Comply with data protection legislation

Enforcement and penalties

If your business processes personal information you need to be aware of the offences under the Data Protection Act 1998.

These include offences relating to:

• notification - where a data controller has failed to notify or to make changes to their notification entry
• knowingly or recklessly obtaining, disclosing, selling etc of personal information without the consent of the data controller
• non-compliance with a notice issued by the Information Commissioner

Enforcement of the Act is the responsibility of the Information Commissioner who oversees and promotes compliance with the legal requirements.

If the Information Commissioner believes a data controller has not complied with one of the data protection principles he can issue an enforcement notice requiring a data controller to take certain steps or to stop processing personal information to bring the processing into compliance with the principle. The notices can be appealed against.

The Information Commissioner may also bring a criminal prosecution where he is satisfied an offence under the Act has been committed.

Failure to notify carries a maximum penalty of £5,000 plus costs in a Magistrates' court or an unlimited fine in the Crown Court.

Data subjects who suffer damage, or damage and distress, as a result of a data controller's non-compliance are entitled to apply to the Court for compensation.

Subjects covered in this guide

• Introduction
• The Information Commissioner
• The Data Protection Act
• The eight principles
• Notifying the Information Commissioner
• Exemptions from notifying the Information Commissioner
• Rights of access
• Monitoring employees
• Enforcement and penalties
• Bogus data protection agencies
• Here's how I complied with the Data Protection Act 1998