New Penalties for Breach of Data Protection Act
Published February 2010
The Information Commissioner’s Office (ICO) has announced new penalties for serious breaches of the Data Protection Act, due to come into force on 6th April 2010.
It is expected that, from this date, the ICO will be able to order organisations to pay up to £500,000 in fines. The ICO has stated that, when enforcing these high penalties, all circumstances shall be carefully considered including the seriousness of the data breach; the likelihood of substantial damage and distress to individuals; whether the breach was deliberate or negligent and what reasonable steps the organisation has taken to prevent breaches.
For a data breach to attract a monetary penalty it must be clear to the ICO that the breach was significantly serious as to be likely to cause damage or distress and it must have been either deliberate or negligent with the organisation failing to take reasonable steps to prevent it.
