Andrew Crossley acted negligently says ICO as it fines him £1,000

Andrew Crossley, the owner of the now defunct solicitors firm ACS Law has been fined £1,000 by the Information Commissioner's Office (ICO) for negligence.

But by winding up his company, he has managed to escape a more punitive measure of a £200,000 fine for failing to keep people's information secure.

ACS Law was subjected to an online attack last September. Emails sent to and from the company plus the sensitive personal details of around 6,000 people the firm had accused of being illegal file sharers were published. Mr Crossley's defence afterwards was that he was the victim of a criminal offence.

But Christopher Graham, the Information Commissioner said Crossley's security measures to keep people's details secure "were barely fit for purpose in a person's home environment, let alone a business handling such sensitive details".

Mr Crossley, who acted as the solicitor for Media Cat, embroiled 27 people in a lawsuit at the end of last year for allegedly illegally downloading porn films.

The files containing people's personal details were published on a website and included distressing emails to ACS Law from people it had accused of illegal file sharing.

Other personal details included people's internet service provider account details, their names and addresses and their IP addresses and information about the content they were alleged to have illegally copied.

Some of the emails also included people's credit card details, as well as references to their sex life, health and financial status.

"This case proves that a company's failure to keep information secure can have disastrous consequences. Sensitive personal details relating to thousands of people were made available for download to a worldwide audience and will have caused them embarrassment and considerable distress.

"As Mr Crossley was a sole trader it falls on the individual to pay the fine. Were it not for the fact that ACS Law has ceased trading so that Mr Crossley now has limited means, a monetary penalty of £200,000 would have been imposed, given the severity of the breach," said Mr Graham.

The ICO said that the firm should have been aware of its obligations under the Data Protection Act, but "continued to act negligently and failed to ensure that appropriate technical and organisational measures were in place to keep personal information secure."

Meanwhile Crossley's woes are not over. He is also facing further legal action. Ralli, the solicitors for some of the defendants in the case taken to the Patent Court is asking for wasted costs. He is also under investigation by the Solicitors Regulation Authority.