Posted: 07th Jul, 2011 By: MarkJ

The boss of defunct solicitors firm ACS:Law UK,
Andrew Crossley, looks set to escape the
Information Commissioner's Office (ICO) paltry
£800 fine for last year's massive personal data leak (
here) because he was officially
declared bankrupt by the London High Court in May 2011 (
original news).
A failed attempt to recover ACS:Law's website last year, which had previously been taken offline by a
Distributed Denial-of-Service (DDoS) attack (
here), resulted in at least 6,000 private customer records from several major broadband ISPs ( e.g. Sky Broadband and PlusNet ) being leaked online.
An investigation by the ICO, which would normally impose a "
monetary penalty of £200,000" for such a breach, found
serious flaws in ACS:Law's IT security system and blamed Crossley for the situation. The ICO then
reduced its fine to just £800 because ACS:Law had ceased trading and Crossley was deemed to be of "
limited means," despite living in luxury (
here).
It's now emerged, through a Q&A session on the ICO's Annual Report 2010/11, that Crossley might not have to pay even one penny of the fine.
Q4. Of the civil penalties issued so far which authorities/organisations paid within the time scale to attract the discount?
[ICO] All of them apart from ACS law who were subject to a bankruptcy order and thus not able to pay within the time scale to attract the discount.
An ICO spokesperson has since told PC Pro that ACS:Law was being divided up among a "
long list of creditors", of which they were at the bottom. Anybody with experience of such situations will know that the
ICO is now highly unlikely to see any of that money.
ACS:Law made its living by "
bullying" customers of UK ISPs, specifically those whom they "
suspected" of being involved with "
illegal"
internet copyright infringement via public P2P (BitTorrent) file sharing networks, into paying hefty fines. The claims were often based upon unreliable IP address evidence, which didn't stand up in the courts.
Meanwhile Crossley is currently going through proceedings at the
Solicitors Disciplinary Tribunal (SDT) over his alleged misconduct (
here). He also faces a
Wasted Costs claim of £90,000, which follows a failed attempt to sue 27 individual ISP customers, although it's unclear whether or not this will now be settled out of court; a decision is expected either today or within the next few days.