Commissioner fines law firms
The Information Commissioner's Office (ICO) has successfully prosecuted two London law firms for failing to notify as data controllers under the Data Protection Act 1998 (DPA).
Under the DPA, organisations that process individuals’ personal information may be required to notify the ICO at a nominal cost of £35 per year. Notification is a form of registration. Most organisations that hold personal data are required to notify with the ICO under the DPA because they are holding personal data.
We advise many law firms and other professional services firms on compliance with privacy and the DPA. For US law firms operating in the UK, there are additional compliance requierments as a result of the fact that personal data - such as data regarding clients, partners and staff - is often transferred from the UK office to the US head office. Under the DPA it is unlawful to transfer personal data outside the EEA unless appropriate arrangements are made to ensure the protection of the data and the rights of the data subjects. For more information on international data transfers, see here.
Please contact us for more information on how we can help you to comply with the DPA.