data protection fines

Summary

The requester asked the Isle of Man Cabinet Office for data on data protection breaches, fines, and related accounting strategies. The authority responded that it does not hold the requested information on fines and budgets, and that providing breach statistics would require creating new information, which is not required under the Freedom of Information Act.

Key Facts

• The Cabinet Office does not hold information regarding the scale of data protection fines or accounting strategies for such fines.
• The authority declined to provide statistics on data protection breaches because doing so would require creating or deriving information.
• The response directed the requester to the GDPR and LED Implementing Regulations 2018 for details on penalties.
• The response provided a link to the Isle of Man Information Commissioner's website for guidance on offences and sanctions.
• The request was formally closed on 4 October 2021.

Data Disclosed

• 1988914
• 2021-09-13
• 2021-10-04
• Regulations 112-117
• 2018

Exemptions Cited

• Information not held
• Requirement to create or derive information is not obliged under the Freedom of Information Act

Original Request

Please release information such as agenda discussion points, policies, procedures, reports, emails, filenotes, minutes, statistics, reviews, recommendations, etc related to (a) the estimated and/or actual scale of data protection breaches notified and/or not notified to the Information Commissioner (b) the estimated and/or actual scale of data protection fines by the Information Commissioner (c) the accounting strategy and any relevant budgets for any such fines.

Data Tables (2)

Full Response Text

Government Office Douglas Isle of Man IM1 3PN Telephone: (+44) 01624 686244 Website: www.gov.im/co

Our ref: 1988914 4 October 2021

Dear ###

We write further to your request which was received on 13 September 2021 and which states:

"Please release information such as agenda discussion points, policies, procedures, reports, emails, filenotes, minutes, statistics, reviews, recommendations, etc related to (a) the estimated and/or actual scale of data protection breaches notified and/or not notified to the Information Commissioner (b) the estimated and/or actual scale of data protection fines by the Information Commissioner (c) the accounting strategy and any relevant budgets for any such fines." Our response to your request is as follows: (a) the estimated and/or actual scale of data protection breaches notified and/or not notified to the Information Commissioner While our aim is to provide information whenever possible, in this instance, complying with your request for information would require the Cabinet Office to create or derive information from information that it holds. Under the Freedom of Information Act the Cabinet Office is not required to do this and so we are not obliged to comply with your request. However, to provide further advice and assistance you may find some useful information available online here: Regulations 112-117 of the GDPR and LED Implementing Regulations 2018 outline the applicable penalties under the Data Protection law: https://legislation.gov.im/cms/images/LEGISLATION/SUBORDINATE/2018/2018- 0145/GDPRandLEDImplementingRegulations2018_5.pdf The Isle of Man Information Commissioner's website offers further guidance on offences, sanctions and penalties. https://inforights.im/organisations/data-protection-law-2018/offences-sanctions-and- penalties/ (b) the estimated and/or actual scale of data protection fines by the Information Commissioner (c) the accounting strategy and any relevant budgets for any such fines."

While our aim is to provide information whenever possible, in this instance the Cabinet Office does not hold the information that you have requested in respect of b) and c) above.

Please quote the reference number 1988914 in any future communications.

Your right to request a review

If you are unhappy with this response to your freedom of information request, you may ask us to carry out an internal review of the response, by completing a complaint form and submitting it electronically or by delivery/post.

An electronic version of our complaint form can be found by going to our website at https://services.gov.im/freedom-of-information/Review . If you would like a paper version of our complaint form to be sent to you by post, please contact me and I will be happy to arrange for this. Your review request should explain why you are dissatisfied with this response, and should be made as soon as practicable. We will respond as soon as the review has been concluded. If you are not satisfied with the result of the review, you then have the right to appeal to the Information Commissioner for a decision on; 1. Whether we have responded to your request for information in accordance with Part 2 of the Freedom of Information Act 2015; or 2. Whether we are justified in refusing to give you the information requested.
In response to an application for review, the Information Commissioner may, at any time, attempt to resolve a matter by negotiation, conciliation, mediation or another form of alternative dispute resolution and will have regard to any outcome of this in making any subsequent decision. More detailed information on your right to a review can be found on the Information Commissioner’s website at www.inforights.im. Should you have any queries concerning this letter, please do not hesitate to contact me. Further information about freedom of information requests can be found at www.gov.im/foi. I will now close your request as of this date.

Yours sincerely