This is the html version of the file http://www.ico.gov.uk/upload/documents/library/data_protection/notices/virgin_media_undertaking_redacted.pdf. G o o g l e automatically generates html versions of documents as we crawl the web. Google is not affiliated with the authors of this page nor responsible for its content. These search terms have been highlighted:  virgin  media

---

Page 1

DATA PROTECTION ACT 1998

UNDERTAKING

Data Controller:

Virgin Media Limited

160 Great Portland Street

London

W1W 5QA

I, (NAME REMOVED), (JOB TITLE REMOVED) of Virgin Media Limited (“Virgin

Media”), 160 Great Portland Street, London W1W 5QA for and on behalf of Virgin

Media hereby acknowledge the details set out below and undertake to comply with the

terms of the following undertaking:

1. Virgin Media (“Virgin Media”), is the data controller as defined in section 1(1) of

the Data Protection Act 1998 (the “Act”), in respect of the processing of

personal data carried out by Virgin Media and is referred to in this Undertaking

as the “data controller”. Section 4(4) of the Act provides that, subject to section

27(1) of the Act, it is the duty of a data controller to comply with the data

protection principles in relation to all personal data in respect of which it is a

data controller.

2. The Information Commissioner (the “Commissioner”) was provided with a

report from (NAME REMOVED), (JOB TITLE REMOVED) acting on behalf of

the data controller, regarding the loss of a compact disc that was passed to

them by Carphone Warehouse (the "data processor"). The data processor had

been engaged to collect the personal data of individuals interested in opening a

Virgin Media account within its Carphone Warehouse stores. The compact disc

contained the personal data of 3,383 customers and was not encrypted.

3. The Commissioner has considered the data controller’s compliance with the

provisions of the Act in the light of this matter. The relevant provision of the Act

is the Seventh Data Protection Principle. This Principle is set out in Schedule 1

Part 1 of the Act.

4. Following consideration of the remedial action that has been taken by the data

controller and the fact that the data controller recognises the seriousness of the

matter, it is agreed that in consideration of the Commissioner not exercising his

powers to serve an Enforcement Notice under section 40 of the Act, the data

controller undertakes as follows:-

---

Page 2

The data controller shall, as from the date of this undertaking and for so long as

similar standards are required by the Act or other successor legislation or from

other data controllers in similar circumstances, ensure that personal data are

processed in accordance with the Seventh Data Protection Principle in

Schedule 1 Part 1 of the Act, and in particular that:

(1) Portable and mobile devices including magnetic media used to store and

transmit personal data, the loss of which could cause damage or distress

to individuals, are encrypted using encryption software which meets the

current standard or equivalent;

(2) Any contract between the data controller and a data processor shall

specifically require that portable and mobile devices including magnetic

media used to store and transmit personal data, the loss of which could

cause damage or distress to individuals, are encrypted using encryption

software which meets the current standard or equivalent;

(3) The data controller shall implement such other security measures it

deems appropriate to ensure that personal data is protected against

unauthorised and unlawful process, accidental loss, destruction, and/or

damage.

Dated……………………………………………….

Signed………………………………………………

(NAME REMOVED)

(JOB TITLE REMOVED)

For and on behalf of Virgin Media Limited

Signed………………………………………………

Mick Gorrill

Assistant Commissioner Regulatory Action Division

For and on behalf of the Information Commissioner