Further Reading: Enforcement and sanctions

Further Reading: Enforcement and sanctions

Non-compliance with Data Protection legislation has consequences for both data controllers and data processors through the application of:

  • Rights of the Individual
  • Powers of the Supervisory Authority (which in the UK is the Information Commissioner through her office, the ICO)

Individuals have rights to:

  • Lodge a complaint with the Supervisory Authority (the ICO in the UK) regarding a controller or processor
  • An effective judicial remedy against a Supervisory Authority
  • An effective judicial remedy against a Controller or Processor
  • Be represented by a body or organisation
  • Right to compensation for material or non-material damage from a controller or a processor –
    • Non-material damage includes distress Section 168 of the DPA 2018
    • Damages for distress is calculated in accordance with personal injury guidelines for psychological or psychiatric injury: TLT and others v The SS for the State and the Home Office [2016] EWHC 2217 (QB) link: https://www.bailii.org/ew/cases/EWHC/QB/2016/2217.html

Powers of the ICO

The ICO is under an obligation to monitor data protection within the UK, protect the fundamental rights and freedoms of the individual and to ensure that free movement of personal data across the EU/EEA. The ICO has a wide range of powers including power to:

  • Conduct compliance assessments, which if urgent, may be conducted within 7 days of notice
  • Issue
    • A request for information notice, which may, if urgent, require action within 24 hours. Failure to respond may result in a Court order requiring compliance
    • A warning where proposed action threatens non-compliance with data protection legislation
    • A reprimand for infringements of relevant data protection legislation

References:

Articles 77 to 84
Recitals 142 – 152
http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611237
https://ico.org.uk/for-organisations/the-guide-to-nis/enforcement/

Data Protection Act Part 6,7 and mainly Schedules 15 and 16
https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted

Vidal-Hall v Google [2015] EWCA Civ 311 Gulati v MGN [2015] EWCA Civ 1291
Murray v Express Newspapers [2007] EWHC 1908 (Ch)
Lloyd v Google [2019]EWHS Civ 1599 but appealed to the Supreme Court
TLT and others v The SS for the State and the Home Office [2016] EWHC 2217 (QB) link: https://www.bailii.org/ew/cases/EWHC/QB/2016/2217.html

W M Morrisons v Various Complainants [2020] UKSC 12
https://www.supremecourt.uk/cases/uksc- 2018-0213.html