The British Pregnancy Advisory Service has decided not to appeal against a £200,000 fine imposed by the Information Commissioner’s Office over a security flaw on its website, because it would be too expensive.
In a report published last month, the ICO said details of nearly 10,000 people were stored unnecessarily on the website of the pregnancy and abortion charity and that an anti-abortion hacker was able to gain access to all their information in 2012.
The ICO handed its judgment to BPAS on 28 February, published the decision on 7 March and gave the charity until 31 March to appeal against the fine itself or the size of the fine in the information rights tribunal.
The charity said last month that it was horrified by the size of the fine and would appeal in an attempt to have it reduced.
But it has since taken up the option of paying the fine by 31 March with a 20 per cent discount, meaning it came to £160,000. This is a standard option the ICO gives to all the organisations it fines, and means the right to appeal is surrendered.
"We’re not going to lodge an appeal because we can’t afford it, basically," said a spokeswoman for the charity, citing the cost of going through an appeal and the loss of the £40,000 discount should it proceed.
She said that the ICO had been unhelpful throughout the charity’s dealings with the regulator. "Because of how obstructive it has been, we thought an appeal was very unlikely to be considered fairly," she said.
BPAS has written a letter of complaint to the ICO, submitted with the payment of the fine.
A spokesman for the ICO said: "We can confirm that we’ve received that letter and we are looking into the details." The spokesman pointed out that an appeal would not have been heard by the ICO itself, but by a tribunal.
Lawrie Simanowitz, a partner at law firm Bates Wells Braithwaite who specialises in information law, said he thought that BPAS would have had a good chance of getting its fine reduced on appeal.
"Certainly, while the charity should have known better, I suspect it didn’t know better, and that contrasts with some of the organisations that do know better and more deserve that level of fine," he said.
Simanowitz said: "Even with the 20 per cent reduction it’s a very heavy fine; but I do recognise that this is very sensitive information so I understand why the ICO would wish to take such a punitive stance."