> > I N D U S T R Y N E W S
LEGAL BRIEF
The Data Protection Act
The Data Protection Act 1998 (‘DPA’) applies to transferred outside of the EEA (unless the current consultation, the ICO will have the
the “processing” of “personal data”. This receiving country ensures an adequate level of power to levy such fi nes from April 2010.
means that practically every business operating data protection) and there must be appropriate Although the ICO will take into account the
within the UK which holds information technical and organisational security seriousness of the breach and the recourses
about individuals who can be identifi ed from measures in place to prevent unauthorised or available to the data controller, it is clear
that data (whether these individuals be unlawful processing of the data. that the ICO intends to take action to try and
employees, customers or anyone else) is Up until now the Information Commissioner’s curtail the frequency at which serious
affected by the DPA. Since breaching the DPA Offi ce (ICO), which is the independent body breaches to the DPA are occurring.
may result in both civil and criminal liability, set up to uphold information rights in the public It is therefore extremely important that
not to mention adverse publicity, no business interest, has had limited powers of businesses ensure that all personal data is
can afford to ignore its data protection enforcement. However, following a series of properly encrypted. This is especially true in the
obligations. high profi le DPA breaches including the HM case of portable devices such as laptops
The DPA imposes a large number of stringent Revenue and Customs’ loss of a CD containing and data sticks. Businesses should also review
obligations on those who process personal 25,000,000 child benefi t records and the their data protection policies general
data. These obligations require that data must theft of a Marks and Spencers’ laptop to reduce their level of exposure to the potential
be processed fairly and lawfully, be containing the personal pension details of new penalties.
obtained only for specifi ed lawful purposes, not 26,000 employees, the Ministry of Justice For further information on data protection
be excessive in relation to the purpose has issued a consultation paper proposing contact Jon Fielden of Gaby
for which it is processed, be processed maximum fi nes of up to £500,000 for Hardwicke Solicitors on:
accurately, be kept for no longer than is “serious” breaches of the DPA which cause jmf@gabyhardwicke.co.uk
necessary, be processed in accordance with “substantial damage and distress”. 01323 435900
the rights of the individual, not be Unless changes are made as a result of the www.gabyhardwicke.co.uk
For further information on any intellectual property issues, please contact Jon Fielden of Gaby Hardwicke Solicitors at:
jmf@gabyhardwicke.co.uk. 01323 435900 www.gabyhardwicke.com
PIXEL 05
Pixel Feb 10e.indd 5 03/02/2010 13:26
Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16