EMPLOYMENT NEWS: New Penalties for Data Protection Breaches

The Information Commissioner is to get new powers to impose fines of up to £500,000 for serious breaches of the Data Protection Act 1998, under regulations set to come into force on 6 April 2010. The penalties will be available for serious breaches of any of the Data Protection principles set out in Schedule 1 of the Data Protection Act. Although the most publicised breaches in recent years have been in relation to inadequate data security, the penalties will also be applicable in cases of the misuse of personal data (for example by unauthorised disclosure), unlawful transfer of personal data outside the EEA, or failure to obtain consent to use personal data.

For fines to be imposed, a breach must be serious and likely to cause substantial damage or distress. The data controller must have either acted deliberately, or have known or ought to have known that the breach would happen and that it would cause substantial damage or distress, and the data controller must have failed to take reasonable steps to prevent it.

The Information Commissioner has published guidance on how he will use the new powers, indicating how he will approach the imposition of penalties, including what will constitute a “serious” breach, what factors will be taken into account in determining whether a monetary penalty is appropriate, and how the level of penalty will be decided.

The ability to impose substantial financial penalties on data controllers for breach of the Data Protection principles gives the Information Commissioner real teeth for possibly the first time. If they have not already done so, organisations and individuals should review their activities to ensure that their processing of personal data is in compliance with the data protection principles, to avoid falling foul of the new powers. Hill Hofstetter is experienced in auditing data protection compliance and would welcome the opportunity to assist with such a review where required.

For further details of how the new penalties will work please click to view our latest ‘Data Protection Newsletter’.

If you have any questions or would like additional information on the issues covered in this update please contact Jessica Brickley.