Feeds

£250k fine for dumping council workers' files in Tesco bins, er, binned

But does this mean a change to ICO enforcement policy? Legal bod investigates

The essential guide to IT transformation

Comment I have just read the information tribunal decision and the reasons why the panel quashed the UK Information Commissioner’s £250,000 fine against the Scottish Borders council.

The local authority was punished after a worker dumped employees' private data in bins at a nearby Tesco and another unnamed supermarket.

It seems clear from the judgment that the tribunal thinks that the Information Commissioner's Office (ICO) should have served an enforcement notice - an order to change practices and end data leaks.

The tribunal has hinted that ICO should, even at this late stage, serve an enforcement notice and that Scottish Borders should accept it. The fact that the tribunal’s decision is designated to be “Preliminary Decision” means that the panel is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.

Unlike other commentators, I don’t think that the tribunal’s reasoning in its decision will result in much change to the ICO’s policy with respect of the use of enforcement or fines (monetary penalty notices) – except possibly he will take more care in deciding the appropriate enforcement mechanism.

In my view, the tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.

However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the Data Protection Act (DPA), then I think the outcome could have been different. I'll explain why below.

Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.

The Scottish Borders Tribunal (preliminary) decision

To understand the tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:

(1) There has been a serious contravention of a data protection principle (in this case the Seventh Principle*) and

(2) “The contravention was of a kind likely to cause substantial damage or substantial distress” and

(3) The data controller (in this case Scottish Borders):

“(a) knew or ought to have known —
(i)that there was a risk that the contravention would occur, and (ii)that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but

(b) failed to take reasonable steps to prevent the contravention”.

Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.

For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.

This disposal technique could have been used a number of times since 2008; it is not surprising that the tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.

That is why the tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the tribunal does not want Scottish Borders to escape “Scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).

The essential guide to IT transformation

More from The Register

next story
GCHQ protesters stick it to British spooks ... by drinking urine
Activists told NOT to snap pics of staff at the concrete doughnut
Britain's housing crisis: What are we going to do about it?
Rent control: Better than bombs at destroying housing
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
Redmond resists order to hand over overseas email
Court wanted peek as related to US investigation
What do you mean, I have to POST a PHYSICAL CHEQUE to get my gun licence?
Stop bitching about firearms fees - we need computerisation
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?