8/6/2019 ACS Law Fact Sheet (2) (5)

1/2

ACS Law fact sheet

Mr Crossley was served with a monetary penalty for a seriousbreach of the Data Protection Act - the law the ICO isresponsible for regulating. The ICOs remit does not cover

looking into an individuals more general business practices.

The power to impose a civil monetary penalty is as set out inthe Data Protection Act and the statutory guidance is set outin Guidance about the issue of monetary penalties.

Although the breach itself and the number of people affectedwas taken into account, the primary reason Mr Crossley wasissued with a monetary penalty was because he did not haveadequate systems and procedures in place to keep personal

data secure. The data was also sensitive in its nature and itsdisclosure was of a kind likely to cause substantial distress.

Victims of the data breach are entitled to claim compensationunder the Data Protection Act but this right can only beenforced by the victims themselves through the courts. TheICO penalty notices will though assist any victims who want totake such action. You can find out more on how to do this onour website at:http://www.ico.gov.uk/upload/documents/library/data_protec

tion/practical_application/claiming_compensation_2.0.pdf

The penalty is not kept by the Commissioner and, whateverits level, it can not be used to provide redress for individuals.It must be paid into the HM Treasurys Consolidated Fund.

The Commissioner cannot impose a monetary penalty on anindividual without taking proper account of that individualsfinancial circumstances. The guidelines he must follow whendeciding the amount of a monetary penalty which have

been approved by Parliament clearly state that the likelyimpact on an individual must be taken into account. Theguidelines make clear that the purpose of a penalty is not toimpose undue financial hardship and that the Commissionerwill take into account any proof of genuine financial hardshipwhich may be supplied. In this case Mr Crossley provided theCommissioner with a sworn statement verifying his means.

After receiving written representations and a sworn statementfrom Mr Crossley verifying his means the Commissioner had

no legal power to inquire further.

http://www.legislation.gov.uk/ukpga/1998/29/contentshttp://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/ico_guidance_monetary_penalties.pdfhttp://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/claiming_compensation_2.0.pdfhttp://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/claiming_compensation_2.0.pdfhttp://www.legislation.gov.uk/ukpga/1998/29/contentshttp://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/ico_guidance_monetary_penalties.pdfhttp://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/claiming_compensation_2.0.pdfhttp://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/claiming_compensation_2.0.pdf

8/6/2019 ACS Law Fact Sheet (2) (5)

2/2

The Commissioner must act within the provisions of the DataProtection Act. His decisions are subject to appeal. He mayhave to justify his decision making and, in particular, theamount of a monetary penalty, to the Court or Tribunal.

A monetary penalty is not the same as a fine imposed by thecourts for a criminal offence. It is a civil debt that would betaken into account in any bankruptcy proceedings and doesnot take precedence over other civil debts an individual mighthave. It would clearly be wrong of the Commissioner toimpose a penalty that he knew could not realistically be paid.Doing so would, amongst other things, have the potential totake money away from other legitimate creditors.

The ICOs detailed investigation into the security breach took

some time to complete and the legal process that followedfurther delayed this matter. However, even if ACS Law hadstill been trading its financial situation following the cyberattack would also have been taken into account by theCommissioner in accordance with the guidelines referred toabove. Therefore Mr Crossley trading as ACS Law might stillhave received a substantially reduced monetary penalty.There was therefore no incentive on Mr Crossley to close hisbusiness simply to avoid a higher penalty. Mr Crossley was asole proprietor of ACS Law and personally liable to pay the

monetary penalty in any event.