Feeds

Orange and Littlewoods breach Data Protection Act, says ICO

Not keeping customer information secure

High performance access to file storage

Mobile operator Orange has breached the Data Protection Act's security requirements and home shopping giant Littlewoods has breached the Act's marketing rules, the Information Commissioner's Office (ICO) has ruled.

Today's announcement indicates that the commissioner is increasing his leverage against data controllers, according to one data protection expert.

The case against Orange Personal Communications Services followed a complaint about the way in which Orange processed personal information, in particular the way in which new members of staff were allowed to share usernames and passwords when accessing the company IT system.

Following its investigation, the ICO found that Orange was not keeping its customers' personal information secure and therefore was in breach of the Data Protection Act.

In a separate investigation the ICO ruled that Littlewoods Home Shopping had failed to process customers' data in line with the Data Protection Act. This follows a customer's attempt to stop the company using her personal data for direct marketing purposes. Despite her requests Littlewoods continued to send her marketing materials.

The ICO has now required each company to sign a formal undertaking to comply with the Principles of the Data Protection Act.

In addition to a general promise to comply, Orange's undertaking states: "The sharing of user names and passwords by Customer Service Representatives, to access computer systems, shall not be allowed under any circumstances."

Again, in addition to a general promise, Littlewoods' undertaking states that the company will ensure that the personal details of the individual "are suppressed from all company databases thereby ensuring that she will not receive any future marketing material from the data controller."

Failure to meet the conditions of the undertaking is likely to lead to further enforcement action by the ICO and could result in prosecution by the Office.

Mick Gorrill, Head of Regulatory Action at the ICO, said: "Organisations that process individuals' personal information must do so in compliance with the Data Protection Act. If they do not, they not only risk further action from the Information Commissioner but also risk losing the trust of their customers. Individuals must feel confident that organisations are safeguarding their personal information."

Last month the Information Commissioner called for stronger powers to allow his office to carry out inspections and audits to ensure organisations are complying with the Data Protection Act. Currently, the Commissioner must gain consent before inspecting an organisation for compliance.

Dr Chris Pounder of Pinsent Masons, and Editor of Data Protection and Privacy Practice, said: "This action is evidence that the Information Commissioner is using undertakings as a way of increasing his leverage against data controllers. Where an assessment by him concludes that a data controller has failed in a key obligation under the Act, then the Commissioner is asking for an undertaking that 'it won't happen again'. This ensures that if something were to happen again, the Commissioner can proceed to immediately to enforcement. It is only when there is a further failure will criminal prosecution occur."

"In other words, the Information Commissioner is trying to establish the data protection equivalent of the 'three strikes and you're out' rule," he said.

Copyright © 2007, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Combat fraud and increase customer satisfaction

More from The Register

next story
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
Reprieve for Weev: Court disowns AT&T hacker's conviction
Appeals court strikes down landmark sentence
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.