I have an article on the recent Scottish Borders Council monetary penalty notice appeal in the latest edition of the Society for Computers and the Law’s bi-monthly magazine. The article is an expanded version of my original blog post on the decision.
In summary, the Tribunal upheld the Council’s appeal against a £250,000 fine issued against it following data protection failures relating to the outsourcing of pensions records digitisation. The appeal was upheld notwithstanding that paper pension records were found to have been disposed of by the contractor in public recycling bins, and no checks or auditing had been carried out by the Council on the contractor. Whilst agreeing that the Council had committed serious breaches of its obligations under the Data Protection Act, the Tribunal took a very narrow interpretation of the test for issuing fines, which requires there to be a likelihood of a data subject suffering serious damage or serious distress.
The article considers the ICO’s original decision notice, the Tribunal’s reasoning, and its potential impact on the effectiveness of the monetary penalty regime going forward. It can be accessed for free on the SCL website for the next week or so.
On October 11, 2013