By Emily Leach, CIPP

In this era of cloud computing and social media, personal information is being scattered across the globe by individuals and organisations alike. Responsible for regulating the handling of that information are the Data Protection Authorities (DPAs)--and the events of this year have kept them on their toes.

Recent media reports indicate that with the modernisation of the EU Data Protection Directive has come an increase in DPA actions--notably, the assessment of fines.

In the past, DPAs have been equated to “toothless tigers” having little ability to dole out severe enough penalties to effectively enforce regulations. But as Jay Cline, CIPP, writes for the IAPP’s Inside1to1: PRIVACY, a new wave of enforcement activity is at hand, triggered by technological advancements and bureaucratic momentum.

According to a soon-to-be released IAPP survey, leading the pack among European DPAs in terms of the amounts of fines levied in the past year are Spain, Italy and the UK, tallying more than €21 million combined.

Spain
Spain has been described as "one of the more enforcement-oriented DPAs in the EU,” and despite Parliament’s decision to lower many fines in the Spanish DPA’s penalty structure--and the government’s decision to give organisations a warning period before fining for data breaches, as reported by the Hogan Lovells Chronicle of Data Protection in March--the nation still topped the recent survey’s list with fines totaling €17.5 million.

Italy
Among the actions it has taken in the past year, the Italian Data Protection Authority (Garante) censored and fined a real estate agency for asking employment applicants "a disproportioned quantity" of personal questions. The DPA found that collecting and processing the sensitive personal information of job applicants violates the Data Protection Code.

UK
The UK Information Commissioner’s Office (ICO), meanwhile, recently released its guidance on fining powers it has received under the Privacy and Electronic Communications Regulations, which allow for fines of up to £500,000. In June, the ICO had fined one county council £120,000 for lax data protection involving misdirected e-mails.

Reactions to such fines have been mixed. While one Irish security expert credits the DPA’s increased fining powers with improving public awareness of breach risks, some in the UK are asking, whether, in tough economic times, fining organisations such as local councils is the best way to promote data protection.

For more information on DPA enforcement powers and regulatory actions around the globe, look for the IAPP Data Protection Authorities 2011 Global Survey to be released at the 33^rd Annual International Conference of Data Protection and Privacy Commissioners in Mexico City this November.