The British Information Commissioner's Office said this week that companies are responsible for data protection. They can be punished for breaches, no matter where they occur and no matter how the information gets out. The ICO recently issued new, more strict guidelines, for protecting personal information under the Data Protection Act.

The ICO specifically protects information transferred beyond the boundaries of the United Kingdom and states that companies should make sure their contractors are handling data safely.