Thousands of firms risk prosecution under data law

More than 10,000 accountancy firms risk prosecution and thousands of pounds
in fines for failing to alert the government’s information commissioner that
they are
holding key information about clients on their databases.

Notification is compulsory under the Data Protection Act, but the
Information Commissioner’s Office (ICO) said that fewer than half the
20,000 accounting firms on its books had informed the body whether they
were storing clients’ personal information on their computer systems. Those

failing to comply range from sole practitioners to firms of 20 partners.

The ICO recently targeted the law profession for its low rate of
compliance, in a campaign that led to the prosecution and fining of several

solicitors. Registration among solicitors rocketed from 25% to 70%
following the legal action.

Philip Taylor, a solicitor at the ICO, said that accountants were next on

its list, due to a ‘particularly low’ level of compliance. ‘Our research
shows that only 45%-50% have notified us,’ said Taylor.

In March, Ralph Harold Donner of solicitors Feld Mackay and Donner was
fined £3,150 and ordered to pay £3,500 towards prosecution costs for
failure to notify the commissioner. Donner was contacted five times over a

two-year period by the department.

The ICAEW and ACCA this week expressed shock at the aggressive tactics
employed by the commissioner’s office.

John Davies, head of business law at ACCA, said the ICO had not approached

the association for help in dealing with the registrations shortfall.

ICAEW head of business law Felicity Banks complained that the commissioner

should have discussed the issue with the institutes before launching its
campaign. ‘We would like to discuss what’s going on with the commissioner,’

she said.

The 1998 Data Protection Act requires every business that is processing

personal information ­ known as a ‘data controller’ ­ to notify the ICO.
The notification costs £35 annually.