I think it's going to be situational. This is not to be fanciful. If somebody's shoe size was revealed to another customer passing by, that is obviously resolvable in the circumstance.
The kinds of harms that are specified are quite varied, everywhere from humiliation to bodily harm to significant financial harm, so I don't know that there is a single answer. Obviously there is a thin skull plaintiff issue here, but where it is something a reasonable person would say there's a risk of significant harm, I think you're frankly into the full reporting regime with a formal report to the individual and a report to the PCO.
In areas that are perhaps a bit more subjective, then if it's possible to get consent for one thing, I suppose it's possible at the same kind of standard to get somebody to indicate they are comfortable there has not been a problem. Now bear in mind there has then been a breach, if you like, so you would still have to record it so that if the person came back later and said, “Well, actually, upon reflection, I'm not happy about it”, at least there would have been a record created.
We are trying to envisage something of a halfway house. This wouldn't preclude that. There is nothing in here that would preclude some informal resolution because if it didn't hit the reasonable risk of significant harm test, then there can still be notice and informal resolution below that level, and could conceivably be worked out between the customer and the retailer, recorded by the retailer as a matter of course under proposed section 10.3.
You'll also bear in mind there are circumstances that we would envisage where something wouldn't even reach the 10.3 level where it's such a technical breach that it doesn't hit the standard in the other sections. We almost envisage three scenarios, one in which it hasn't really offended, although technically there had been a breach of security protocols; one where it might be resolved informally, and should nevertheless be recorded; and then a kind of third level where you actually hit that test on a reasonable belief basis and you are then duty-bound to report both to the individual and to the PCO.