data-protection-and-journalism-a-guide-for-the-media-draft

Data protection and journalism
Disputes
Civil monetary penalties
We can also impose a civil monetary penalty (fine) of up to £500,000 if
we are satisfied that:
there was a serious breach;
it was likely to cause substantial damage or distress; and
it was either deliberate, or you knew (or should have known) of the
risk but failed to take reasonable steps to prevent it.
We don’t need the court’s permission to impose a civil monetary penalty,
but if the breach relates to a story which you have not yet published, our
powers of investigation are restricted. We can compel you to answer our
questions after publication, or if you are not acting with a view to
publication.
You can also appeal to the Information Rights Tribunal against a
monetary penalty.
For more information about our approach to monetary penalties, see our
separate guidance about the issue of monetary penalties.
Prosecution
The Information Commissioner can investigate and prosecute offences
under the DPA (except in Scotland, where the Procurator Fiscal brings
prosecutions).
A person or company found guilty is liable to a fine up to £5,000 if the
case is heard in a magistrates’ court or the sheriff court, or to an
unlimited fine on conviction in the Crown Court or the High Court of
Justiciary. There is currently no power to impose a custodial sentence.
Criminal offences created by the DPA include:
the section 55 offence;
processing personal data without notifying the ICO;
failing to comply with an Enforcement Notice; and
failing to comply with an Information Notice.
DRAFT 47