2 May 2014
Peterborough office
48 Broadway, Peterborough Cambridgeshire, PE1 1YW
01733 346 333 01733 562 338 enquiries@hegarty.co.ukStamford office
10 Ironmonger Street, Stamford Lincolnshire, PE9 1PL
01780 752 066 01780 762 774 enquiries@hegarty.co.ukOakham office
66 South Street, Oakham Rutland, LE15 6BQ
01572 757 565 01572 720 555 enquiries@hegarty.co.ukMarket Deeping office
27a Market Place, Market Deeping, PE6 8EA
01778 230 120 01778 230 129 enquiries@hegarty.co.uk2 May 2014
Q. Is my company in breach of the Data Protection Act (DPA) and liable to be fined if my employee loses their own personal device holding company information?
A. The DPA applies to the processing by data controllers of personal data relating to data subjects. A breach of the DPA may result in the data controller, often the company or employer, being liable for a substantial fine up to £500,000.
To avoid contraventions of the DPA companies should consider appointing a data-compliance officer and implementing relevant company policies. Employers should be particularly vigilant about the contents of any employment contracts and consider whether they make sufficient provisions for breaches of the DPA.
To emphasise the stringent approach under the DPA, a company may even be liable where a device is lost or stolen and contains or allows access to personal data of the company and/or that device is inadequately encrypted. This is particularly important when a firm operates a ‘Bring Your Own Device’ (BYOD) policy.
The Information Commissioner’s Office website offers valuable guidance to data controllers.
