SPOTLIGHT

A zero sum game?

The number of SEND tribunal cases is rising and the proportion of appeals ‘lost’ by local authorities is at a record high. Lottie Winson talks to education lawyers to understand the reasons why, and sets out the results of Local Government Lawyer’s exclusive survey.

Data protection offenders threatened with hefty fines

The Ministry of Justice has announced plans to give the Information Commissioner the power to impose a fine of up to £500,000 on those seriously contravening data protection principles.

A consultation paper released this month, Civil Monetary Penalties: Setting the maximum penalty, asks whether such a penalty would be a proportionate sanction to a “serious contravention” of the Data Protection Act 1998 (DPA).

Under the DPA, as amended by section 144 of the Criminal Justice and Immigration Act 2008 (CJIA), the Information Commissioner may impose a civil monetary penalty when the following criteria have been satisfied:

(a) there has been a serious contravention of section 4(4) of the DPA by the data controller;

(b) the contravention was of a kind likely to cause substantial damage or substantial distress and either;

(c) (i) the contravention was deliberate; or,

(c) (ii) the data controller knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but failed to take reasonable steps to prevent the contravention.

A monetary penalty notice will only be used as punishment where there has been a deliberate or reckless handling of data. When deciding the extent of the penalty, the Information Commissioner will take into account the data controller’s size, the financial resources available to the data controller and the sector in which the data controller operates.

Justice Minister Michael Wills said: “The government is committed to ensuring that personal data is handled and processed responsibly and lawfully. We want to ensure that the Information Commissioner's Office has the powers it needs and is able to impose robust penalties on those who commit serious breaches of data protection principles.”

The government said a fixed maximum penalty will give the ICO the “flexibility and discretion to deal effectively with a large number and range of data controllers”.

The consultation closes on 21 December 2009.