Enforcement of section 18 DPA

The request was successful.

Jonathan Baines

Dear Information Commissioner’s Office

In October last year you disclosed to another requester a list of 46 MPs who had not renewed their section 18 DPA registration with your office. You explained some of the procedure for enforcing the statutory requirement to register, and explained that

"Prosecution is usually the last resort when all else fails and we do give ample opportunity for the data controller to register. The legal team are not currently considering any MPs for prosecution."

It appears, from a check of your register that, currently, 22 of those same MPs have still not registered, more than seven months later. These are

Z1243695
NIGEL EVANS MP
Z1434043
GAVIN BARWELL
Z1939110
EDWARD LEIGH MP
Z9286519
KHALID MAHMOOD MP
Z1993957
JAMES CLAPPISON MP
Z1102604
ANGUS ROBERTSON MP
Z9256111
JIM SHANNON
Z927838X
DAVID SIMPSON
Z1577500
DAVID BURROWES
Z1538835
PAT DOHERTY MP MLA
Z2134863
MARGARET CURRAN
Z2241138
RACHEL REEVES MP
Z2241519
NIGEL ADAMS
Z2247846
STUART ANDREW
Z9938280
SHAILESH VARA MP
Z2342005
TRISTRAM HUNT
Z1893869
PAUL BERESFORD
Z1903198
CHRISTOPHER CHOPE MP
Z2378834
JESSICA LEE
Z8752516
ERIC JOYCE MP
Z2343491
ZAC GOLDSMITH MP
Z1728512
ADAM HOLLOWAY

I note that in several instances these MPs appear not to have renewed their notification for over a year.

Please inform me, under the Freedom of Information Act 2000

1. What enforcement action has been taken against these MPs?
2. How many reminders each has been given (I understand you normally operate a two-reminder, then enforcement, system)
3. In addition to these 22, how many other MPs have not renewed their notification? (as more than seven months have elapsed I presume there will be some additional notifications which have lapsed).

I acknowledge that the online register does not guarantee to be up-to-date.

Yours faithfully,

Jonathan Baines

Information Commissioner's Office

PROTECT

10 May 2012

Case Reference Number IRQ0447930

Dear Mr Baines

Request for Information
 
Thank you for your correspondence of 10 May 2012, entitled “Freedom of
Information request - Enforcement of section 18 DPA”.
 
Your request is being dealt with in accordance with the Freedom of
Information Act 2000.  We will respond by 08 June 2012 which is 20 working
days from the day after we received your request.
 
Should you wish to respond to this email please be careful not to amend
the information in the ‘subject’ field. This will ensure that the
information is added directly to your case. However, please be aware that
this is an automated process; the information will not be read by a member
of our staff until your case is allocated to a request handler.
 
Yours sincerely
 
 
 
Andrew Walsh
Lead Internal Compliance Officer
01625 545 363

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

Information Commissioner's Office

3 Attachments

PROTECT

08 June 2012

Case Reference Number IRQ0447930

Dear Mr Baines

I am writing further to our email dated 10 May 2012, in which we
acknowledged your request for information to the Information
Commissioner’s Office (ICO). Your request has been considered under the
Freedom of Information Act 2000 (the FOIA).
 

In your correspondence, you referenced an earlier FOI response and in that
context provided a list of 22 MP’s. You then requested

 
1. What enforcement action has been taken against these MPs?

2. How many reminders each has been given (I understand you
normally operate a two-reminder, then enforcement, system)

3. In addition to these 22, how many other MPs have not renewed their
notification? (as more than seven months have elapsed I presume there will
be some additional notifications which have lapsed).
 

We have considered your request in accordance with the Freedom of
Information Act 2000 (FOIA)

What enforcement action has been taken against these MPs?

I can confirm that no enforcement action has been taken against these
MP’s.
 

How many reminders each has been given (I understand you
normally operate a two-reminder, then enforcement, system.
 
Please find attached a document showing the number of times we have
written to each of the MP’s you have indicated. I thought it would be of
additional interest to provide the dates of each reminder.

Our Notification system automatically reminds Data Controllers whose
notification has expired in the form of two reminder letters.  This
happens in all cases other than where a Data Controller who previously
paid for their notification by direct debit changes their method of
payment.  In these cases the automatic reminders are not currently
triggered.  In the case of the MPs listed in the attachment this applied
to 2 of them who, as the table shows, did not receive our automated
reminders.  We are in the process of reviewing our notification systems
and when doing so will be considering whether we are able to update our
automated reminder service to ensure it includes those customers who have
changed their payment methods since their last renewal of their
notification. 
 

In addition to these 22, how many other MPs have not renewed their
notification? (as more than seven months have elapsed I presume there will
be some additional notifications which have lapsed).
 
Please find attached a document showing a full list of all 650 MP’s, along
with (where applicable) their Registration number and date of expiry. For
completeness I should clarify that this list has essentially been created
for the purposes of this response. At the time of your request, we did not
hold a full list of MP’s and the list has been compiled with the
assistance of external websites. Further, the information was correct at
of 24 May 2012, so as you will appreciate, there may have been a small
number of updates since then.
 

Finally, I thought it would be useful if I provided a supplementary
explanation as to our work in the area of Notification. As we have
previously outlined, it largely appears to be the case that Data
Controllers will renew their Notification entries following our automated
reminder letters. I should also clarify that when an entry expires it is
the responsibility of the Data Controller to assess their data processing
at that point and make a determination as to whether notification is still
required. As previously acknowledged, this is not always done in a
particularly timely manner, although it remains the case that the
significant majority of MP’s are notified.

I am mindful that there might be some confusion between the process of
sending renewal reminders and the more targeted non notification
enforcement process. When a data controller notifies, the notification
lasts for a year and then expires.  As stated above, it is then the
responsibility of the data controller to assess their data processing at
that point and make a determination as to whether notification is still
required. 

We provide a reminder service to notified entities to help them maintain
their notification.  However, because there are legitimate reasons why
many Data Controllers may not need to renew their notification once it
expires, we do not actively pursue all 350,000 of our annual renewals. 
Our non notification activities are targeted at particularly high risk or
under represented groups or sectors. 
 
As we have explained previously we wrote to all newly elected MPs after
the last election and we are also in the process of writing to the House
of Commons to remind all MPs of the need to maintain their notification on
an ongoing basis.
 
I do hope this information is of assistance to you.

Review/Complaint Procedure
 
In respect of our response to you under the FOIA, if you are dissatisfied
with this and wish to request a review of our decision or make a complaint
about how your request has been handled you should write to the
Information Governance Team at the address below or e-mail
[email address].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the Case Reception Team, at the address below or visit the ‘Complaints’
section of our website to make a Freedom of Information Act or
Environmental Information Regulations complaint online.  A copy of our
review procedure is attached.
 
 
 
Yours sincerely
 
 
 
 
Andrew Walsh
Lead Information Governance Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF.
T. 01625 545363  [1]www.ico.gov.uk

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. blocked::http://www.ico.gov.uk/
http://www.ico.gov.uk/