A recent fine imposed by the Information Commissioner on Scottish Borders Council demonstrates that employers can be liable for breach of data protection legislation by their contractors. All employers handling data about employees must comply with the Data Protection Act 1998 (the Act) and in particular, the eight data protection principles set out in that legislation. It is essential employers have streamlined and compliant arrangements in place to try to avoid incurring substantial fines due to the short comings of their outsourced service providers. As a minimum there should be a written agreement between their data controller and their data processor, which should contain warranties regarding compliance with the data protection principles and an indemnity for any breach of the Act to encourage best practice.
