Gage Skidmorereader comments 10
Share this story
Donald Trump’s controversial luxury golf resort in Aberdeenshire has a chequered history of putting its neighbours’ noses out of joint, but this time, it’s flouted the UK’s data laws by failing—possibly for years—to register with the Information Commissioner’s Office.
The Guardian found that the £30 million resort in north-east Scotland hadn’t been registered under the Data Protection Act, “despite operating an extensive CCTV system and handling data on thousands of golfers and guests, its staff, and suppliers,” potentially putting Trump’s golf resort at risk of being found guilty of a criminal offence and fined.
However, just as the ICO was preparing to write to Trump International Golf Course to remind it of its legal duties, it received registration details, somewhat taking the wind out of the sails of the newspaper’s investigation.
And, despite the Guardian pressing for legal action, a spokesperson for the ICO told Ars: “We were asked whether we would prosecute them retrospectively for having not been registered; we would not,” adding:
Where data controllers respond to advice from the ICO that they need to notify and complete the registration process, it generally would not be a proportionate response to then commence a prosecution.
We treat those that we regulate in a consistent way and to pursue the golf course in these circumstances would be inconsistent to how we have dealt with others in similar circumstances.
The resort itself, which has repeatedly gone to war with environmental campaigners in an effort to block the construction of a nearby off-shore wind farm, and which has upset locals in various other ways—not least by allegedly pointing CCTV cameras at their neighbouring houses—blamed a “clerical” error for its failure to register.
In a statement given to the newspaper, a spokesperson said: “We take the security of our employees and guests’ personal data very seriously and comply with all aspects of the Data Protection Act.
A clerical oversight has just been brought to our attention which is now being rectified.”
According to the Guardian, “Trump’s critics fear the resort could use its CCTV systems to track their and guests’ movements, even though Scotland’s robust right to roam law entitles the public have a legal right to walk across the resort.” The resort’s statement labelled the accusations that it was using CCTV to film its neighbours “unfounded and categorically untrue.”
The ICO told Ars that it would typically only prosecute a business for non-notification if it ignored the watchdog’s subsequent advice, adding: “Where they do not respond to this advice, we will prosecute, and have on several occasions.”
It added that it was unclear how long Trump’s golf course had flouted data protection laws.
It’s possible, we’re told, that the course may have previously outsourced data protection duties to a third party, which means the company—incorporated in late 2005—hadn’t necessarily been the data controller for the past 11 years.
And the firm may have only recently brought control of its data in-house.
It didn’t matter, however, if Trump’s golf course had been lax with data protection laws in the UK for a decade, the ICO confirmed to Ars, because the company has registered with the watchdog now.
This post originated on Ars Technica UK