Making UK directors personally liable for data privacy breaches
Among the proposals for the U.K.’s new Digital Economy Bill (the Bill), due to become law next spring, is one under which company directors would become personally liable for payment of fines as a result of nuisance calls being made by their companies. At a recent House of Commons Public Bill Committee meeting, Elizabeth Denham, the U.K. Information Commissioner, suggested that directors of companies who violate data protection laws should be personally liable to pay fines.The general aim of the Bill is to improve the U.K.’s digital infrastructure by encouraging the development of fast broadband and mobile networks and imposing fewer regulatory hurdles. The Bill will also strengthen the rights of consumers to easily switch suppliers and to receive compensation when their service fails.
Impact on data protection compliance
While data protection is not the main focus for the Bill, it is clear that a number of the proposed provisions could have a significant impact on data protection compliance obligations for businesses. Currently, the Information Commissioner can impose fines of up to £500,000 on companies, with its largest-ever fine to date being a £400,000 fine imposed in October 2016 on a well-known U.K. mobile network.
Enforcement has proved difficult
The problem for the Commissioner, as data privacy regulator, has been one of enforcement. According to her office, since April 2015, she has issued fines against companies for more than £2.7 million for nuisance calls, but a very significant proportion (£2.26 million) remains unpaid.
In her evidence to the Select Committee she said that this inability to recover fines was due, in part, to large numbers of such companies going into liquidation. Often these businesses would reopen with the same management, staff and premises in a new corporate entity. Making directors personally liable for such fines would be a means of preventing these avoidance measures.
How will personal liability be attached?
Are such fines insurable?
More generally, (and as previously blogged) the question of insurability of fines and penalties under English law remains a vexed one. Readers will recall this was an unsuccessful attempt by a company to recover damages from its directors in respect of a fine which had been levied on it as a result of alleged breaches of their duty of skill and care. The court ruled that, in this case, it was not permissible to claim indemnity but left open the possibility that certain categories of fines might be insurable.
Whether the government will legislate so as to criminalize the act of placing a company into insolvency—if it can be shown that this was done so as to allow the company to avoid the fine in the first place—remains to be seen. If that were to happen, I rather doubt that there would be any question of such fines or penalties being insurable given the level of deliberate intent implied in such conduct. It would still represent another headache and cause for concern for directors.
Using my crystal ball and knowing how keen The Government is on anti-avoidance measures in general I wouldn’t bet against it.
Read more: https://blog.willis.com/2017/01/making-directors-personally-liable-for-data-privacy-breaches/