ABOUT THIS EPISODE
Just yesterday, the ICO announced a £200,000 settlement with DSG Retail, finally bringing an end to nearly seven years of legal wrangling over a massive 2017 cyberattack that compromised more than 5.6 million payment cards.
But beyond the shrinking fine, this case resolved a fascinating legal debate about the "relativity" of personal data: If a hacker steals your customers' information but lacks the means to actually identify who it belongs to, does your statutory duty to protect that data still apply?
In this episode, Robert Bateman breaks down the procedural marathon of DSG Retail v ICO, the critical software patch that was left half-finished, and why the UK Court of Appeal drew directly on the CJEU's landmark EDPS v SRB judgment to determine the scope of a controller's security duties.
In this episode, we cover:
The Timeline of a Breach: How the 2017-2018 attack on Currys PC World and Dixons Travel led to a maximum £500,000 penalty under the DPA 1998, and its eventual reduction to £200,000.
The Unfinished Patch: Why outsourcing your IT security doesn't outsource your liability, and the devastating consequences of failing to complete step two of a critical 2014 Microsoft software patch.
The "Relativity" of Personal Data: DSG's argument that the stolen card numbers weren't personal data to the hackers—and why the Upper Tribunal initially agreed.
The Court of Appeal's Reversal: Lord Justice Warby’s reasoning on why a controller cannot escape its security duties just because an attacker can't identify the victims. (Hackers don't need to know who you are to maliciously encrypt or delete your records!)
The EDPS v SRB Connection: How the CJEU's ruling on the Single Resolution Board and pseudonymised data directly shaped the UK Court of Appeal's approach to controller obligations.
Practical Takeaways: Why privacy professionals must remember that security extends beyond confidentiality. Pseudonymisation and encryption are great, but neither stops an attacker from deleting your data.
