Feeds

£250k fine for dumping council workers' files in Tesco bins, er, binned

But does this mean a change to ICO enforcement policy? Legal bod investigates

Top 5 reasons to deploy VMware with Tegile

Comment I have just read the information tribunal decision and the reasons why the panel quashed the UK Information Commissioner’s £250,000 fine against the Scottish Borders council.

The local authority was punished after a worker dumped employees' private data in bins at a nearby Tesco and another unnamed supermarket.

It seems clear from the judgment that the tribunal thinks that the Information Commissioner's Office (ICO) should have served an enforcement notice - an order to change practices and end data leaks.

The tribunal has hinted that ICO should, even at this late stage, serve an enforcement notice and that Scottish Borders should accept it. The fact that the tribunal’s decision is designated to be “Preliminary Decision” means that the panel is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.

Unlike other commentators, I don’t think that the tribunal’s reasoning in its decision will result in much change to the ICO’s policy with respect of the use of enforcement or fines (monetary penalty notices) – except possibly he will take more care in deciding the appropriate enforcement mechanism.

In my view, the tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.

However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the Data Protection Act (DPA), then I think the outcome could have been different. I'll explain why below.

Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.

The Scottish Borders Tribunal (preliminary) decision

To understand the tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:

(1) There has been a serious contravention of a data protection principle (in this case the Seventh Principle*) and

(2) “The contravention was of a kind likely to cause substantial damage or substantial distress” and

(3) The data controller (in this case Scottish Borders):

“(a) knew or ought to have known —
(i)that there was a risk that the contravention would occur, and (ii)that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but

(b) failed to take reasonable steps to prevent the contravention”.

Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.

For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.

This disposal technique could have been used a number of times since 2008; it is not surprising that the tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.

That is why the tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the tribunal does not want Scottish Borders to escape “Scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).

Beginner's guide to SSL certificates

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
In the next four weeks, 100 people will decide the future of the web
While America tucks into Thanksgiving turkey, the world will be taking over the net
Microsoft EU warns: If you have ties to the US, Feds can get your data
European corps can't afford to get complacent while American Big Biz battles Uncle Sam
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.