GDPR and prosecution

[FN-GM]

Hello,

 

I was wondering if someone can help. If an organisation has the correct polices and procedures in place but a member of staff goes against this and discloses information can the individual be prosecuted?

 

Thanks

[GREED]

As I understand it, if you can prove you have followed pre-issue and post-issue procedures, then you are fine. Remember GDPR is as much about prevention as it is handling when there is a problem.

[rom1984]

The DPA and GDPR is specific to data controllers so the ICO wouldn't bring enforcement or prosecution against an individual.

 

The things the ICO would look at when determining if the data controller was in the wrong would be are the correct procedures in place, how did the organisation tell staff about these procedures, did they do specific training, have they breached the policy before, if so what did you do etc.

 

However, if the person makes a DPA Section 55 offence, then this is a criminal offence and the ICO could take action against the individual. For example if the person stole data from the school or shared personal information without authorisation (like the link below)

 

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/02/former-council-worker-fined-for-sharing-personal-information/

Edited February 28, 2018 by rom1984

[rom1984]

This might help convincing staff too...

 

https://iconewsblog.org.uk/2017/11/16/personal-data-must-be-safe-from-prying-eyes/

[enjay]

This might help convincing staff too...

 

https://iconewsblog.org.uk/2017/11/16/personal-data-must-be-safe-from-prying-eyes/

 

Similar but slightly different to that, I've seen problems in the past where a staff member with a child in the school looked at their child's SIMS data, saw records of low-level behaviour incidents (which we wouldn't routinely inform parents about) then taken the issuing teacher to task over it in the staff room.

[mthomas08]

Hello,

 

I was wondering if someone can help. If an organisation has the correct polices and procedures in place but a member of staff goes against this and discloses information can the individual be prosecuted?

 

Thanks

 

YES. There was recently an incident that a member of staff in the Education sector took a screenshot/photo of FSM data and shared it with some one they shouldn't. That individual who took the photo was fined.

 

This wasn't the link I had but this is it:

https://parissmith.co.uk/blog/education-worker-fined-850-following-conviction-data-protection-breach-magistrates-court/

Edited March 1, 2018 by mthomas08