Solicitors fined for failure to register under the Data Protection Act

Two English legal firms have recently been fined in legal actions initiated by the Information Commissioner’s Office (ICO), for failing to register themselves as controllers of personal data.

The Data Protection Act 1998 (the DPA) requires almost all organisations that hold personal details of individuals to notify and register with the ICO.

In 2005 the ICO issued a statement which said that one third of UK legal firms had not yet met their obligation under the DPA to notify the ICO that they processed personal data. The statement also said that the ICO would be cracking down on those firms who failed to comply with the rules.

The recent fines show that the ICO is prepared to take action against businesses which fail to notify. In both cases the fines were preceded by numerous reminders which appear to have been simply ignored.

Notification currently costs an annual fee of £35 which contrasts favourably with the £300 fine and £500 costs order handed down to each of these two firms.

For more information about your rights and obligations under the DPA issues please contact Richard Fox on 01603 281127. Richard is a general commercial solicitor, practising data protection and e-commerce law.