| Breach of act |
Failure to take appropriate technical and organisational measures against unauthorised processing of personal data, in particular a failure to train employees appropriately and provide a secure means of sending email. |
| Known or should have known |
Staff were used to handling confidential and sensitive personal data and the danger of sending unencrypted email, which the data controller was aware was occuring, should have been self evident. |
| Likely to cause damage or distress |
Data was confidential and highly sensitive and related to an ongoing legal case. |
