I have just read the Scottish Borders Tribunal Decision and the reasons why the Tribunal quashed the Commissioner’s Monetary Penalty Notice (MPN). It is clear from the judgment that the Tribunal thinks that the Information Commissioner (ICO) should have served an Enforcement Notice.
The Tribunal has hinted that ICO should, even at this late stage, serve an Enforcement Notice and that Scottish Borders should accept it. The fact that the Tribunal’s Decision is designated to be “Preliminary Decision” means that the Tribunal is reserving its position; it could impose its own solution and clearly does not want Scottish Borders to be seen as being wholly innocent.
Unlike other commentators, I don’t think that the Tribunal’s reasoning in its Decision will result in much change to the ICO’s policy with respect of the use of Enforcement or Monetary Penalty Notices except possibly he will take more care in deciding the appropriate enforcement mechanism. In my view, the Tribunal has simply determined that, on the facts of the case presented before it, the ICO had chosen the wrong enforcement vehicle.
However, I do think that the Scottish Borders case provides another example of the failure of the ICO to pursue “lawful processing”; if the ICO had focused “unlawful processing” as the reason underpinning the contravention of the DPA, then I think the outcome could have been different. I explain why below.
Finally, I think the idea of an MPN levied against any public sector data controllers lacks logic; there should be instead an offence associated with deliberately ignoring or grossly neglecting an obligation to comply with a data protection principle.
The Scottish Borders Tribunal (Preliminary) Decision
To understand the Tribunal’s decision, it’s useful to look at the relevant section of the MPN provision as it applies in the Scottish Borders case. Section 55A(1) allows the Commissioner to serve a MPN if he is satisfied that three conditions apply. These are that:
(1) there has been a serious contravention of a data protection principle (in this case the Seventh Principle) and
(2) “the contravention was of a kind likely to cause substantial damage or substantial distress” and
(3) the data controller (in this case Scottish Borders):
“(a) knew or ought to have known —
(i)that there was a risk that the contravention would occur, and
(ii)that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but
(b) failed to take reasonable steps to prevent the contravention”.
Now to the facts of behind the MPN. In summary, Scottish Borders had used a contractor (data processor) for back records conversion for over two decades. There was no data processor contract in place because the value of the contract was under £20,000; there were no provisions for managers who agreed such smaller contracts to ensure that any of the other data processor requirements outlined in the Seventh Principle were met.
For instance, there were no written instructions given to the data processor as to how to dispose of the manual records (once converted); the data processor apparently took it upon himself to dispose of the original records by means of the use of the recycling bins found at several locations in supermarket car-parks.
This disposal technique could have been used a number of times since 2008; it is not surprising that the Tribunal determined that, since the 1998 Act commenced, there was sufficient evidence to identify a “serious” contravention of the Seventh Principle.
That is why the Tribunal states that "procedures in relation to contracts for data processing were too serious simply to allow the Council's appeal (against the MPN)”. In other words, the Tribunal do not want Scottish Borders to escape “scot-free” so to speak; that is why it suggests an Enforcement Notice and has reserved its position (see paragraph 55).
Before going further, it is important to explain that the Tribunal had to differentiate between the “trigger event” and the “contravention”. For the Tribunal, the “trigger event” occurred several times (i.e. each time a supermarket recycling bin was used) however the “contravention” of the Act was the lack of data processor supervision.
The Tribunal, however, had difficulty in establishing the consequences of the lack of data processor supervision (i.e. finding evidence that “such a contravention would be of a kind likely to cause substantial damage or substantial distress”). Indeed the Tribunal stated that “Focussing on the contravention we have been unable to construct a likely chain of events which would lead to substantial damage or substantial distress”.
Of course it was possible to imagine some untoward consequences of data processor supervision (e.g. the Press publishing certain details); however what was “possible” did not pass the threshold of “likely”. In further detail, the reasons for the Tribunal’s difficulty are:
• First the items of personal data being recycled were details associated with staff pensions; “typically… a name, an address, date of birth, national insurance number and salary. In some cases the files contained bank account details, a signature, a nominee to receive benefits”. In other words there were no sensitive personal data involved, the implication being that the Tribunal might have come to a different conclusion if say, medical records originating from a health professional were disposed of in the same way.
• Secondly, even though the supermarket’s recycling bin was in a public place, it is difficult to retrieve files from such a bin if the bin is not overflowing (retrieval was possible in the Scottish Borders case for a few data subjects). This accounts for the statement in the Tribunal Decision that of all the consequences that could follow from the contravention, the most likely outcome for the majority of data subjects would be the destruction of their manual records (albeit not in a guaranteed secure way).
• Thirdly, the Tribunal considered it was fair only to consider the contraventions from the date of the commencement of the Monetary Penalty provisions (6 April 2010); this meant that the contravention only related to about 1,600 data subjects in total (and in relation to those files which could be retrieved from overflowing recycling bins, a much smaller number – at a guess, of the order of a 100 data subjects or so).
In summary, any actual data loss was limited to a few data subjects and did not involve sensitive personal data. No evidence of substantial distress could be adduced as being ”likely” from the time after when the MPN was introduced; however, the contravention involving the unsupervised data processor had occurred for years. Hence, as the MPN thresholds were not reached, the Enforcement Notice became the only game in town.
Unlawful processing again!
I think Scottish Borders were successful in its MPN appeal because of two reasons:
• the facts in the case happened to be fortuitous, and
• the ICO’s case was limited to the issue of data processor supervision.
