Data protection: where are the fines?

Regular readers of this blog (thank you!) will know that we consider the Information Commissioner’s lack of enforcement and regulatory powers to be a serious deficiency in the UK’s data protection and privacy law.

To emphasise the point yet again, the Information Commissioner has published details of the enforcement notices issued against 14 construction companies arising out of the misuse of personal data collected and sold by Ian Kerr trading as the Consulting Association. There are some big names listed in the Information Commissioner’s press release. The enforcement notices demand that the construction companies stop using Ian Kerr personal data, and comply with certain obligations that they already had under the Data Protection Act 1998.

Despite these serious breaches, there are no fines or compensation orders, as the Information Commissioner does not have the power to award fines or make orders. Have the construction companies got away with their blatant breach of the Data Protection Act 1998? Perhaps, but at least the enforcement notices contain an interesting final warning. In setting out in the notices that the construction companies must comply with certain data protection obligations, the Information Commissioner has ensured that any further breach of these obligations would also be a breach of the relevant enforcement notice.

Breach of an enforcement notice is a criminal offence. In addition, where that offence “has been committed by a body corporate and is proved to have been committed with the consent or connivance of or to be attributable to any neglect on the part of any director, manager, secretary or similar officer of the body corporate or any person who was purporting to act in any such capacity, he as well as the body corporate shall be guilty of that offence and be liable to be proceeded against and punished accordingly” (section 61(1) of the Data Protection Act 1998).

The officers of the 14 construction companies subject to these Ian Kerr enforcement notices ought to bear this in mind.

PCC against Facebook journalism

There is increasing guidance being given by bodies such as the Information Commissioner about the dangers of posting photographs to social networking sites. Clearly, posting photographs risks having those photographs put into the public domain eventually.

However, the Press Complaints Commission has laid a marker down that it does not consider the use of social networking photographs to be justified where this requires the press to circumvent privacy settings, unless there is a public interest justification. To do so would be a breach of Clause 3 (Privacy) of the Editors’ Code of Practice.

This is the result of the PCC upholding a complaint against the Scottish Sunday Express by parents of survivors of the Dunblane shooting in 1996. The Scottish Sunday Express had published photographs and other material about the children to claim that their normal teenage behaviour “shamed” the memory of the deceased.

The only negative aspect to this story is that as the PCC is a self-regulatory body which has been given limited powers by the newspapers it governs, the only result of having a complaint upheld is that the relevant newspaper has to publish in a prominent manner a report of the PCC adjudication. The PCC has no fining powers or the ability to award compensation.

"Mental" is a colloquialism too far

We recently came across a ruling of the Advertising Standard Authority, which seems to make the use of colloquialisms in advertising more difficult.

The ruling concerned the use of the word “mental” in a radio advert by Bognor Motors Ltd: “if you don’t go to Bognor Motors, you must be mental”.  This was ruled to be in breach of BCAP Radio Advertising Code rule concerning good taste, decency and office to public feeling: section 2 rule 9.

The key is the possibility that the colloquialism is a pejorative term which could cause serious offence to some listeners.

This is also a reminder that there are a number of codes of practice on advertising.