The announcement had been expected ever since the ICO Twitter account tweeted, "#Sony CEE confirms it will not be appealing £250k penalty after serious #DPA breach", last Thursday. Now Sony has made formal confirmation, although it continues "to disagree with the decision on the merits."
According to a report in Computing, Sony fears that fighting the case 'could risk exposing sensitive information about its own networks.' "This decision," said a Sony spokesperson, "reflects our commitment to protect the confidentiality of our network security from disclosures in the course of the proceeding."
It was in January 2013 that the ICO announced the fine. “The penalty we’ve issued today is clearly substantial, but we make no apologies for that," said David Smith, deputy commissioner and director of data protection. "The case is one of the most serious ever reported to us. It directly affected a huge number of consumers, and at the very least put them at risk of identity theft."
The breach itself potentially exposed account details for up to 77 million customers, including names, addresses, email addresses, dates of birth and account passwords. Credit card details may also have been exposed, and although Sony said at the time that card data had been encrypted, it did not explain the strength of the encryption.
Had Sony continued with an appeal it would have been the first time that an ICO decision would have to face the power of corporate lawyers in the courts. For the most part, the sheer cost of legal action against fairly low fines has made appealing an uneconomic proposition. However, if the European Commission's GDPR proposal for fines based on global turnover become enacted in the future (leading to the potential for fines in the billions of dollars range for large corporates), then appeals are likely to become common for large companies in the future.
Sony could have been in the vanguard of that. Meanwhile it has proven to be in the vanguard for attacks against gaming companies. In this month alone, Ubisoft, Nintendo and Konami have all been attacked.