The early part of 2015 saw major changes to the monetary fines that may be imposed for breaches of the Data Protection Act (‘DPA’). For example, unlimited fines may now be imposed by UK Magistrates’ courts for criminal offences under the DPA.
The Information Commissioner’s Office (‘ICO’) has now seen similar changes to its powers. …
Since the Legal Aid, Sentencing and Punishment of Offenders Act 2012 (Fines on Summary Conviction) Regulations 2015 came into force 12 March 2015, the Magistrates’ Court has had the ability to impose unlimited fines for criminal offences under the Data Protection Act 1998 (‘DPA’).
Under s.55 DPA, an individual can be convicted of a criminal offence if he or she obtains or discloses personal data without the consent of the data controller. Before 12 March, a £5,000 fine cap existed, but this has now been removed, allowing for fines of any amount to be imposed at sentencing.
