A pay-day loans company based in London and its director have been prosecuted by the Information Commissioner’s Office after failing to register that the business was processing personal information.
Under the Data Protection Act 1998, organisations processing personal information are required to register with the ICO. Most organisations will be required to pay an annual notification fee of £35 and provide details about the types of information they process. Failure to notify is a criminal offence and could lead to a fine of up to £5,000 in a magistrates’ court, or an unlimited fine in a Crown Court.
Hamed Shabani, the sole director of First Financial, was convicted under the Data Protection Act 1998, s 61 at City of London Magistrates’ Court today. He was fined £150 and ordered to pay £1,010.66 towards prosecution costs, as well as a £20 victims’ surcharge. The company, was convicted under s 17 of the Act, was fined £500 and has also been ordered to pay £1,010.66 towards prosecution costs, as well as a £50 victims’ surcharge.
Before the hearing Mr Shabani had attempted to remove his name from the company’s registration at Companies House in order to avoid prosecution.
Stephen Eckersley, ICO Head of Enforcement, said:
‘Failure to register is not only a criminal offence, but also shows that a company holds a clear disregard for looking after and protecting the personal information of their customers. Pay-day loans companies hold important information about some of the most financially vulnerable people in the UK. This makes this company and its director’s decision not to face up to their legal responsibilities all the more concerning. Businesses must commit to looking after the information of their customers and this begins with making sure that they are registered. We will continue to use our enforcement powers to safeguard people’s information.’
