NEW: Labour’s decision to report Keir Starmer’s campaign to the information watchdog over an alleged data breach could result in the party itself being liable for a fine of more than £15million, if the ICO were to pursue the maximum possible sanction
As ‘data controller’ Labour is considered legally responsible for ensuring members’ personal information is protected. So far the ICO only say they are making enquiries, but if a personal data breach is deemed to have occurred the party could face a range of sanctions
The party insist the referral was made because Labour takes data protection responsibilities “extremely seriously”. Starmer allies however believe it was intended to undermine his campaign. If that WAS the intention, it looks like it might well have backfired...
Potential fines for data protection failings have significantly increased as a result of changes to the Data Protection Act last year, which enacted the european General Data Protection Regulations (GDPR) in UK law.
Perhaps unhelpfully for the party, yesterday a spokesperson for Rebecca Long-Bailey appeared to suggest the party was to blame for any potential breach because it hadn't restricted access to the Dialogue membership database after the general election 
Full story: news.sky.com/story/labour-c…
The obligation for Labour to self-report a potential breach is a given. However, the party are now suggesting it is “misleading & disingenuous” for me to suggest the referral *could result* in the party being liable for a fine, despite them being liable as the data controller 🤷♂️
