Is it time to criminalise data breach cover ups?
As the US proposes criminalising data breach cover ups, we explore whether the UK should do the same.
![Arrest](https://cdn.mos.cms.futurecdn.net/V9GAkEfY7PgczmF6uiPW6U-320-80.jpg)
ANALYSIS The US is really upping its game in the fight against cyber crime.
In the past month, the Obama administration has made some moves to protect the nation from cyber attacks, releasing its first International Strategy for Cyberspace.
Now, in the proposed Personal Data Privacy and Security Act, the US Government has recommended criminalising data breach cover-ups.
Under current UK law private companies are not required to confess to data breaches, hence why the Information Commissioner's Office (ICO) has fined public bodies considerably more.
It looks likely the UK will one day make data breach disclosure mandatory, but should we follow the US and criminalise cover ups?
The ups and downs
It's clear there would be benefits to criminalising concealing of data breaches, the central one being the extra deterrent.
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2024.
"There is clearly merit in ensuring that data breaches are not hidden from those they affect, given the numerous high profile hacks that have taken place in the last six months," said Chris Boyd, senior threat researcher at GFI Software.
However, over regulation can be a stifling force. According to Boyd, smaller companies could be disadvantaged, given they don't have the same resources as big corporations to protect themselves.
"There is a worry that smaller companies will struggle to implement the same level of security protection as their much large rivals, running the risk of bad publicity, fines and further attacks," Boyd told IT Pro.
"It's concerning to think that we'd require further legislation such as this to make certain companies look at how they can improve their security instead of them doing it by default."
Certainly, companies should have security as one of their chief priorities, not just from a compliance perspective but out of respect for their customers.
Nevertheless, it would seem sensible to threaten companies with legal action. If companies can break laws and get away with it simply because they don't have to confess their sins, it makes for a pretty light-handed system. Sometimes fear is the best medicine.
Tom Brewster is currently an associate editor at Forbes and an award-winning journalist who covers cyber security, surveillance, and privacy. Starting his career at ITPro as a staff writer and working up to a senior staff writer role, Tom has been covering the tech industry for more than ten years and is considered one of the leading journalists in his specialism.
He is a proud alum of the University of Sheffield where he secured an undergraduate degree in English Literature before undertaking a certification from General Assembly in web development.
Most Popular
Resources
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2024.