Uncovered: Fraudster profits from data protection fears

A con-artist who masqueraded as a data protection watchdog official to scare UK firms into coughing up for data registration has moved his operation online.

Gary McNeish, director of the Data Protection Act Registration Service, sent an email to hundreds of companies with a warning they face criminal conviction if they fail to register with the Information Commissioner's Office (formerly the Data Protection Commission).

A copy of the email, obtained by silicon.com, reads: 'Subject: £5000 FINE. Data Protection Act 1998.

'Dear Sir or Madam, Failure to notify is a criminal offence. Offences are triable either in the Magistrates' Court or the Crown Court in England or Wales... On conviction an offender is liable to a maximum fine. At present this is £5,000 in the magistrates' and Sheriffs' Court (Scotland) or an unlimited fine in a Crown Court and High Court of Justiciary.'

The Manchester-based company then offers to help firms by registering them for an £85 charge - more than twice the cost of a direct registration with the Commission.

The Data Protection Act 1998 requires companies who hold personal data on customers or partners to register with the Information Commissioner at a cost of £35 per year.

Although acting as a broker in the transaction is not illegal, the Information Commissioner's Office has previously warned McNeish for deliberately misleading companies into believing his letters are official.

Nicolas Tyler, legal advisor at the Commission, said: "We've taken advice from external lawyers about issues like passing off. But there is not sufficient evidence for pursuing the matter in the courts."

The warnings have prompted McNeish to add a disclaimer to the email, pointing out that his company is not attached to the Commission. But officials are still angry about the threatening wording of the message.

"There is considerable concern in the Commission over this," Tyler told silicon.com. "We've placed a statement on our website to make it clear it has nothing to do with us."

silicon.com was unable to contact McNeish or the Data Protection Act Registration Service at the time of publication.