75% of law firms 'breach data rules'

Up to 75% of law firms could be committing a criminal offence for failing to notify the Information Commissioner (IC) for their inclusion in the public register of data controllers.

Since October 2001, under the Data Protection Act 1998, any individual or organisation that processes personal data for the purpose of administering legal services, using a computer or other system, is required to join the register.

Recent research by the IC has revealed only 25% of firms have so far notified, despite failure to do so being a criminal offence.

These figures come on the back of an announcement earlier this month by the commissioner, Elizabeth France, that her office would be taking a more aggressive stance over enforcement of the 1998 Act (see [2002] Gazette, 3 October, 16).

In a letter to the Law Society, Nigel Revill, assistant investigating officer at the IC, wrote that 'within the near future the commissioner will be contacting a number of solicitors who do not appear to be on the public register of data controller'.

Mr Revill explained that the move would come as a result of such a low number of law firms notifying.

He told the Gazette: 'I hope this news piece acts as a warning to solicitors.

Now this has been printed we will be going down the list of unregistered firms and sending out letters to make them aware of the situation.'

Law Society professional adviser, Elizabeth Richards, said: 'Solicitors with computer systems, which hold information about clients or staff, need to register with the IC office.

Although at the moment it is unlikely that solicitors who register late will be criticised, the commissioner is likely to want to start using her new enforcement powers soon.

Therefore, the Law Society is reminding solicitors about their legal obligations under the Data Protection Act.'

Some firms may be exempted if their handling of data falls outside the definition of 'processing'.

According to Mr Revill's letter, the term refers to the 'obtaining, recording or holding of data, or the carrying out of any operation on such data [and] organising, adapting or amending the data; retrieving, consulting or using the data; and disclosing, erasing or destroying the data'.

Eduardo Ustaran, senior solicitor in the tech-media department of London firm Berwin Leighton Paisner, said: 'What alarms me is that registration with the IC is only the tip of the iceberg when it comes to data compliance, and if firms have failed to do this it is highly unlikely they have addressed other issues in the Act.'

The former director of public policy at Clifford Chance, Richard Thomas, has been appointed as successor to Ms France as Information Commissioner.

He will begin his term on 2 December.

- The notification form can be accessed on-line at: www.dpr.gov.uk, or by telephoning the IC on 01625 545740.

The annual fee is 35.

Andrew Towler