Misuse and Penalties

Misuse of personal data is when information about people is handled in a way that breaks the Data Protection Act 2018. It is not only about stealing data; careless or deliberate actions that go beyond what the person was told would happen count too.

Misuse includes:

• Unauthorised access: looking at personal data when you do not have permission to see it.
• Changing or deleting data without permission, so records become wrong or disappear.
• Using data for an unagreed purpose: for example, a swimming club collects members' phone numbers for emergency contact but uses them to send marketing messages.
• Sharing data inappropriately: for example, emailing a list of members' home addresses to a local business without asking them first.

For example, a volunteer at a charity shop opens a donor's record on the till system even though their role is only to sort donations. They had no permission to look, so it is misuse even though they changed nothing and told nobody.

Penalties

An organisation that breaches data protection law can be given a warning, be ordered to comply by changing how it handles personal data, or be fined. Fines are the most serious penalty and are used for the worst breaches, such as losing a database of customer records or using data for a purpose the person never agreed to. A warning or an order still matters: it forces the organisation to put things right, and the publicity can damage the trust people place in it.