Tribunal cancels monetary penalty notice after ICO and council reach deal

The First-Tier Tribunal (Information Rights) has formally cancelled the monetary penalty notice issued by the Information Commissioner’s Office against Scottish Borders Council.

In August the tribunal ruled that the ICO should not have imposed a £250,000 fine on the council – a record sum for local government.

The case arose after pension records for former employees were discovered in an over-filled paper recycling bank outside a supermarket in Queensferry.

In its preliminary ruling, the tribunal found that:

• The council’s arrangements with its external contractor for the destruction of the records were “obviously defective” and in contravention of the Data Protection Act;
• The contravention was serious. It was systemic, not an isolated human error.

However, it also found that the contravention was not of a kind likely to cause substantial damage or substantial distress.

At the time the tribunal decided at the time it was not – on the information it had seen – prepared to allow Scottish Borders’ appeal, saying its concerns about the council’s procedures in relation to contracts for data processing were too serious for that.

It therefore delayed consideration of whether to issue an enforcement notice or take some other action to allow a conversation to take place between the authority and the ICO about the placing of data processing contracts and the training given to staff involved. “It may be possible for the parties to agree a way forward.”

In a decision notice issued last week (26 September), the tribunal said: “Negotiations between the parties concerning Scottish Borders’ procedures in relation to data protection have resulted in agreement that there is no need to issue an enforcement notice.

"The appeal is allowed and the monetary penalty notice is cancelled."