South of the border a maximum fine of £500,000 for a breach of the Data protection act has been proposed by government. In a consultation paper, the Ministry of Justice invited comment on introducing a maximum civil monetary penalty to be imposed by the Information Commissioner. The consultation will close on 21 December and a paper summarising the responses will be published by 11 January 2010.

Edinburgh keynote address: Dr Ken Macdonald,(left) Assistant Information Commissioner for Scotland Chair: (right) Professor Charles Raab.


Raising awareness of the role and functions of the Information Commissioner’s Office (ICO) within Scotland.

• Reviewing the draft Identity Management and Privacy Principles produced by the Public Service Reform Directorate

• Sharing examples of best practice in data protection between public and private sector organisations

• Discussing the benefits of Privacy Impact Assessments, including Privacy by Design initiatives and Privacy Enhancing Technologies

Data protection is an ongoing issue. With more and more information being stored and transferred digitally, there is strong concern amongst the general public for the privacy of their personal details. The remit of the ICO is developing rapidly, and it will have new powers to check and fine from April 2010.

All modern organisations handle and manage information, including personal data, as part of their business, and therefore data protection is just as much of an issue in the private as the public sector. Losses must be identified and learned from: both actual problems and near misses. Sharing examples of breaches between sectors, adopting a "lessons learned approach", will help progress for all concerned.

The public need to be able to trust and have confidence in Scottish public services and other organisations. The Public Service Reform Directorate has recently produced a set of draft Identity Management and Privacy Principles. In Scotland, following a consultation which ends on 23 November 2009, a report will be published in February 2010, followed by the final Principles for public service delivery organisations in Scotland by early spring 2010.

At Data Protection: Respecting Privacy, Building Trust, these Principles will be reviewed and their implementation discussed.

Any project involving personal data must consider privacy issues from inception, with Privacy Impact Assessments. Staff of all levels need to be fully trained in data protection, and understand the value of the information they are handling. Privacy Enhancing Technologies must be used, and Privacy by Design initiatives implemented, with information professionals working alongside organisations to ensure privacy risks are dealt with from the outset.

Technology is advancing incredibly quickly, and information-storing devices are becoming more and more portable. Following high profile data losses and data breaches involving laptops and memory sticks, the security of such mobile devices must be considered. How do we make sure that the next generation of mobile phones and laptops is as secure as possible? What is the safest way to store sensitive information?

All of these issues will be discussed by leading representatives from the public, private and academic sectors.