Can I be prosecuted for misplacing data...?

[abbierhodes]

...even if I've never signed the data protection act?

In my job I handle personal information on a number of people. I have been told today that if this gets into the wrong hands through my carelessness, I can be prosecuted.

However, I've never been asked to sign anything to this effect. I had a job in the past where data was an issue, and I signed something from the data protection act accepting liability for data.

This job is completely different in nature, and I'm not sure they're correct in what they're saying.

Morally and ethically, I am of course discreet with other people's data, but I think my employers are scaremongering.

Does anyone know?

You don't usually have to sign anything regarding the DPA. However a 'data controller', ie an employer, can indeed be prosecuted for not handling data correctly. The question would be are you the data compliance officer for your organisation - probably not or you'd know about it! So as long as you follow the procedures you've been told to you should be OK.

www.out-law.com/page-413 might help.

Thanks notcitrus, that's really helpful. I'm not the data controller!

I wouldn't normally object to being reminded to be careful with data, and certainly would like to be better trained on data handling laws...but I'm annoyed at the way this was handled today!

You should be fine then unless you're incredibly reckless. (I'm not a lawyer, disclaimer etc etc) Hypothetically you could be prosecuted for being careless with data (eg leaving your work laptop in the pub) but in reality it's more written-warning type reaction.

Regardless of your status at work it depends on the nature of the data you handle.