Data protection in action

A press release from the Information Commissioner confirms that, for the first time, the ICO has used its powers under the Data Protection Act 1998 to serve an Enforcement Notice with a seven day compliance condition. 

 The trader in question had violated the Data Protection Act 1998 by maintaining a database of personal data, and sensitive personal data, about employees in the construction industry.  For a fee, industry employers could contact the trader to search against potential employees.  Not only had the trader in question failed to notify the ICO about the data processing question, but he had not sought the consent of the data subjects, and had indeed denied the existence of the database. 

The breaches of the DP Act were discovered during a raid by the ICO on the trader's premises on 23 February. 

As a result of the ICO's action, the trader has since ceased trading.  The ICO is currently planning to prosecute the trader, and investigate whether or not to take action against the construction industry firms which used his service.

 The BBC website also contains a news report on this story.