In a move that will shock many observers, the Information Commissioner has announced the level of the civil monetary penalty that will be imposed on one of the most awful solicitors of this century. Christopher Graham announced the award – and a bit of the thinking behind it – at a packed reception today in the Strangers Dining Room at the Palace of Westminster, where some of the great and the good of the Data Protection (and Parliamentary) community had assembled to celebrate the launch of the Data Sharing Code of Practice.
In an extremely astute move, Christopher Graham commanded that cake and sandwiches should not be served to us until he had finished speaking. Just as well. If our mouths had been full of any of those comestibles as he gave his explanation, I’m sure that most of us would have coughed the food onto the carpet in disbelief at what we were hearing.
Let’s be clear. Andrew Crossley, the sole practitioner of ACS Law, was involved in a business which people who are far cleverer than I have suggested was morally outrageous. If he has done even half of what he is alleged to have done, then that in itself would cause me to cross the road if I were ever to notice him coming towards me.
However, turning to the matters that were of concern to the Information Commissioner, according to the ICO's findings, he routinely handled large amounts of personal data, in an internet environment, and had used a legal assistant with no IT qualifications to research and recommend a new web-hosting company and package to him. The “home” web-hosting package cost £5.99 a month. It was never intended for significant business use, nor did it appear to provide any guarantees to the data controller in relation to the security of the personal data. So, he knew or ought to have known that failing to take professional IT advice about an appropriate web-hosting company and the implementation and development of his associated IT systems might lead to deficiencies in the data controller’s IT systems.
As a result, a large amount of personal data and sensitive personal data leaked on-line relating to around 6,000 individuals. The ICO’s findings do not specify what this data is, but friends of mine who know about these things are truly shocked at what was leaked. This information has been distributed worldwide and could be available to third parties indefinitely. The contravention was of a kind likely to cause substantial damage and distress to the data subjects.
And the fine – well, we know that civil monetary penalties are not designed to impose financial hardship on a data controller. The Statutory Code makes that pretty clear.
So, if Andrew Crossley pays in full by 6th June, the fine will be £800.
I claim more than that in expenses, some months.
As I heard the reasoning behind the decision to set the figure that low (he’s a small businessman who is fully co-operating with the ICO, and hasn’t got any money left anyway – it’s all been spent, blah blah blah) my mind turned to the work of Thomas Luis de Victoria (1548 - 1611), whose 400th anniversary we celebrate this year. He was the Andrew Lloyd Webber of his time – and one phrase from his Lamentations (composed for the Holy Saturday of the Easter festival) is particularly apt: Recordare Domine quid acciderit nobis: intuere, et respice opprobrium nostrum. For those scholars amongst us whose natural classical language is not Latin, the English translation is Remember, O Lord, what has befallen us: look and see our disgrace.
Some disgrace.
If the best the ICO is capable of doing (under the circumstances) is issuing a fine of £800 to someone as notorious as Andrew Crossley, the “custodial sentence” brigade are going to be rising forth, demanding penalties that fit the crime a little more closely than those Parliament have currently empowered the Commissioner with.
I wanted to suggest to David Davies MP, who was also at today’s Parliamentary reception, that perhaps Parliament should bring in a new punishment, to allow the Commissioner to have miscreants paraded through the streets of Wilmslow before being beaten on the bottom with a copy of the Woman’s Weekly.
If it’s a punishment that is sufficiently invigourating for Victoria Wood, then it ought to be good enough for the likes of Andrew Crossley.
Sources:
http://www.ico.gov.uk/~/media/documents/pressreleases/2011/monetary_penalty_acslaw_news_release_20110510.ashx
http://www.ico.gov.uk/~/media/documents/library/Data_Protection/Notices/acs_law_monetary_penalty_notice.pdf
.
Posts
