[BeeEmmDubleYuu]

Just wondering if anyone knows under what circumstances can an individual be sued surrounding DPA (data protection act)?

I mean everyone in a company at some point has access to customer data so sales ' customer service guys have it, IT have access to it, aftercare have access to it etc but under what circumstances are individuals held responsible?

I know it's a long winded question but any examples would help. If something is unclear then feel free to ask.

[ronime]

Google is your friend.

http://www.allenovery.com/publicatio...-Breaches.aspx

"It’s not yet clear what form any personal liability might take. Where criminal offences under the Data Protection Act (DPA) are committed by a corporate body then any ‘director, manager, secretary or similar officer’, as well as the corporate body, can be prosecuted for the offence if it has been committed with their consent or connivance or be attributable to any neglect on their part."

[XWV]

First, IANAL. If you want professional advice you really need to go to a professional. However this is an area I'm interested in, so...

So much here depends on context, which obviously isn't something you can supply in this sort of situation, but I'd say situations where individuals might be successfully prosecuted for their own direct actions are likely to be rare - basically in cases where individuals have stolen customer data from their employer to sell or otherwise misuse. Executive officers are more likely to be prosecuted for indirect actions (or more likely inaction) leading to data protection breaches.

Individuals bringing actions against other individuals is something that I don't think there's even any mechanism for.

I'd expect any company to regard personal misuse of customer data as gross misconduct - not to do so might leave the relevant managers open to prosecution for that misuse.

[isleaiw1]

Originally Posted by BeeEmmDubleYuu

Just wondering if anyone knows under what circumstances can an individual be sued surrounding DPA (data protection act)?

I mean everyone in a company at some point has access to customer data so sales ' customer service guys have it, IT have access to it, aftercare have access to it etc but under what circumstances are individuals held responsible?

I know it's a long winded question but any examples would help. If something is unclear then feel free to ask.

From my DPO, when I asked if an individual could be prosecuted for accidental or deliberate misuse of customer personal data... "That's a criminal offence under section 55 of the DPA. Anyone who uses data without the consent of the the data controller is guilty of that offence. There is an exemption for journalism and public interest."

He is quite knowledgeable on this stuff so hopefully that helps....