ICO shuts down firm selling private worker data
The Information Commissioner's Office will prosecute the owner of a construction worker database, and is considering action against the firms which accessed it.
The Information Commissioner has shut down a consulting firm that was selling private data about construction workers.
Consulting Association, run by Ian Kerr, operated a database holding details on 3,213 construction workers. He sold access to the data to over 40 firms for a 3,000 annual fee plus 2.20 to access each individual, according to the Information Commissioner's Office (ICO).
The construction firms used the data to vet potential workers, and the database held information about their personal relationships, connections to trade unions and employment history.
The ICO told the BBC that the database also held notes on what people thought of the workers, including calling them "lazy and a trouble stirrer." Other comments included "ex shop steward. Definite problems. No Go" and "Communist Party".
The ICO raided Kerr's West-Midland's business at the end of February, seizing the data. He faces prosecution for breaching the data protection act, and has been ordered to stop trading, which the ICO said he has done.
Deputy information commissioner David Smith said in a statement: "This is a serious breach of the Data Protection Act. Not only was personal information held on individuals without their knowledge or consent but the very existence of the database was repeatedly denied."
Under the Data Protection Act, any organisation holding personal information must be open about how they use it and most are required to register with the ICO. "Kerr did not comply with the law on either count," said Smith.
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2024.
The ICO is also considering taking regulatory action against the construction firms that had at some point subscribed to the database, which include "household names." The full list of companies which accessed the data is available on the ICO's website.
"I remind business leaders that they must take their obligations under the Data Protection Act seriously," Smith said. "Trading people's personal details in this way is unlawful and we are determined to stamp out this type of activity."
On 16 March, the ICO will launch a dedicated enquiry system offering help to people who believe their personal data is being held in such a way. However, Smith asked that people hold off until then before contacting the ICO on such issues.