Thread by @theDPOdaily

Having seen a few posts about director liability and data protection, I thought it would be worth setting out how it works and how the ICO would prosecute a director for their company’s UK #GDPR misdeeds.

Put simply, they can’t.

Section 198 of the UK DPA says if “an offence under this Act has been committed by a body corporate” and it can be proved that it happened with the consent or connivance or because of the neglect of a director (or similar), they are liable to be prosecuted.

This section doesn’t apply to any contraventions of the UK GDPR, only to *offences* set out in the UK DPA. The offences themselves are a mixed bag, ranging from obtaining personal data without the authorisation of the controller to unauthorised reidentification.

There are also offences over subject access and its portability and law enforcement cousins, where deliberate destruction or concealment of personal data is criminalised, as is enforced subject access for health or criminal data.

Separately, it’s an offence to make false statements in response to an ICO information notice, or to delete or conceal data relevant to an information notice.

A quirk of the DP offences is that they’re prosecuted by the ICO – there’s no point reporting a possible offence to the police because it’s not their role to investigate them. ICO is the equivalent of both police and CPS for the offences.

The opportunities for prosecuting directors are rare. The offences cover a narrow range of data misuses and ICO must prove two things: that a company committed the offence, and that a director either approved it or it happened because of their neglect.

ICO can’t prosecute a director because their company doesn’t provide transparency information or doesn’t answer subject access requests because these are GDPR contraventions, not criminal offences.

Possibly because of the pandemic, prosecutions have dried up. ICO also suffered an embarrassing loss in the Shepherd case in 2019 where it seemed that they had misunderstood how the DPA 1998 worked in offence cases.

The test for DPA 2018 is clear, so that shouldn’t be a barrier, but ICO hasn’t reported a successful conviction in more than two years. This is for any offence, not just ones that can be pinned on a director.

I don't know what the future holds for this part of UK DP; in the past those copying and misusing data from employers have been held to account, but nothing has happened for years. The idea that directors have much to fear seems very tenuous.