MONETARY PENALTY

NOTICES

WHAT ICO NEEDS TO SHOW

(1) Contravention of data protection principles...

(2) That was serious...

(3) of a kind likely to cause substantial damage

or substantial distress; and

(4) Knew/ought to have known and failed to

take reasonable steps;

(5) MPN is appropriate in the circumstances;

and

(6) A notice of intent has been properly served.

The Contravention

• To be distinguished from the trigger

incident

• Must be identified in the notice

Likely to cause substantial

damage or distress

• Quantity as well as quality

• Substantial distress assumed if sensitive

personal data sent to public

• ICO also relies on stress of being told?!

Knowledge and reasonable

steps

• Risk assessments

• Staff training

Discretion and notice

• Is MPN appropriate

• Did the ICO serve a procedurally correct

notice of intent?

Thirty Nine Essex Street LLP is a governance and holding entity and a limited liability partnership registered in England and Wales (registered number0C360005) with

its registered office at 39 Essex Street, London WC2R 3AT Thirty Nine Essex Street's members provide legal and advocacy services as independent, self-employed barristers

and no entity connected with Thirty Nine Essex Street provides any legal services. Thirty Nine Essex Street (Services) Limited manages the administrative, operational and

support functions ofChambers and is a company incorporated in England and Wales (company number 7385894) with its registered office at 39 Essex Street, London WC2R 3AT