Partner Article

ICO Investigation into Construction Industry Use of ?Blacklists?

With Watson Burton LLP Law Firm

On 06 March 2009, the Information Commissioner’s Office (“ICO”) announced that it had uncovered a database containing details on 3,213 construction workers which was used by over 40 construction companies when considering individuals for employment. The database is believed to contain personal information such as employment history, trade union activity and personal relationships and was run by a private detective called Ian Kerr through a firm known as The Consulting Association.

The ICO have served Mr Kerr with an enforcement notice ordering him to cease trading and he now faces prosecution under the Data Protection Act 1998 (“DPA”) for failing to notify the ICO that he was a “data controller.” The ICO has already published the names of over 40 construction companies who subscribed to the list. The ICO will now investigate these companies and part of their probe will be to identify the companies involved in setting up the database.

Whilst the above development is specific to the construction industry, there have been calls from trades unions for legislation to prohibit such ‘blacklists’ to be enacted, amid concerns that they may be in use across other employment sectors and industries. Therefore, the following advice is of potential relevance not only to construction companies but to individuals and companies operating in other sectors where such databases may exist.

If your company has purchased information concerning individuals from The Consulting Association or another such organisation or has sold/given information on individuals to such a third party you could be exposed to one or more of the following consequences:

1. Your company may be investigated by the ICO which may involve it being served with a notice to provide certain information or the ICO may obtain a warrant to enter your company’s premises to inspect/seize documents and equipment.
2. An individual may bring court proceedings against your company for damages for losses arising from breaches of the DPA or for distress arising from such breaches. An individual may also seek a court order requiring your company to amend, block or destroy any data about them which is inaccurate.
3. Your company may face criminal charges under the DPA if it knowingly or recklessly obtained or disclosed information about an individual without that individual’s consent. This would include providing data to a third party without consent. The maximum fine if found guilty is unlimited.
4. Individuals within your company may personally face criminal charges if they actively participated in or failed to appropriately act to stop the unlawful obtaining/disclosing of information relating to an individual. Again, this may attract an unlimited fine if found guilty.

If you or your company are affected by any of the above matters you should immediately review your existing DPA registration and policies to ensure compliance and set up a system to ensure that any subject access requests you receive are dealt with effectively and in accordance with the DPA.

Further information is provided in the Construction section of www.watsonburton.com. If you have any queries relating to this article, or any other Construction Law matter, please contact Mark Lennon at Watson Burton LLP on 0191 244 4369 or email mark.lennon@watsonburton.com.

This was posted in Bdaily's Members' News section by Ruth Mitchell .