"It's one of the ICO's few tools in these circumstances"
It really ought to have been considered at the time the DPA was drawn up. Fines are inappropriate for a public body. There seems to be an assumption that public bodies wouldn't breach the provisions. We now realise that they're one of the categories of data managers who present most problems. In the absence of any other more appropriate provision there needs to be a mandatory requirement for personal responsibility.
But I still can't get my head round the notion that this was supposed to have been carried out in accordance with the force's procedures. Are the procedures really so stupid as to mandate this or are they so vague that anything would be in accordance?
Biting the hand that feeds IT
