On 4 July 2006, the Information Commissioner served an enforcement notice on B4U Business Media Limited. B4USearch.com offers a free online people and business finder. This allows internet access to directory enquiry information and full electoral roll information, derived from the 2001 Electoral Roll. The Information Commissioner received 1,600 complaints about B4U's activities and, in response to these, issued its enforcement notice. This required B4U to cease all use of the 2001 Electoral Roll with effect from 1 August. However, B4U seems set to fight the Commissioner's enforcement notice and, on 28 July, lodged a notice of appeal with the Information Tribunal.
Law relating to use of the Electoral Roll
The Representation of the People (England & Wales) (Amendment) Regulations 2002 introduced two versions of the electoral roll. The Regulations created an "edited" register - individuals details are not included in the edited register if they opt-out. The edited register is available for general sale without restriction. The Regulations provided that the full register may only be used by specified organisations for specified purposes. The Regulations were introduced following the case of R v Wakefield Metropolitan Council and the Secretary of State for the Home Department (ex parte Brian Robertson). This case held that it was unlawful for individuals to be compelled to provide their details for inclusion in the electoral register on penalty of a criminal conviction, when that information could then be sold to commercial organisations without any restrictions on reuse. Such a system breached Mr Robertson's rights under Article 8 (privacy) of the European Convention on Human Rights and Article 3 of the First Protocol (the right to participate in free elections).
The Regulations only allowed people to opt-out of the full register from 2002 onwards. However, the Information Commissioner's view, confirmed in guidance issued shortly after the Robertson decision, was that organisations who carried on using earlier versions of the electoral register for commercial purposes would be likely to breach the Data Protection Act. As the Robertson decision confirmed that the previous arrangements relating to the electoral register interfered with individuals' rights to privacy under Article 8, it is not surprising that the Information Commissioner considered that continued use of these versions of the register would also breach the Data Protection Act.
The Information Commissioner's enforcement notice states that B4U's use of the 2001 Electoral Register is in breach of the first data protection principle (fair and lawful processing).
The enforcement notice follows the principle established by the credit referencing cases decided under the Data Protection act 1984 - that in assessing fairness the dominant consideration is the effect of the processing on individuals.
- it is inherently unfair for individuals to be compelled to provide information on pain of commission of a criminal offence, where that information is then available for resale to commercial organisations without any restriction on reuse;
- it is unfair to undermine the express wishes of individuals who have opted out as part of the scheme introduced by the 2002 Regulations, by continuing to make earlier data freely available on a website.
Schedule 2 Preconditions
The enforcement notice also concludes that B4U could not satisfy any of the preconditions for processing personal data in Schedule 2 of the Act. The only condition which could possibly be relevant is that in paragraph 6 - i.e. that the processing
"is necessary for the purposes of legitimate interests pursued by the data controller ...except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject".
This condition requires the interests of the data controller to be balanced with those of the individual. In this case, the Commissioner concluded that B4U could make use of the most recent (edited) electoral register or data from other legitimate sources to provide its services. Use of the full electoral register would, as already stated, be unfair. In addition, disclosure of address details from the full register could cause problems for individuals in sensitive occupations and industries. A number of the complaints received by the Commissioner were from serving police and prison officers.
The Commissioner also considered, as he is obliged to do under Section 40(2) when serving an enforcement notice, that B4U's activities had likely caused damage or damage and distress to individuals.
The enforcement notice gave B4U until 1 August to cease making electoral register data available to the public via its website. This deadline has now been lifted pending the outcome of the appeal.