The UK's privacy watchdog is demonstrating that it has real power by shutting down an illegal database of personal information on construction industry workers.
The Information Commissioner's Office (ICO) seized the database in a raid at the Consulting Association in Droitwich, West Midlands.
"This is proof the ICO is far from being a toothless tiger among regulators," says Paula Barrett, partner at international law firm Eversheds.
The database contained sensitive information such as the employment history and trade union activity of construction workers without their consent or knowledge.
The ICO says Consulting Association owner Ian Kerr ran the database for the past 15 years and charged construction firms a £3,000 annual subscription fee.
Kerr charged subscribers for personal details held about individuals to enable subscribers to vet potential employees.
He faces prosecution for breaching the Data Protection Act, which requires data controllers to register and be open about how they process personal information.
The action against Kerr is evidence of proactive enforcement by the ICO and that the watchdog has a range of powers, says Barrett.
Prominent construction firms Balfour Beatty, Sir Robert McAlpine, Taylor Woodrow and Laing O'Rourke are listed among Kerr's past and present subscribers.
David Smith, deputy information commissioner, says the ICO is considering taking action against these construction firms for using the database.
This case highlights a number of key compliance issues and should serve as a cautionary tale against vetting employees in this way, says Barrett.
Vetting should be done only to address specific justifiable risks in an open way with the consent of those involved.
Organisations should select information providers with care, says Barrett, because as users of the information they could be charged under the Data Protection Act.
"Ask questions about how they collect their data. If in doubt, don't use it," she says.
Businesses purchasing vetting information should have a contract that gives assurances that the information is collected in a way that complies with the Data Protection Act.
Those that check suppliers and build guarantees into contracts will reduce the risk being charged under the Data Protection Act as the ICO becomes increasingly proactive.