[2024] UKUT 287 (AAC)

The FTT then addressed whether the contravention of section 4(4) DPA 1998 that it had found made out in respect of DPP7 was serious. It concluded that it was serious having regards to:

“111….

a.

The fact that the personal data of approximately 25 million individuals were stored on DSG’s IT system at the relevant time;

b.

The nature of this personal data, which comprised names, postal addresses, email addresses, dates of birth, and credit check information, as well as an unknown quantity of PAN capable of being used to indirectly identify a living individual, and

c.

The reasonable expectation of individuals and society that a body of personal data of this nature would be adequately protected, given the potential consequences of unauthorised or unlawful processing.”