Feeds

£250k fine for dumping council workers' files in Tesco bins, er, binned

But does this mean a change to ICO enforcement policy? Legal bod investigates

Beginner's guide to SSL certificates

Comment I have just read the information tribunal decision and the reasons why the panel quashed the UK Information Commissioner’s £250,000 fine against the Scottish Borders council.

The local authority was punished after a worker dumped employees' private data in bins at a nearby Tesco and another unnamed supermarket.

It seems clear from the judgment that the tribunal thinks that the Information Commissioner's Office (ICO) should have served an enforcement notice - an order to change practices and end data leaks.

The tribunal has hinted that ICO should, even at this late stage, serve an enforcement notice and that Scottish Borders should accept it. The fact that the tribunal’s decision is designated to be “Preliminary Decision” means that the panel is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.

Unlike other commentators, I don’t think that the tribunal’s reasoning in its decision will result in much change to the ICO’s policy with respect of the use of enforcement or fines (monetary penalty notices) – except possibly he will take more care in deciding the appropriate enforcement mechanism.

In my view, the tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.

However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the Data Protection Act (DPA), then I think the outcome could have been different. I'll explain why below.

Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.

The Scottish Borders Tribunal (preliminary) decision

To understand the tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:

(1) There has been a serious contravention of a data protection principle (in this case the Seventh Principle*) and

(2) “The contravention was of a kind likely to cause substantial damage or substantial distress” and

(3) The data controller (in this case Scottish Borders):

“(a) knew or ought to have known —
(i)that there was a risk that the contravention would occur, and (ii)that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but

(b) failed to take reasonable steps to prevent the contravention”.

Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.

For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.

This disposal technique could have been used a number of times since 2008; it is not surprising that the tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.

That is why the tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the tribunal does not want Scottish Borders to escape “Scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Why Oracle CEO Larry Ellison had to go ... Except he hasn't
Silicon Valley's veteran seadog in piratical Putin impression
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.