£250k fine for dumping council workers' files in Tesco bins, er, binned
But does this mean a change to ICO enforcement policy? Legal bod investigates
5 ways to reduce advertising network latency
Comment I have just read the information tribunal decision and the reasons why the panel quashed the UK Information Commissioner’s £250,000 fine against the Scottish Borders council.
The local authority was punished after a worker dumped employees' private data in bins at a nearby Tesco and another unnamed supermarket.
It seems clear from the judgment that the tribunal thinks that the Information Commissioner's Office (ICO) should have served an enforcement notice - an order to change practices and end data leaks.
The tribunal has hinted that ICO should, even at this late stage, serve an enforcement notice and that Scottish Borders should accept it. The fact that the tribunal’s decision is designated to be “Preliminary Decision” means that the panel is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.
Unlike other commentators, I don’t think that the tribunal’s reasoning in its decision will result in much change to the ICO’s policy with respect of the use of enforcement or fines (monetary penalty notices) – except possibly he will take more care in deciding the appropriate enforcement mechanism.
In my view, the tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.
However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the Data Protection Act (DPA), then I think the outcome could have been different. I'll explain why below.
Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.
The Scottish Borders Tribunal (preliminary) decision
To understand the tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:
(2) “The contravention was of a kind likely to cause substantial damage or substantial distress” and
(3) The data controller (in this case Scottish Borders):
(b) failed to take reasonable steps to prevent the contravention”.
Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.
For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.
This disposal technique could have been used a number of times since 2008; it is not surprising that the tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.
That is why the tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the tribunal does not want Scottish Borders to escape “Scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).
