Monetary Penalty Notices

1. MONETARY PENALTY
NOTICES

2. WHAT ICO NEEDS TO SHOW
(1) Contravention of data protection principles...
(2) That was serious...
(3) of a kind likely to cause substantial damage
or substantial distress; and
(4) Knew/ought to have known and failed to
take reasonable steps;
(5) MPN is appropriate in the circumstances;
and
(6) A notice of intent has been properly served.

3. The Contravention
• To be distinguished from the trigger
incident
• Must be identified in the notice

4. Likely to cause substantial
damage or distress
• Quantity as well as quality
• Substantial distress assumed if sensitive
personal data sent to public
• ICO also relies on stress of being told?!

5. Knowledge and reasonable
steps
• Risk assessments
• Staff training

6. Discretion and notice
• Is MPN appropriate
• Did the ICO serve a procedurally correct
notice of intent?

7. Thirty Nine Essex Street LLP is a governance and holding entity and a limited liability partnership registered in England and Wales (registered number0C360005) with
its registered office at 39 Essex Street, London WC2R 3AT Thirty Nine Essex Street's members provide legal and advocacy services as independent, self-employed barristers
and no entity connected with Thirty Nine Essex Street provides any legal services. Thirty Nine Essex Street (Services) Limited manages the administrative, operational and
support functions ofChambers and is a company incorporated in England and Wales (company number 7385894) with its registered office at 39 Essex Street, London WC2R 3AT