A housing developer has been slapped with almost 1,500 in fines and penalties by the Information Commissioner's Office (ICO) over its failure to abide by data protection laws.
The developer, Magnacrest Ltd, failed to comply with a Subject Access Request, which led to it being brought before Westminster Magistrates and fined by the data protection watchdog.
The SAR was submitted to Magnacrest by an unnamed individual on 17 April 2017, and included a cheque for 10, to cover the processing fee that companies are legally allowed to charge for processing a SAR.
Magnacrest was reported to the ICO after it failed to provide the individual's data within the 40-day time limit mandated by UK data protection laws, and then repeatedly reminded of its legal responsibilities by the ICO via mail and phone.
After Magnacrest still refused to comply with the SAR, the ICO issued an enforcement notice on 30 January last year, compelling it to do so. Failing to comply with an enforcement notice is a criminal offence, and the developer was subsequently charged, pleading guilty on Wednesday this week.
Luckily for the Buckinghamshire-based developer, the SAR was submitted in 2017, before GDPR came into force. As such, its failure constituted a breach of the Data Protection Act 1998, and Magnacrest was only ordered to pay a 300 fine, 1,133.75 in prosecution costs and a 30 victim surcharge. Under GDPR, it would have been liable for a substantially higher fine.
"The right to access your own personal information is a fundamental and long-standing principle of data protection law," said the ICO's criminal enforcement manager Mike Shaw. "New laws brought into effect last May strengthen those rights even further."
"Organisations not only have to respect this right but must also respect notices from the ICO enforcing the law. If they fail to do so then they must accept the consequences, which can include a criminal prosecution."
-
ICO admits it's too slow dealing with complaints – so it's eying up automation to cut staff workloadsNews The UK's data protection authority has apologized for being slow to respond to data protection complaints, saying it's been overwhelmed by increased workloads.
-
“Limited resources” scupper ICO probe into EasyJet breachNews The decision to drop the probe has been described as “deeply concerning” by security practitioners
-
Surge in workplace monitoring prompts new ICO guidelines on employee privacyNews Detailed guidance on how to implement workplace monitoring could prevent data protection blunders
-
TikTok could be hit with £27m fine for failing to protect children's privacyNews Social media firm issued with a notice from the ICO for potential violations of UK data protection laws
-
What is AdTech and why is it at the heart of a regulation storm?In-depth The UK data regulator has come under heavy fire for consistently delaying much-needed action, privacy groups say
-
ICO crackdown on AI recruitment part of three-year vision to save businesses £100 millionNews ICO25 outlines a fresh approach that involves releasing learning materials, advice, and a new ICO-moderated discussion forum for businesses
-
Clearview AI fined £7.5m over improper use of UK dataNews Australian facial recognition firm collected 20 billion images from the internet without consent in order to build its database
-
UK data watchdog cut IT spending by £1.2 million during pandemicNews The ICO’s IT budget has been slashed by around 23% since 2019
