The SECURITY DUTY in the 7th Data Protection Principle in DPA 1998 requires a DATA CONTROLLER to GUARD AGAINST THE RISK that data which relates to individuals who could be identified by the data controller would be subject to unauthorised/unlawful processing by a third party who could not identify those individuals. So held in INFORMATION COMMISSSIONER v DSG RETAIL LTD ( “)”^ ) EWCA Civ 140.