiny because they have not been impacted by a breach might be in for a shock, whether they are fined or not.
The key of course is that GDPR is not a one-time tick-box exercise but an ongoing process. The introduction of the regulation was precisely designed to protect the type of data that many public sector organisations hold. The industrialisation of GDPR means the embedding all compliance processes into business-as-usual practices. This ensures that they become automated, updating as when changes to the regulation come through.
Instead of being the responsibility of one or two individuals within public sector bodies, the industrialisation means that internal processes are automatically adhering to the latest version of GDPR.
The sensible step of taking away the threat of huge fines cannot be replaced with complacency with the public sector. The threat from cyber criminals and poor internal processes means that data within the sector remains very much at risk. The implementation of new cyber defensive strategies and solutions such as zero-trust and the industrialisation of GDPR processes will help to shore up and protect the often-sensitive data organisations hold. This in turn allows departments to ensure front-line services are given priority safe in the knowledge that data is safe and they will not be hit by a huge fine.
Rob Batters is director of managed and technical services at Northdoor plc
