UK Company Sold Workers' Secret Data

krou writes "The BBC is reporting that the Information Commissioner's Office has shut down a company in the UK for a serious breach of the Data Protection Act. It claims that the company, The Consulting Association in Droitwich, Worcs, ran a secret system that it repeatedly denied existed for 15 years, selling workers' confidential data, including union activities, to building firms, allowing potential employers to unlawfully vet job applicants. About 3,213 workers were in the database, and other information included data on personal relationships, political affiliations, and employment histories. More than 40 firms are believed to have used the service, paying a £3,000 annual fee, and each of them will be investigated, too." The article says that The Consulting Association faces a £5,000 fine — after pulling in £1.8 million over 15 years with its illegal blacklist.

Comments

5k fine, 1.8M in profits

[KiloByte]

It's kind of hard to say "continue, please" louder than by slapping such an enormous fine.

Re:5k fine, 1.8M in profits

[Anonymous Coward]

Actually, it can get a lot worse for them, they can be forced to stop all data exports for a long investigation time. I was on a project receiving data for a rather large global company (who is making the news quite regularly these days) from all European markets as part of a pan Europe system. The data itself was nothing special, the company owned it in each market and was merely transferring it around within, yet one country data protection overlords somehow found protocol wasn't precisely being followed. I never found out exactly what was wrong, but that country's data wasn't able to be used for almost two years.

Re:5k fine, 1.8M in profits

[Shakrai]

It's kind of hard to say "continue, please" louder than by slapping such an enormous fine.

What are the odds of the employers who illegally used said database being fined or punished in some way? Punish the people who used the database and you'll find that the next time someone offers up illegal information for sale they'll have a much harder time finding customers.

Re:5k fine, 1.8M in profits

[Tony Hoyle]

The company has been shut down. Its owner faces prosecution *and* a £5000 fine (and for a case like this they will go for the maximum penalties).

Also all its customers are now under investigation and also face possible prosecution.

Also both the original company *and* its customers are wide open for legal action against them if they denied anyone a job because of this data.

That's a pretty fucking heavy disincentive for anyone doing it again.

Re:5k fine, 1.8M in profits

[Hatta]

Let us know when it actually happens.

Re:5k fine, 1.8M in profits

[Captain Hook]

those 3,213 employees are the ones who are blacklisted, that doesn't mean the employers are only checking 3213 potential employees.

and before anyone says those 3213 employees had it coming for being trouble makers - http://news.bbc.co.uk/1/hi/uk/7928331.stm

much bigger damage to society

[pmarini]

surely the damage done over 15 years to the families of those not employed because of this illegal practice is much bigger than £1.8mln...

Re:much bigger damage to society

[dkleinsc]

Even if they agreed to a background check, they probably didn't agree to be checked for activities that aren't in any way illegal or reflecting on job performance, such as (FTFA) "ex-shop steward" or "Irish ex-Army".

This is an old, old blacklist

[ab8ten]

This blacklist was specifically for the construction industry - for those who haven't RTFA. The terrible thing is that this list, and its sale for money, has been around for years and years. It's the industry's dirty little secret. It's only now they've computerised the records that they can use the Data Protection Act to prosecute. Sadly, I have no doubt that the information will live on somehow. All the major players have fingers in the pie and won't give it up, I think.

Re:This is an old, old blacklist

[pjt33]

It's only now they've computerised the records that they can use the Data Protection Act to prosecute.

That's not true. The DPA covers "information which ... (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system", where "relevant filing system" is defined as "any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible."

"political affiliations"

[krou]

Just to point out that the original BBC article (when I submitted the story to /.) had a quote from the notes in the illegal database stating that someone was a member of the Communist Party, hence why I mentioned it contained political affiliations. Not sure why the BBC removed this, but just thought I'd mention it in case someone wonders why.

4. ?????

[Ogive17]

Finally we figure out the 4. ????? before 5. Profit!

British Paranoia at its finest!

[ringbarer]

Let me get this right:

British Employers are paranoid that potential employees are Communists or worse. They subscribe to a secret blacklist that potentials have no knowledge of or ability to refute allegations. Anyone blacklisted will not be employed, but the work still needs to be done.

So they draft in cheap labor from countries that didn't even exist twenty years ago. As these migrant workers aren't on the blacklist, they get cherry picked for work that local labor should have the same rights to apply for. The end result being the rise of local unemployment through no fault of the workers.

No wonder their economy is fucked.

Inaccurate summary

[Apatharch]

...what a surprise.

The article does not say that the company is being fined £5000; it's the owner himself who faces prosecution, and hence a criminal record.

Re:sounds like the work of a genius

[Cally]

That's the infuriating aspect of this for some of us in the infosec world. This wasn't "selling private data", it was a good old-fashioned blacklist of "troublesome" employees who did annoying things like joining unions, complaining about health and safety violations (construction's very dangerous in the UK, I think it's ~100 deaths a year, and you can work out the ratio of deaths to maimings and career-ending injuries.) What they did was vile and evil, and the companies (huge mainstream FTSE-listed corporations, mostly) should be taken to the fucking cleaners as a clear sign that this sort of thing is illegal for good reasons, and will not be tolerated. However it's got FA to do with "leaking of personal data"; the headlines here, on the Beeb and even El Reg have been totally misleading.

Re:I'm confused

[cbiltcliffe]

Governments can be held accountable for their actions.

Really? What country do you live in? I'd like to move there.

solution:

[Anonymous Admin]

Charge them with 3213 instances and fine them per instance. The profit disappears and so does the motivation.

Re:sounds like the work of a genius

[fuzzyfuzzyfungus]

Highly variable, I suspect.

Illiterate undocumented immigrant getting paid 80 pence an hour to carry a hod? Probably not.

Skilled tradesman who happens to have political opinions pinker than his boss would like? Quite possibly(especially the web stuff).

Access to legal options, unfortunately, is very much a game for the wealthy; but the interwebs are pretty far downmarket these days.