Turning up the heat: Latest developments in data protection law
James Castro-Edwards, Head of Data Protection Law discusses the recent developments affecting organisations in this area of law.
Spring 2015 has seen two significant developments in data protection law, of which companies should be aware. The first was the decision in Google Inc v Vidal-Hall & Ors  EWCA Civ 311 of 27 March, which could establish 'misuse of private information' as a tort. The second was the publication on 1 June of the latest draft of the European General Data Protection Regulation (GDPR) and a timetable for finalising the text.
Vidal-Hall could potentially allow individuals who have suffered distress from the way their information has been used a right to sue the organisation responsible, even if the affected individuals have suffered no financial loss. This potentially has far-reaching consequences as to how companies manage information about their employees, customers and suppliers. Meanwhile, the GDPR would reform existing data protection laws across Europe and introduce heavy penalties (up to 2% of worldwide annual turnover) for those who transgress them.
The changes will affect organisations that handle information about people, whether these are employees, customers, tenants or suppliers. Almost all UK companies will be subject to the GDPR in one way or another. The risk is greatest for those companies that handle a large volume of personal information, and those who deal with particularly sensitive information. Operators in the property sector may face increased risk if, for example, they hold large volumes of data relating to tenants, or prospective purchasers or have a large workforce. Personal information may also require a higher standard of care if it includes information about individuals' financial circumstances, or health, for example. Sharing data between affiliates, business partners and sub-contractors may also be problematic.
Organisations that may have previously seen compliance with the Data Protection Act 1998 as a low priority should consider revisiting the subject as the law becomes more stringent, to avoid potentially heavy penalties. It is essential that they 'grasp the nettle' and evaluate their