Has the ICO finally found its teeth with £150,000 fine?

 

Gallery

By Nicole Kobie

Posted on 5 Jul 2012 at 14:17

A loans firm has been fined £150,000 by the Information Commissioner's Office - one of very few private companies to be targeted by the data watchdog, despite a significant increase in the number of penalties doled out.

The £150,000 fine against Welcome Financial Services for losing a pair of backup disks is the only the third instance of a private organisation being fined since the ICO was given the power in 2010.

The previous two fines against non-public bodies were a £1,000 penalty against an individual - Andrew Crossley of ACS Law - and £60,000 in 2010 against government-funded employment body A4E.

The fine comes as the ICO has significantly increased the number of financial penalties it hands out. The ICO has already issued almost twice as many fines so far in 2012 as in all of 2011.

Over the past year, the ICO has bared its teeth and has taken effective action to punish organisations

In the first six months of 2012, the data watchdog has issued 12 fines. In all of 2011, it issued seven. The ICO said that may partly because it wouldn't have been able to take action on any breaches that happened before April 2010. "This would have discounted some of the breaches reported to our office in 2011," a spokesman said.

The size of the fines has also increased. In 2011, the total value of fines was £541,000, an average of £90,000, not including Crossley's £1,000 fine, which was an anomaly. In the first half of 2012, the ICO has already hit £1,490,000 - an average of £124,166 per fine.

The leap in number and size of the fines is despite the number of breaches of the data protection act staying flat from one annual report to the next - although the ICO's reporting year runs to the end of March, not by calendar year. "Each case is looked at on a case-by-case basis and we will consider issuing a monetary penalty where the criteria are met," the ICO said.

Cases that have attracted fines have ranged from sensitive documents faxed to the wrong number to the half a million loan customer details leaked by Welcome Financial Services.

"Over the past year, the ICO has bared its teeth and has taken effective action to punish organisations, many of which have shown a cavalier attitude to looking after people's personal information," said Information Commissioner Christopher Graham. "It's a case of wake up and smell the CMP [civil monetary penalty]," he added.

Unwelcome fine

Welcome Financial Services was given the ground-breaking fine after its Shopacheck loan business lost a pair of backup tapes holding names, addresses and phone numbers of customers in November. The tapes have yet to be found.

While the Shopacheck website continues to operate, Welcome Financial Services stopped offering loans in 2009. It defaulted in 2011, declaring it couldn't offer PPI refunds, which are now being paid by the Financial Services Compensation Scheme.

Despite the financial difficulties, the ICO said it wouldn't have any trouble collecting the fine. “We are aware of Welcome Financial Services Limited’s current financial situation and are satisfied that the company has the ability to pay the penalty amount, without impacting on their outstanding financial commitments,” an ICO spokesman said.

The ICO has executed search warrants at a number of sites across the UK linked to companies we believe are breaking the law

The ICO infamously cut Crossley's fine from £200,000 to £1,000 after the solicitor declared he was unable to pay the larger amount, and takes into consideration an organisation's ability to pay when coming up with the penalty amount.

Emarketing complaints

While the number of complaints about data protection issues were the same year on year, the watchdog reported a 43% jump in the number of complaints about unsolicited marketing calls and text messages, with more than 12,000 received over the past 12 months.

The ICO was handed the ability to issue £500,000 fines last year to battle marketing calls and SMS spam, but has yet to dole out a penalty.

The watchdog has set up a dedicated team to target the issue, and is "working to identify the operators responsible," it said. "The ICO has executed search warrants at a number of sites across the UK linked to companies we believe are breaking the law."