The Information Commissioner’s Office has issued an enforcement action notice to a Liverpool-based IFA which it said “failed” to provide data to two clients concerning their personal pensions.
Both clients asked Smith, Law & Shepherds IFA for “a copy of all documents, of any kind, which relate to me and my pension”, under the Data Protection Act 2018.
The advice firm, whose client book was acquired by Bolton-based Markland Hill Wealth on January 20, was told it must send the requested data, if in possession of it, to both individuals “by no later” than today (March 16).
An administrator at new owner Markland Hill Wealth told FTAdviser it sent the data on March 7, the same day the ICO published the official notice on its website.
Smith Law & Shepherds IFA appointed an administrator the same day its clients were acquired by Markland Hill Wealth. The acquiring firm told FTAdviser it was not aware of the data issue when it bought the firm's clients, and said it complied immediately with the ICO notice as a matter of "goodwill and good practice".
If Smith, Law & Shepherds IFA had not complied, the ICO would have been able to issue a fine against the firm of up to £17.5mn, or 4 per cent of its annual turnover - whichever was higher.
While one client submitted their initial request for data on April 14, 2020 the other sent their request three days later, on April 17.
This means both clients have waited just shy of two years to receive data relating to their pensions.
During this period, one client waited five months for an ICO case officer to first make contact with the IFA from when they made their complaint, while the other waited six months.
In both instances, the ICO called the firm multiple times to chase the data these clients had requested under the Data Protection Act.
“The case officer was advised that someone would return his call but they did not,” the ICO said, relating to one of these calls.
Citing another, the ICO said: “The case officer ended the call believing that a response would be sent imminently.”
But by December 9, 2021, neither client had received their data from the firm. This prompted the ICO to submit an enforcement action notice.
“In light of the above, the Commissioner is of the view that Smith, Law & Shepherd IFA Ltd has contravened Chapter 3, Article 15 of the GDPR, in that it has failed to inform ‘data subject 1’ and ‘data subject 2’, without undue delay, whether their personal data is being processed by or on behalf of the controller and, where that is the case, has failed without undue delay to provide access, in an intelligible form, to such personal data,” the ICO said in its March 7 notice.
“The Commissioner considers that an enforcement notice would be a necessary and proportionate regulatory step to bring Smith, Law & Shepherd IFA Ltd into compliance.”
According to Companies House, Smith Law & Shepherds IFA's total estimated liabilities sit at £908,592.
