Can Your Business Afford Not To Get Its Data Protection House In Order?

Commerce & Technology Partner Mark O'Shea considers recent fines imposed for data protection transgressions, and the potential cost of these to businesses.

ICO Powers

The Information Commissioner's Office (ICO) has a broad range of powers to enforce data protection infringements. The ICO can require businesses to pay up to £500,000 for serious breaches of the Data Protection Act 1998 or for serious breaches of the Privacy and Electronic Communications Regulations by issuing monetary penalty notices. Other sanctions include:

information notices which require specified information to be provided within a stated time period: undertakings which commit a business to a particular course of action; enforcement notices and 'stop now' orders which require businesses to take (or refrain from taking) specified actions; audits (consensual assessments) to check compliance; and/or prosecution of criminal offences under the Data Protection Act 1998. Monetary Penalty Notices The imposition of monetary penalty notices by the ICO for serious losses of data is a regular occurrence. Health Authorities, Councils and Police Forces have been particularly vulnerable. For example, in October 2012 a penalty of £150,000 was imposed on Greater Manchester Police following the theft (from an officer's home) of an unprotected memory stick containing sensitive personal data comprising details of over one thousand people with links to serious crime investigations. In September 2012, Scottish Borders Council was fined £250,000 after former employees' pension records were found in a paper recycling bank in a supermarket car park. And, in June that year, Brighton and Sussex University Hospitals NHS Trust was...