Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what statutory requirements apply to the operation of the World Check database operated by Thomson Reuters Accelus; and if he will make a statement.

Organisations that process personal data in the UK must register with the Information Commissioner’s Office (ICO) and comply with the Data Protection Act’s (DPA) eight data protection principles. These include requiring personal data to be processed fairly and lawfully; to be accurate and up-to-date; not to be kept for longer than is necessary; and to be processed in accordance with the rights of the data subjects under the DPA. Failure to comply with the Act is an offence. Further information about these obligations can be found on the ICO’s website at:

https://ico.org.uk/for-organisations/guide-to-data-protection/

The Information Commissioner is the UK's independent authority responsible for administering and enforcing information rights, and provides guidance and advice to organisations on the Data Protection Act. The ICO has a number of tools at its disposal to take action against those that breach the legislation. These powers include the ability to conduct audits, serve enforcement notices and impose civil monetary penalties of up to £500,000.

Further information about the Information Commissioner can be found on the ICO’s website at:

www.ico.org.uk