Feeds

£250k fine for dumping council workers' files in Tesco bins, er, binned

But does this mean a change to ICO enforcement policy? Legal bod investigates

The Power of One Infographic

Comment I have just read the information tribunal decision and the reasons why the panel quashed the UK Information Commissioner’s £250,000 fine against the Scottish Borders council.

The local authority was punished after a worker dumped employees' private data in bins at a nearby Tesco and another unnamed supermarket.

It seems clear from the judgment that the tribunal thinks that the Information Commissioner's Office (ICO) should have served an enforcement notice - an order to change practices and end data leaks.

The tribunal has hinted that ICO should, even at this late stage, serve an enforcement notice and that Scottish Borders should accept it. The fact that the tribunal’s decision is designated to be “Preliminary Decision” means that the panel is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.

Unlike other commentators, I don’t think that the tribunal’s reasoning in its decision will result in much change to the ICO’s policy with respect of the use of enforcement or fines (monetary penalty notices) – except possibly he will take more care in deciding the appropriate enforcement mechanism.

In my view, the tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.

However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the Data Protection Act (DPA), then I think the outcome could have been different. I'll explain why below.

Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.

The Scottish Borders Tribunal (preliminary) decision

To understand the tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:

(1) There has been a serious contravention of a data protection principle (in this case the Seventh Principle*) and

(2) “The contravention was of a kind likely to cause substantial damage or substantial distress” and

(3) The data controller (in this case Scottish Borders):

“(a) knew or ought to have known —
(i)that there was a risk that the contravention would occur, and (ii)that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but

(b) failed to take reasonable steps to prevent the contravention”.

Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.

For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.

This disposal technique could have been used a number of times since 2008; it is not surprising that the tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.

That is why the tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the tribunal does not want Scottish Borders to escape “Scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).

Boost IT visibility and business value

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.