Data firms 'on a hiding to nothing' in ICO investigations

Verso Group has hit back at the Information Commissioner’s Office’s handling of its investigation – and subsequent press statements – following last week’s £80,000 fine, amid growing concerns that once companies are in the ICO’s sights, they are on “a hiding to nothing”.
Speaking exclusively to Decision Marketing, Verso chairman Anthony Hawkins claimed that not only were the ICO’s statements “misleading”, but the regulator also failed to support its findings with any figures on how many records were in breach of the law, making it virtually impossible for the firm to refute the claims.
Hawkins said: “The directors of Verso would like to highlight the fact that the ICO has implied that Verso Group was responsible making 46 million nuisance calls. The number of data records supplied by Verso to Prodial was less than 0.15% of the volume stated. Furthermore, to this day Verso still has no evidence that any of our 50,000 records of data supplied to Prodial were actually ever dialled – nevertheless it is an extremely small fraction of the figure suggested by the ICO.
“During the investigation the ICO also failed to support its enquiries with any figures relating to breach of regulation. This obviously prevented any opportunity to refute the claims, but nevertheless the ICO has stated that Verso Group has been found to have breached the relevant rules.”
Hawkins also claimed that Verso has recently been exonerated in a case investigated by a separate UK regulator. The investigation lasted more than a year, and there were found to be no charges to answer for. However, defending the allegations cost Verso Group £120,000 in legal and forensic accountancy fees.
Hawkins (pictured) explained: “When during its investigation the ICO provided the opportunity for the directors of Verso Group to accept a fine that would be discounted by £16,000 if paid by a given date, they decided that it was commercially more prudent to accept the fine than fight the case which, based on previous experience, may have cost upwards of £150,000 in professional fees.
“Such fees cannot be recovered when there is found to be no case to answer for. The actual fine that will be paid is £64,000, not £80,000 as reported.”
The ICO says Verso is just one of 14 companies it is investigating as part of a wider probe into the data broking industry.
One industry insider said: “We all know the ICO has a job to do, but whatever happened to its claim that it has always preferred ‘the carrot to the stick’? The recent investigation into the charity sector resulted in just a slap on the wrist for most, but they have been abusing the system for years. So why can’t other businesses get the same treatment? It seems that once you are in its sights, you are on a hiding to nothing.”
In September, the ICO slapped True Telecom with an £85,000 fine for contacting just over 200 people registered on the TPS over a two-year period, in which it claimed to have made 5 million calls.
Others have pointed out that the current regulations are a minefield and the situation is only likely to get worse. Last week, Pinsent Mason data law protection expert Claire Edwards said data practitioners face a Herculean task to ensure their businesses remain compliant.
She said: “To properly get to the bottom of data protection legislation in the UK, a controller or processor would need at the very least to read the lengthy Data Protection Bill, the lengthy GDPR and rules on e-privacy – currently PECR, although a new EU ePrivacy Regulation is on the way.
“That is before taking into account other pieces of national law, which may have some impact, such as the Digital Economy Act for example. Adding a potentially never-ending list of orders statutory instruments etc. made under the Bill’s delegated powers and it has the potential for compliance to be over burdensome for controllers and processors trying to make sense of it all.”

Share with friends and colleagues

Related Articles