Company that failed to register with the ICO and ignored an Information Notice is prosecuted
Noble Design and Build of Telford, Shropshire, which operates CCTV systems in buildings across Sheffield, broke data protection laws by failing to let people know they were being recorded.
The company also failed to register with the Information Commissioner’s Office (ICO), which is a criminal offence.
On Monday 2 July 2018, the company was convicted in absence at Telford Magistrates’ Court. It was fined £2,000 for failing to comply with an Information Notice under section 47 of the Data Protection Act 1998.
It was also fined £2,500 for processing personal data electronically without having notified when required to do so, under Section 17 of the Data Protection Act 1998, and ordered to pay costs of £364.08 and a victim surcharge of £170.00,
On 4 September 2017, the ICO sent a letter to Noble Design and Build, raising concerns that it didn’t have the appropriate signage in place to alert people to the CCTV. It also notified the firm of its legal duty to register with the ICO.
The ICO sent out another letter on 11 October and a final email on 25 January 2018; both of which were ignored.
The ICO then sent an Information Notice, under section 43 of the Data Protection Act 1998, compelling the company to comply, but this was also ignored.
Head of Enforcement at the ICO, Steve Eckersley, said:
“Refusing to register with the ICO and ignoring an information notice are criminal acts – let it act as a stark warning to other companies who flout the law that we will take robust action.”
The company was prosecuted under the terms of the 1998 act because of when the offence took place. The new Data Protection Act 2018 came into force on 25 May. Organisations which process personal data still have a legal duty to register with the ICO unless they are exempt.
If you’re unsure whether you about whether you need to register you can take our self-assessment test here.
Notes to Editors
- The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- A limited number of civil and criminal enforcement cases – including this case – are still being dealt with under the provisions of the Data Protection Act 1998 because of the date the breach of the legislation occurred.
- Criminal prosecution penalties are set by the courts and not the ICO.
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.