Latest news
- Beware public law arguments in anti-social behaviour possession proceedings
- Granting tenancies to minors is no minor matter
- Suzanne is new pensions partner
- New NI rules affect EU workers and employers
- Beware of relying on indemnity in plant hire standard terms
- Head of planning has voice in UK-wide debate
See more Press releases
RSS news feeds
Home | News & events | Legal updates | Data protection fines signal a new era of enforcement
Data protection fines signal a new era of enforcement
19 January 2010
Serious breaches of the Data Protection Act 1998 could attract fines of up to £500,000, it has been announced.
The Government has confirmed the penalties the Information Commissioners Office (ICO) can impose on data controllers in serious contravention of the Act, and where the contravention was ‘deliberate or reckless and of a kind likely to cause substantial damage or substantial distress to individuals’.
Fines can be applied to contraventions taking place on or after 6 April 2010.
The ICO considers the sum appropriate to encourage organisations to comply with the Act and deter them from breaching it. It has also published statutory guidance on the circumstances in which a fine will be imposed and the factors affecting the amount.
In response to concerns raised during the consultation, the ICO has reiterated that fines are only designed to deal with the most serious contraventions, and that it has no desire ‘to impose serious financial hardship on a responsible data controller’.
In making its decision on whether or not a fine is an appropriate response to a particular breach, the ICO will consider a number of factors, including:
- the seriousness of the breach (by reference to the duration of the breach, the nature of the breach and the data involved, the number of affected individuals, the level of public importance)
- the likelihood of damage and distress
- whether or not the breach was deliberate or negligent (for example a repeat breach, failure to follow ICO guidance)
- what action the organisation had taken to protect information (for example risk assessments, governance/audits, policies/procedures)
Where the ICO concludes a fine is appropriate, it will decide how much based on the above factors and others, including:
- the sector in which the data controller operates, for example voluntary or private
- the size of the data controller and the financial and other resources available to it
Applying this guidance, the ICO has highlighted that a data controller with substantial financial resources is more likely to attract a higher monetary penalty than a data controller with limited resources, for a similar contravention of the Act.
One positive aspect of the guidance for data controllers is that a 20% discount on the fine will apply if it is paid within 28days of the notice being served.
What is also worth noting is that issuing a fine will not preclude the ICO from also serving an enforcement notice on the data controller if the ICO considers taking positive steps is also necessary to bring about compliance.
© Shoosmiths. This page is for general information: it is not legal advice. Please read our full terms and conditions for details of the disclaimers and exclusions which apply.
Search the site
Enter the keywords below to search:
Get in touch
Aisling Duffy
Solicitor
T: 03700 86 5089
I: +44 (0)115 906 5089
E: aisling.duffy@shoosmiths.co.uk