The UK Information Commissioner’s Office (“ICO”) has cracked down on a London-based payday loans company which failed to register that it was processing personal data.
The UK Data Protection Act 1998 (“DPA”) says that organisations that process personally identifiable information must register with the ICO. The standard registration fee is £35 per annum. Organisations are required to complete a form setting out details of the information that they process.
Any organisation which does not comply with this requirement is committing a criminal offence, which is punishable by a fine of up to GBP£5,000 in a Magistrates Court, or unlimited fines in a Crown Court.
The ICO prosecuted a payday loans company called First Financial for failing to register under the DPA. First Financial was duly convicted and fined GBP£500. It was also ordered to pay around GBP£1,000 in legal costs, plus a “victim’s surcharge” of £50. A Mr Hamed Shabani was also found guilty in his capacity as sole director of the company. He was fined GBP£150 and was also ordered to pay legal costs and a victim’s surcharge. He had attempted to remove his name from the company’s registration at the UK register of companies in order to avoid prosecution, but this attempt had failed.
The ICO welcomed the result of the case, saying it was important for businesses to show due regard for the personal data of their customers, especially if (as was the case here) those customers were vulnerable persons.
Prosecutions of this kind are quite rare. However, this case shows how businesses that process personal data in the UK should not be complacent about failing to register with the ICO. It seems like a mundane compliance issue, and the fines levied were small. However, the consequences of failing to register can result in criminal liability, with potential implications for the reputation of a business, which should otherwise be easy to avoid.
Directors and officers of unregistered companies should similarly be wary of breaching the DPA in this regard, as they might receive an unwanted criminal record for their organisation’s non-compliance. Taking care of the small things can reap rich rewards.