Commissioner Richard Thomas had issued an enforcement notice against B4U, which runs b4usearch.com, a site which contained people's personal and contact information without their permission. B4U did not take the information down by the deadline set in the order, which was 1st August 2006.
Now that the information has been taken down, the ICO is dropping its case, even though an offence was committed during all the time when the information was on the site past 1st August.
"The problem is the lack of follow through because if he doesn't follow through no examples are made," data breach victim Tim Trent told technology law podcast OUT-LAW Radio. "And there are plenty of other people who will use it in a potentially cynical manner and will also see that B4U have not been prosecuted therefore they can do as they please and if someone ever does tell the Information Commissioner about it it's a bit like being told off by your favourite uncle."
The ICO said that it did not see a need for further action. "The company has now complied with the notice and taken down the information that it shouldn't have been using," said an ICO spokeswoman.
"Now that they have complied, looking at it responsibly do we really want to go down the path of prosecuting when they have complied with the Act?," she said.
B4U owner Raj Banga said that he did not know how long after the deadline the information was taken off the website. "I haven't got the exact dates in front of me," Banga told OUT-LAW.
Though neither Banga nor the ICO could confirm exactly when the material was taken down, OUT-LAW understands that it was at least as late as November or even December of last year. Banga did not dispute those dates. The ICO only stopped the investigation this week.
"We complied with them, albeit a few weeks late, which was due to technical difficulties we experienced here," said Banga. "As far as I know we've done our duty and so have they."
Trent said that the view of the ICO investigator who took a statement from him was that an offence had been committed for all of the time that the data was live after 1st August.
"He was of the feeling that an offence had been committed, a substantial offence, and that it was being committed from 1st of August all the way through to when they removed the data," said Trent. "His opinion as an investigator, which obviously is not the opinion of a prosecutor, was that there was a solid case for them to answer."
Trent says that the approach is not good enough, and that the offence has been committed.
"I'd like the traffic police to deal with my speeding tickets that way too, cause if I brought my car to halt then I've been a good boy," said Trent. "B4U have brought their car to a halt so they've obviously been good boys. They can go on without a stain on their character and I'd have three points on my licence and a sixty quid fine."
"I hope organisations wouldn't see us as an organisation that was afraid to prosecute. We do prosecute cases," said the ICO spokeswoman. "We have taken enforcement action, and we have also prosecuted. In this case the company did comply following our action."
