In Short
-
UK employers have a legal duty to protect employees’ eye health as part of their health and safety obligations.
-
Employees who use screens regularly or drive for work can request employer-funded eye tests.
-
Employers may also need to pay for basic corrective glasses where DSE work requires them.
Tips for Businesses
Identify which roles involve regular screen use or driving and record this in risk assessments. Put a simple process in place for employees to request eye tests and keep clear records of what you provide. Review DSE assessments regularly, train staff on eye strain prevention, and be alert to when eye conditions may trigger disability-related duties.
Summary
This article explains employers’ legal responsibilities for employee eye health under UK health and safety law, aimed at UK business owners and employers. Prepared by LegalVision, a commercial law firm specialising in advising clients on employment law and workplace health and safety, it outlines eye test obligations, glasses requirements, and related disability considerations.
All organisations face the risk of personal data breaches. High-profile breaches in the UK policing sector show that even organisations with critical public roles can fall short in meeting data protection requirements.
Various police data breach incidents have attracted significant media attention and caused considerable concern. For all organisations processing personal data, these cases highlight the crucial need to proactively work on and strengthen compliance with data protection law to ensure incident readiness and measures to help prevent breaches from occurring.
This article explores:
- the concept of personal data breaches;
- key legal data protection obligations arising from them; and
- important learnings from police data breaches that your organisation can seek to apply to help reduce risk in respect of data breaches.
This factsheet outlines the steps for notifying the ICO and affected individuals about personal data breaches.
What Counts as a Personal Data Breach?
UK data protection law defines a personal data breach as a security incident that causes:
- accidental or unlawful destruction;
- loss;
- alteration; or
- unauthorised disclosure or access to personal data.
Personal data breaches can arise from malicious cyber incidents or everyday staff mistakes. If a personal data breach occurs, your organisation must quickly assess whether the incident triggers legal notification obligations.
Data Controller
If your organisation acts as a data controller, it means you decide the purposes and means of processing personal data. Where a breach creates a likely risk to individuals’ rights and freedoms, you must notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware. If there is a high risk to affected individuals, you must also inform them without undue delay.
Data Processor
If your organisation acts as a data processor, you must alert the relevant controller without undue delay once you become aware of a breach. Your contractual obligations under your processing agreement may impose stricter, specific timeframes, so your organisation must maintain internal procedures to support such reporting.
Developing Breach Response and Governance Processes
Organisations must take a structured and proactive approach to handling data breaches. Your organisation should develop and maintain a documented incident response plan that clearly defines:
- roles;
- escalation channels; and
- decision-making authority.
You should test this framework regularly and train staff to ensure operational effectiveness in the event of a data breach. Senior management must oversee your data breach plan and ensure it is effective.
Continue reading this article below the formReputational and Regulatory Consequences of Police Data Breaches
Police data breaches have illustrated the consequences of what can go wrong for organisations. In one significant and highly reported incident, a spreadsheet was released which disclosed the surnames, initials, ranks, and roles of officers and staff, as part of a Freedom of Information response. The ICO imposed a £750,000 penalty fine and confirmed that if public sector discretion had not applied, the fine would have been £5.6 million. The ICO stated that the breach could have been prevented by using basic safeguards and stressed that the incident had left many individuals fearing for their safety. The key issues and failings were around failing to implement adequate security measures.
This incident shows both the regulatory consequences and the reputational impact of serious, high-profile data breaches and failing to protect personal information appropriately. The breach:
- generated widespread media coverage;
- raised concerns; and
- highlighted the operational risks of poor data handling.
It demonstrates that reputational harm can emerge immediately and persist long after the event, even when the breach occurs unintentionally.
Wider Lessons from Police Data Breaches
Following audits of eleven police forces, the ICO published an outcome report on Personal Data Breach Management and Reporting of Police Forces in England and Wales. The report’s key themes reflect broad compliance expectations. These findings show where organisations often get things wrong and what they can learn from it.
Police data breach incidents highlight several practical lessons. Organisations can reduce risk by taking the following steps, some of which reflect the ICO’s key findings.
Continuously Strengthen Your Data Governance Framework
Remember to clearly define:
- roles;
- responsibilities; and
- breach escalation routes.
Improve the Consistency of Your Breach Procedures
You should improve the consistency of your breach procedures and ensure compliance with the latest regulatory guidance. Remember to ensure you have robust processes for:
- breach detection;
- assessment; and
- reporting.
Keep Breach Records
You should keep complete records and document all breaches and risk assessments, including any decisions not to report, to help demonstrate your accountability.
When you work with third-party processors as a controller, ensure they can report breaches to you promptly so you can fulfil your obligations.
Focus on Training
Training should be regular and role-specific, so staff truly understand their obligations to identify and escalate breaches, and to help prevent them.
As well as the legal risks that can arise from data breaches, you should also remember the severe damage that your reputation can suffer from as a result of a data breach. Data breaches can undermine public confidence and trust. Therefore, it is important to take steps to minimise the risk of personal data breaches.
Key Takeaways
Police data breaches have highlighted serious regulatory and reputational risks that can quickly arise where organisations fall short of their data protection obligations. The ICO’s findings offer clear guidance on strengthening compliance. The high-profile police data breach cases are an important reminder of the need to handle data breaches correctly and to take steps to mitigate their risk in the first place. Your organisation should:
- review its controller or processor responsibilities;
- ensure breach procedures are operational and documented;
- keep precise breach records; and
- establish robust data breach governance processes.
These proactive measures will help you mitigate regulatory risk and safeguard your organisation’s reputation, as data breaches can result in lasting negative publicity and critical scrutiny.
egalVision provides ongoing legal support for businesses through its fixed-fee legal membership. Our lawyers help businesses in the recruitment industry manage contracts, employment law, disputes, intellectual property, and more. Members receive unlimited access to specialist lawyers for a fixed monthly fee. To learn more, call 0808 196 8584 or visit our membership page.
Frequently Asked Questions
Only breaches likely to result in a risk to individuals must be reported. However, your organisation must record all breaches internally, both for compliance and future learning.
Reputational damage can often arise when the public believes an organisation did not respond effectively or transparently to the incident. This can occur and have lasting damage, regardless of any penalty imposed.
We appreciate your feedback – your submission has been successfully received.
