Intellectual Property Law

The Government hasn't exactly had the best record of late when it comes to the way in which it handles personal data.

It was in November 2007 that the Chancellor Alastair Darling revealed that two unencrypted CD's containing the personal details of 25 million child benefit claimants and their parents had gone missing. Only a month later the Transport Secretary Ruth Kelly reported that the details of 3 million learner drivers were lost when the hard drive on which they were recorded was misplaced in Iowa. In the same month the personal details of thousand of benefit claimants were found on a CD in the home of a former contractor to the Department of Work and Pensions and just three days later, the Government lost the names, dates of birth and national insurance numbers of 45,000 people claiming benefits in West Yorkshire.

In fact research shows that in 2007 a record 37 million items of personal data went missing and most of it was lost by the Government and the trend has continued in 2008. In June this year two NHS trusts lost unencrypted laptops which held records of 31,000 patients and just a month earlier, 38,000 were lost when the Isle of Wight Primary Care Trust posted the tape on which the information was held.

In light of this track record, it is somewhat surprising that the Home Secretary Jacqui Smith has announced plans to grant the Police and security services more powers to gather data from people's phone, email and web browsing. Consultation on the plans, which are expected to be included in the Communications Data Bill due to be included in the Queens Speech in November, will start in the New Year but reports have suggested that the Government wants single database to store the details of every UK phone call and email sent.

So what recourse do individuals, whose personal data and details have been lost, currently have? Under the Data Protection Act 1998 (DPA) appropriate technical and organisational security measures must be taken to prevent unauthorised or unlawful processing, accidental loss of or destruction to personal data. If this principle is breached, individuals are entitled to compensation from data controllers for damage caused. However, the courts have made it clear that compensation will only be available where the individual if they have suffered damage by reason of a data controller's contravention of the DPA. Where no damage is caused, no compensation is payable.

The House of Lords has backed a proposed amendment to the criminal justice and immigration bill which would make it a criminal offence to "intentionally or recklessly disclose information" or "repeatedly and negligently" allow information to be disclosed. Whilst stronger privacy laws are to be welcomed, in the short term, individuals have only a limited course of action reliant upon them actually suffering damage in order to claim compensation.