Data Protection Act: heavy penalties for those who fail to comply with obligations

Some 3,000 law firms are risking heavy penalties for failing to comply with their duties under the Data Protection Act 1998, the Information Commissioner's Office (ICO) warned this week as it launched a crackdown on solicitors.


The ICO said that around a third of law firms have still not registered as data controllers. Under the legislation, organisations that enter details about identifiable individuals on to a computer must notify the ICO.


The ICO must crack down on this lack of notification, a spokeswoman said. 'It is no longer reasonable for firms to say they are not aware of their obligations - we have written to them at least once, if not twice.'


ICO chief operating officer Simon Entwisle said: 'Notification is a legal requirement under the Data Protection Act. We are trying to make this process as simple as possible for solicitors and, to that end, we are now writing again to firms that have failed to notify to us. I must stress that failure to notify is a serious offence and, ultimately, we do have legal powers at our disposal to ensure firms comply with the law.


'Complying with the Act ensures that individuals' personal information is secure, accurate, up-to-date and is processed fairly. One of our statutory obligations is to keep a register of data controllers, which individuals can consult, and annual notification is the essential process to ensure that the register is kept up-to-date.'


Notification costs £35 and should be made directly to the ICO.


Last March, solicitor Ralph Donner, a partner at Feld McKay & Donner, was ordered to pay a record £3,150 fine following an ICO prosecution for failing to notify under the Act (see [2005] Gazette, 10 March, 1).


Mr Donner had believed a small businesses exemption applied under the Act and claimed the ICO was making an example of the firm. He said the summons was issued four months after the firm notified and involved a failure to notify for a four-month period only. There was no suggestion of any breach of the Act.


He was the eighth solicitor to be prosecuted by the ICO in 12 months.


Link: www.ico.gov.uk