2020-02-17
Legal Articles

Data protection - Sony fined £250,000 for data security breach

Home / Knowledge base / Data protection - Sony fined £250,000 for data security breach

Posted by Claire Halle-Smith on 08 March 2013

Claire Halle-Smith Senior Associate

The UK Information Commissioner’s Office (the “ICO”) has fined Sony £250,000 following a breach of security of its PlayStation Network Platform.

In April 2011, a group of hackers attacked part of the PlayStation Platform compromising the personal information of millions of Sony customers, including their names, addresses, email addresses, dates of birth, account passwords and in some cases, credit card details.

ICO’s findings

The ICO determined that Sony had committed a serious breach of the Data Protection Act 1998. It had failed to ensure that appropriate technical measures were taken against unauthorised or unlawful processing of personal data stored on its servers (breaching the seventh data protection principle). 

The ICO considered a number of aggravating and mitigating factors, including the nature and effect of the breach, Sony’s behaviour and the impact on Sony. 

Aggravating factors:

  • The nature and vast amount of personal data placed at risk meant that the contravention was considered particularly serious.
  • Sony should have been aware of the software vulnerability, acted sooner and had sufficient resources to address the security issues.
  • Sony has sufficient financial resources to pay a monetary penalty up to the maximum without causing undue financial hardship.

Mitigating factors:

  • Sony was subject to “a focused and determined criminal attack”.
  • Sony had taken steps to secure some aspects of the PlayStation Platform and there had been no similar security breach in the past.
  • The compromised personal data was unlikely to have been used for fraudulent purposes and the ICO had not received any complaints.
  • Sony voluntarily reported the contravention to the ICO and had subsequently been fully cooperative with the ICO investigations. 
  • Sony had taken substantial remedial action, which included informing the affected data subjects and offering reparation in the form of a “welcome back” package where appropriate.
  • The security breach had had a significant impact on Sony’s reputation.

Comment

Although the maximum fine that can be levied is £500,000, this is the largest penalty awarded by the ICO against a private company to date. 

The case highlights that organisations that process consumers’ personal data need to remain vigilant to data security and ensure that they have appropriate, effective and up to date security measures in place to protect all personal data stored and processed on their computer systems. 

In the event of a breach occurring, data controllers should consider making a voluntary notification to the ICO and co-operating fully with the ICO’s investigations, as this may be taken into account by the ICO to reduce the level of the penalty.

About the author

Claire Halle-Smith

Senior Associate

Claire is a senior associate with extensive in-house commercial experience within the social care sector. Claire acts for a wide range of clients, from individuals and small businesses to larger, multi-national organisations.

Claire Halle-Smith

Claire is a senior associate with extensive in-house commercial experience within the social care sector. Claire acts for a wide range of clients, from individuals and small businesses to larger, multi-national organisations.

Recent articles

04 June 2020 Coronavirus: business interruption insurance update

If you purchased business interruption cover (BI), you might have insurance to pay losses while you cannot trade. You will need to have one or two of the most common BI extension clauses and cover will depend very much on the wording of that clause.

Read article
04 June 2020 What can our health service learn now from Covid?

It is normal for most organisations to have a business continuity plan that is regularly reviewed, updated and stress-tested to ensure that it is sufficiently robust to deal with pretty much every conceivable disaster scenario.

Read article
04 June 2020 Setting a trend for success fee recovery in 1975 Inheritance Act claims?

In a recently unreported Inheritance (Provision for Family and Dependants) Act 197 claim (‘the Act’), His Honour Judge Gosnell sitting at Leeds County Court made the unusual decision to give an award specifically to part-pay a claimant’s success fee, which was payable by the Claimant as a result her ‘no win, no fee’ funding agreement.

Read article
Contact
How can we help?
01926 732512
CALL BACK