The UK Information Commissioner’s Office (the “ICO”) has fined Sony £250,000 following a breach of security of its PlayStation Network Platform.
In April 2011, a group of hackers attacked part of the PlayStation Platform compromising the personal information of millions of Sony customers, including their names, addresses, email addresses, dates of birth, account passwords and in some cases, credit card details.
ICO’s findings
The ICO determined that Sony had committed a serious breach of the Data Protection Act 1998. It had failed to ensure that appropriate technical measures were taken against unauthorised or unlawful processing of personal data stored on its servers (breaching the seventh data protection principle).
The ICO considered a number of aggravating and mitigating factors, including the nature and effect of the breach, Sony’s behaviour and the impact on Sony.
Aggravating factors:
- The nature and vast amount of personal data placed at risk meant that the contravention was considered particularly serious.
- Sony should have been aware of the software vulnerability, acted sooner and had sufficient resources to address the security issues.
- Sony has sufficient financial resources to pay a monetary penalty up to the maximum without causing undue financial hardship.
Mitigating factors:
- Sony was subject to “a focused and determined criminal attack”.
- Sony had taken steps to secure some aspects of the PlayStation Platform and there had been no similar security breach in the past.
- The compromised personal data was unlikely to have been used for fraudulent purposes and the ICO had not received any complaints.
- Sony voluntarily reported the contravention to the ICO and had subsequently been fully cooperative with the ICO investigations.
- Sony had taken substantial remedial action, which included informing the affected data subjects and offering reparation in the form of a “welcome back” package where appropriate.
- The security breach had had a significant impact on Sony’s reputation.
Comment
Although the maximum fine that can be levied is £500,000, this is the largest penalty awarded by the ICO against a private company to date.
The case highlights that organisations that process consumers’ personal data need to remain vigilant to data security and ensure that they have appropriate, effective and up to date security measures in place to protect all personal data stored and processed on their computer systems.
In the event of a breach occurring, data controllers should consider making a voluntary notification to the ICO and co-operating fully with the ICO’s investigations, as this may be taken into account by the ICO to reduce the level of the penalty.
