A housing developer has been slapped with almost 1,500 in fines and penalties by the Information Commissioner's Office (ICO) over its failure to abide by data protection laws.
The developer, Magnacrest Ltd, failed to comply with a Subject Access Request, which led to it being brought before Westminster Magistrates and fined by the data protection watchdog.
The SAR was submitted to Magnacrest by an unnamed individual on 17 April 2017, and included a cheque for 10, to cover the processing fee that companies are legally allowed to charge for processing a SAR.
Magnacrest was reported to the ICO after it failed to provide the individual's data within the 40-day time limit mandated by UK data protection laws, and then repeatedly reminded of its legal responsibilities by the ICO via mail and phone.
After Magnacrest still refused to comply with the SAR, the ICO issued an enforcement notice on 30 January last year, compelling it to do so. Failing to comply with an enforcement notice is a criminal offence, and the developer was subsequently charged, pleading guilty on Wednesday this week.
Luckily for the Buckinghamshire-based developer, the SAR was submitted in 2017, before GDPR came into force. As such, its failure constituted a breach of the Data Protection Act 1998, and Magnacrest was only ordered to pay a 300 fine, 1,133.75 in prosecution costs and a 30 victim surcharge. Under GDPR, it would have been liable for a substantially higher fine.
"The right to access your own personal information is a fundamental and long-standing principle of data protection law," said the ICO's criminal enforcement manager Mike Shaw. "New laws brought into effect last May strengthen those rights even further."
"Organisations not only have to respect this right but must also respect notices from the ICO enforcing the law. If they fail to do so then they must accept the consequences, which can include a criminal prosecution."
