Liverpool City Council prosecuted for data protection offences
In the first prosecution brought by the Information Commissioner for failure to
comply with an information notice, Liverpool City Council has today pleaded
guilty to the offence and agreed to the Information Commissioner’s Office
auditing the authority’s data protection procedures. The council was fined
£300 and no application for costs was made. In his summing up, the District
Judge at Liverpool Magistrates’ Court said the council had shown an
‘appalling breakdown of communication’ and ‘a clear lack of compliance’ with
the Data Protection Act 1998.
Using the Data Protection Act a former employee of Liverpool City Council
made a ‘subject access request’ for personal information held on her by the
authority. Following the request, Liverpool City Council provided some
information to the woman. However she felt that some sensitive information
relating to her health was missing from the material provided. As a result of
this she made a complaint to the Information Commissioner’s Office (ICO).
ICO commenced an investigation and tried to contact Liverpool City Council
on several occasions by letter and telephone. The council did not respond. As
the council had failed to respond to a preliminary information notice in another
matter that was running alongside this case, ICO issued an information notice
in respect of both matters to the chief executive of Liverpool City Council by
recorded delivery on 15 June 2006. The notice required the council to
respond to ICO by 20 July 2006. No response of any kind was received from
the council.
Under section 47 of the Data Protection Act it is a criminal offence to fail to
comply with an information notice. ICO wrote to the chief executive of the
council again on 22 August 2006 affording the public body 14 days to make
representations on circumstances which might make a prosecution
inappropriate. ICO did not receive a response and therefore was left with no
alternative but to commence proceedings through the courts.
Mick Gorrill, Head of the Regulatory Action Division at the Information
Commissioner’s Office, said: “The Data Protection Act gives us all important
rights, including the opportunity to find out what information is held on us by
an organisation. This right is the very cornerstone of the Act and that is why
the legislation is so important. Today’s successful prosecution serves as a
very useful reminder to organisations that they must comply with subject
access requests appropriately and that it is a criminal offence to ignore
information notices served by the Information Commissioner.” |
