Data protection: the breaches continue

Despite high profile and damaging data losses in previous years, it seems that data controllers are still not ensuring compliance with their obligations under the Data Protection Act. 

The BBC today reports details of a very serious data loss which, if true, would suggest a significant breach of the seventh data protection principle.  According to the report, confidential police tapes were found at Buchanan Street bus station in Glasgow, relating to a child abuse inquiry.  The tapes reportedly contained an interview of a six year old girl, in relation to an alleged drunken assault by her father on her younger brother.

Such data is of course classified as sensitive personal data, since it has to do with the potential commission of an offence by the father and also relates to the health of the girl and her brother.  Failing to keep personal data or sensitive personal data secure is a breach of the seventh data protection principle, which requires that "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data".

Since April 2010, the Information Commissioner has enjoyed stronger powers to impose monetary penalties of up to £500,000 for breaches of the data protection principles (in terms of section 55A of the Data Protection Act 1998, which was inserted by the Criminal Justice and Immigration Act 2008, section 144(1).)  It remains to be seen whether this breach, if proven, will lead to a penalty for the responsible authority, but in the meantime, the quest for protecting personal data continues.