Under section 55A of the DPA, provision is made for the Information Commissioner's Office ("ICO") to impose a monetary penalty on data controllers who breach their obligations. These are in addition to the ICO's powers to issue Enforcement Notices requiring data controllers to do or refrain from doing things in relation to the processing of data. The current maximum monetary penalty that can be imposed by the ICO is £500,000.
How are monetary penalties assessed?
With only a few exceptions, monetary penalties can be imposed on any data controller (but not on a data processor who is proce…