Enforcing the Data Protection Act

If a data controller fails to comply with any of the Data Protection Act’s requirements, for example:

  • If it withholds information which is not exempt
  • Fails to respond to your request within 40 days
  • Refuses to correct demonstrably inaccurate information
You can complain either to a court or to the Information Commissioner. The Commissioner is usually preferable, as this costs you nothing.

Also, if you have suffered damage because a data controller has contravened the Data Protection Act, you are entitled to compensation under Section 13. The Information Commissioner, however, has no power to award compensation - you will need to take the organisation to court. In proceedings brought under this section it is a defence for the data controller to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.
kitsite