WIREDGOV

Noble Design and Build of Telford, Shropshire, which operates CCTV systems in buildings across Sheffield, broke data protection laws by failing to comply with an Information Notice.

The company also failed to register with the Information Commissioner’s Office (ICO), despite it being a criminal offence to do so.

On Monday 2 July 2018, the company was convicted at Telford Magistrates’ Court, in their absence. They were fined £2000 for failing to comply with an Information Notice, under section 47 of the Data Protection Act 1998.

They were also fined £2500 for processing personal data electronically without having notified when required to do so, under Section 17 of the Data Protection Act 1998, and ordered to pay costs of £364.08 and a victim surcharge of £170.00,

On 4 September 2017, the ICO sent a letter to Noble Design and Build, raising concerns that it didn’t have the appropriate signage in place to alert people to the CCTV. It also notified the firm of its legal duty to register with the ICO.

The ICO sent out another letter on 11 October and a final email on 25 January 2018.

The ICO then sent an Information Notice, under section 43 of the Data Protection Act 1998, compelling the company to comply.

Head of Enforcement at the ICO, Steve Eckersley, said:

“Not registering with the ICO and, in addition to this, not complying an information notice are criminal acts - let it act as a stark warning to other companies who flout the law that we will take robust action.”

The company was prosecuted under the terms of the 1998 act because of when the offence took place. The new Data Protection Act 2018 came into force on 25 May, and organisations that process personal data have a duty to pay a data protection fee unless they are exempt.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 2018, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
3. The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
4. A limited number of civil and criminal enforcement cases – including this case - are still being dealt with under the provisions of the Data Protection Act 1998 because of the date the breach of the legislation occurred.
5. Criminal prosecution penalties are set by the courts and not the ICO.
6. To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.