The Information Commissioner has the power to issue fines of up to £500,000 to organisations that are guilty of a serious breach of the Data Protection Act. The watchdog serves the punishments in 'civil monetary penalty' (CMP) notices which detail organisations' right to appeal against the imposition of the penalty or the amount of the penalty levied on them.
In each case, the Information Commissioner also offers organisations a chance to pay a reduced penalty amount within a defined timeframe in the aftermath of being served with the CMP notices.
Earlier this year, Scottish Borders Council was served with a £250,000 CMP by the Information Commissioner after a firm the Council hired to digitise its employees' pension records failed to dispose of the paper records properly.
Last month the Council announced that it had launched an appeal against the Commissioner's fine, but that it had already paid the discounted penalty of £200,000. The Council said that it had paid the fine to take advantage of the 20% discount the watchdog had offered but that it had "done so with the caveat that [it] still reserved the right to appeal".
However, in a statement the Information Commissioner's Office (ICO) has said that the fact the Council has paid the discounted penalty means the body has lost its right to appeal. The statement was first reported by the Hawktalk information law blog.
"The Commissioner operates an early payment scheme for all civil monetary penalties served," an ICO spokesperson said in a statement. "Under that scheme, a data controller who has been subject to a penalty may obtain a 20% discount if the Commissioner receives the full payment of the penalty within 28 calendar days of the notice being served."
"The objectives of the early payment scheme are to encourage early payment of the penalties and reduce the costs to the public purse entailed on pursuing enforcement action and responding to challenges to the notices. The scheme operated by the Commissioner is similar to that operated by other regulators, such as the Financial Services Authority," the spokesperson added. "There is no provision under the scheme which allows a data controller to make a payment subject to reservations, for example, by reserving his right to appeal against the penalty. The effect of such reservations would be to nullify the advantages which the scheme is intended to achieve."
A spokesperson for the Information Rights Tribunal service told Out-Law.com that a date has not yet been set for the hearing in the case but that the body has a target of holding appeal hearings within 16 weeks of first receiving notice of the appeal. In its statement the Scottish Borders Council said it expects the hearing to take place before the end of January 2013.