Once again Richard Thomas the UK's data protection regulator has demonstrated that his office will take action against companies who infringe the Data Protection Act (the "Act"). The latest to be named and shamed is the Carphone Warehouse along with Talk Talk, its sister company.

Following complaints to his office, the Information Commissioner commenced an investigation and found that the companies had failed to follow the fundamental principles which underpin the Act.

The investigation found that both Carphone Warehouse and Talk Talk had:

  • failed to comply with subject access requests – despite having cashed the cheques accompanying the requests;
  • unfairly and unlawfully processed data – by opening up accounts under the wrong name;
  • failed to put in place appropriate measures to prevent unauthorised or unlawful processing - in some cases customers were able to view the personal data of other customers; and
  • processed inaccurate data – by providing debt collection and credit reference agencies with data that was inaccurate.

The Commissioner took the view that Carphone Warehouse and Talk Talk's failings had, where they had used inaccurate and incorrect personal data, "caused real damage and distress to customers".

In issuing its Enforcement Notice, the Commissioner's Office stated that they have "now ordered them to take the necessary steps to ensure customers' personal information is sufficiently protected". The Enforcement Notice effectively orders that Carphone Warehouse and Talk Talk comply with the principles of the Act, and should they fail to comply with the Enforcement Notice they will be committing a criminal offence.

Disclaimer

The material contained in this article is of the nature of general comment only and does not give advice on any particular matter. Recipients should not act on the basis of the information in this e-update without taking appropriate professional advice upon their own particular circumstances.

© MacRoberts 2008