With respect to the latter, the limitation to data processor supervision is a consequence of the ICO’s neglect of the link between the common law of confidence and lawful processing (see references); something which in the context of the processing of confidential personal data has yet to be remedied.
For instance, I am sure that you would agree that pension details relating to the financial affairs of data subjects are subject to an obligation of confidence, and the disposal of these confidential details in the “Scottish Borders way” sits uneasily with such an obligation.
So instead of the current case based on just the data processor obligations of the Seventh Principle, the ICO could have focused “unlawful” processing as part of the MPN.
He could have thus argued the MPN in terms of a substantial breach of the First and Seventh Principles; the First Principle in terms that confidential personal data have to be processed “lawfully” with due regard to the common law of confidence, whereas the Seventh Principle requires “appropriate organisational and technical measures” to guard against “unlawful processing” (i.e. a breach of the obligation of confidence”).
Note that with this change of emphasis, the case widens the grounds; the actual case was linked to the supervision of a data processor whereas a “lawfulness” case would be linked to all appropriate organisational and technical measures linked to processing of the confidential personal data.
In other words, when the ICO is considering whether a MPN should be served, on the grounds of “lawfulness” his investigation would be far wider; it would allow Scottish Borders approach to data protection and the processing of confidential personal data to be assessed across a range of issues (i.e. all relevant organisational and technical measures to assess their appropriateness).
So in the actual case before the Tribunal, the narrow confines of data processor supervision (or lack of it) was the only factor under consideration. By contrast, in a “lawfulness” approach, the lack of data processor supervision would be one consideration in many.
Of course, in the “lawfulness” scenario, if the data processor contravention was the only issue, then it would still be the case that the breach was of a kind unlikely to cause substantial distress. If this were the case, the outcome of our hypothetical lawfulness case would be the same as in the actual case.
So is there evidence that there were wider problems at Scottish Borders with data protection compliance? Well, in its Press Release released after the Appeal (see references) Scottish Borders confess that:
• “Since the data breach, the Council has initiated an Information Management project which aims to reinforce existing processes and procedures currently in place with regards to information management across all areas of the Council”.
• “This has involved reviewing and implementing improvement actions to strengthen information governance and security arrangements both internally and when arranging contracts and agreements with suppliers and partners”.
• “As part of this project, in February this year, we launched a new staff awareness campaign called ‘Think Information’ which aims to support all staff in their role in looking after information.”
• “The focus of this campaign is to ensure all staff, no matter what their role is, understand the role they have to play in making sure the public trusts the Council to look after their information”.
• “Not only does this include further support and training for all staff, but a series of materials have been produced to provide important information and advice to all levels of staff”.
So which of the following observations do you think is correct? Does the press release portray a data controller who has his data protection ship in seaworthy condition? Or does the press release resonate to the sound of slamming stable doors?
An offence of breach of a Principle
I have always thought that the idea of a MPN in the public sector quite absurd. You have one public body data controller which gets its money from the Treasury fined by another public body (the ICO), and appealing to a third public body (the Tribunal) which also is funded by the Treasury.
At the end of a complex legal process, any fine that is levied is returned to the Treasury so that in the next financial year, the first public body can obtain additional grant money from the Treasury (possibly covering the fine levied in the previous financial year).
In summary, this is a nonsensical public-sector “money-go-round”; it’s rather like a game of legal Monopoly which enriches the lawyers every time they pass “GO”. For instance, in the Scottish Borders case, there were 4 days of two legal counsels, two expert witnesses and a pile of preparation; one wonders how much this cost the public purse? But what the heck, the lawyers are not complaining.
A MPN fine works for the private sector as there is no “money-go-round”; the MPN fine can be seen as transferring private sector money from an errant data controller to compensate the public (i.e. the set of all data subjects). This idea of compensating the complete set of data subjects is absent in when you have a MPN in the public sector. The MPN just returns the fine, paid out of public funds, to public funds until it is redistributed.
So unless you allow the ICO to keep the fine to expand data protection services to protect data subjects, then for public sector bodies, the idea of a MPN in the public sector lacks intellectual credibility. However, if the law were changed in this direction (i.e. to allow the ICO to keep fines), it would raise a deep conflict of interest. For instance, if the ICO were to be “short of the readies”, he would be incentivised to prowl the data protection jungle to prey on data controllers.
That is why I have often argued that there should be, as a last resort, an offence of deliberate action or gross neglect on the part of a data controller or data processor that results in a breach of a data protection principle. For public bodies, it would be far more of a durable threat than a one off fine paid by the taxpayer. In addition, senior managers could be vulnerable also (e.g. via Section 61 of the DPA or by “aiding and abetting”).
I cannot see why if a member of staff sets out to intentionally breach the data controller’s procedures then that can be a criminal offence (theoretically punishable by 2 years in prison), but when a data controller sets out to totally neglect or deliberately breach his obligations to the Principles, it isn’t.
Scottish Borders MPN Tribunal Reference EA/2012/0212; http://www.informationtribunal.gov.uk/DBFiles/Decision/i1068/Scottish%20Borders%20Council%20EA.2012.0212%20(210813)%20Preliminary%20Decision.pdf
The ICO can deal with breaches of confidence as unlawful processing: http://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html
Scottish Borders press release: http://www.scotborders.gov.uk/news/article/542/information_tribunal_overturns_ico_fine
Still places on our Edinburgh Data Protection Course starting 15th September. Details on http://www.amberhawk.com/dp.asp