...as information on policyholders who had since died or moved address. A full investigation was carried out by the datacontroller. Subsequently an independent company reviewed data security arrangements at the company and found a lack of detailed...
http://www.finextra.com/fullpr.asp?id=28530
...likely to cause substantial damage or substantial distress and either: the contravention was deliberate; or the datacontroller knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention...
http://www.out-law.com//default.aspx?page=10517