A bit later than normal, it is time for our monthly review of the enforcement action taken by the Information Commissioner in respect of Privacy and Data Protection matters during the month of November 2017. This follows on from our reviews covering September 2017 and October 2017.
Key Points
- Ensure that when you are collecting personal data that you are clear and open about what it will be used for. If it is to be supplied to third parties for direct marketing purposes state as accurately as possible who those third parties are – stating that it will be shared with “carefully selected partners” is not going to be sufficient.
- When undertaking direct marketing by electronic means, such as by E-mail or text message, ensure that you have in place the necessary consent (and remember the definition of consent in the Data Protection Directive) of the recipient before sending your marketing messages.
- Once again, if you have access to personal data as part of your employment, ensure that you only access it where there is a legitimate business need for you to do so. Do not send personal data to your own personal E-mail address without first explaining to your employer why you need to do it and getting their consent to do so.
Enforcement action published by the ICO in November 2017
Verso Group (UK) Limited
Verso Group (UK) Limited was served with a Monetary Penalty Notice [pdf] in the amount of £80,000. Verso had been supplying personal data to third parties to enable those third parties to conduct direct marketing campaigns; the Commissioner considered that Verso had breached the First Data Protection Principle in doing so. This was because the Commissioner did not consider that the terms and conditions and privacy policies of Verso and those other companies from which it obtained personal data were clear enough to make the processing by Verso fair and lawful.
Hamilton Digital Solutions Limited
Hamilton Digital Solutions Limited were served with an Enforcement Notice [pdf] and a Monetary Penalty Notice [pdf] in the amount of £45,000 after the company were responsible for the sending of in excess of 150,000 text messages for the purposes of direct marketing in breach of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Prosecutions
There were a number of successful prosecutions reported by the ICO during the month of November 2017:
Prosecution 1 –
A former employee of a community based counselling charity was prosecuted by the ICO at Preston Crown Court and pleaded guilty to three charges under Section 55 of the Data Protection Act 1998. The Defendant had sent a number of E-mails to his personal E-mail address which contained sensitive personal data of clients, without his employers’ consent. He was given a 2 year Conditional Discharge, ordered to pay costs of £1,845.25 and a £15 Victim Surcharge.
Prosecution 2 –
An employee of Dudley Group NHS Trust pleaded guilty two offences under Section 55 of the Data Protection Act 1998: one of unlawfully obtaining personal data and one of unlawfully disclosing personal data. The defendant had accessed the medical records of a neighbour and former friend medical records and also disclosed information about a baby. She was fined a total of £250 (£125 for each offence) and was ordered to pay prosecution costs amounting to £500 and a victim surcharge of £30.
Prosecution 3 –
A former nursing auxiliary at the Royal Gwent Hospital in Newport was fined £232 for offences under Section 55 of the Data Protection Act 1998. She was also ordered to pay prosecution costs of £150 and a victim surcharge of £30. The Defendant had unlawfully accessed the records of a patient who was also her neighbour
If you require advice and assistance in connection with any of the issues above, or any other Information Law matter, please do contact Alistair on 0345 450 0123 or by completing the form on the contact page of this blog. Alternatively, you can send him an E-mail directly.