Commissioner Richard Thomas had issued an
enforcement notice against B4U, which runs b4usearch.com, a site
which contained people's personal and contact information without
their permission. B4U did not take the information down by the
deadline set in the order, which was 1st August 2006.
Now that the information has been taken down,
the ICO is dropping its case, even though an offence was committed
during all the time when the information was on the site past 1st
August.
"The problem is the lack of follow through
because if he doesn't follow through no examples are made," data
breach victim Tim Trent told technology law podcast OUT-LAW Radio. "And there are plenty of other
people who will use it in a potentially cynical manner and will
also see that B4U have not been prosecuted therefore they can do as
they please and if someone ever does tell the Information
Commissioner about it it's a bit like being told off by your
favourite uncle."
The ICO said that it did not see a need for
further action. "The company has now complied with the notice and
taken down the information that it shouldn't have been using," said
an ICO spokeswoman.
"Now that they have complied, looking at it
responsibly do we really want to go down the path of prosecuting
when they have complied with the Act?," she said.
B4U owner Raj Banga said that he did not know
how long after the deadline the information was taken off the
website. "I haven't got the exact dates in front of me," Banga told
OUT-LAW.
Though neither Banga nor the ICO could confirm
exactly when the material was taken down, OUT-LAW understands that
it was at least as late as November or even December of last year.
Banga did not dispute those dates. The ICO only stopped the
investigation this week.
"We complied with them, albeit a few weeks
late, which was due to technical difficulties we experienced here,"
said Banga. "As far as I know we've done our duty and so have
they."
Trent said that the view of the ICO
investigator who took a statement from him was that an offence had
been committed for all of the time that the data was live after 1st
August.
"He was of the feeling that an offence had
been committed, a substantial offence, and that it was being
committed from 1st of August all the way through to when they
removed the data," said Trent. "His opinion as an investigator,
which obviously is not the opinion of a prosecutor, was that there
was a solid case for them to answer."
Trent says that the approach is not good
enough, and that the offence has been committed.
"I'd like the traffic police to deal with my
speeding tickets that way too, cause if I brought my car to halt
then I've been a good boy," said Trent. "B4U have brought their car
to a halt so they've obviously been good boys. They can go on
without a stain on their character and I'd have three points on my
licence and a sixty quid fine."
"I hope organisations wouldn't see us as an
organisation that was afraid to prosecute. We do prosecute cases,"
said the ICO spokeswoman. "We have taken enforcement action, and we
have also prosecuted. In this case the company did comply following
our action."
