On 6 April 2010, the Information Commissioner's Office
("ICO") acquired significant new powers to fine Data
Controllers that fail to protect personal data up to
£500,000.
Data controllers are organisations that collect data that can be
used to identify individuals and determine the purposes for, and
the manner in which, such information is processed. Given the
steady increase in reported data losses, it may not be long before
the ICO is given the opportunity to test these new powers.
The change was introduced by the Criminal Justice and
Immigration Act 2008, which amends the Data Protection Act
("DPA"), and allows the ICO to issue a Monetary Penalty
Notice ("MPN") (a) where the data controller seriously
contravenes the data protection principles; (b) this is likely to
cause substantial damage or distress; and (c) it was deliberate, or
reckless, in circumstances where the data controller failed to take
reasonable steps to prevent it.
