The individual complained to the Information Commissioner's Office (ICO), which issued an enforcement notice in January 2018, telling Magnacrest to respond to the subject access request.
Magnacrest still failed to do so and the ICO brought a criminal prosecution under the Data Protection Act 1998, due to the time that the breach of the law occurred. The developer pleaded guilty and was fined £300, with a £30 victim surcharge, on 6 February 2019.
Although the penalty may seem relatively small, the victim is still entitled to bring a civil claim for damages for breach of the Data Protection Act, which could result in Magnacrest having to pay a much higher sum to the victim.
The new Data Protection Act 2018, which brings into force the GDPR, has strengthened individuals' rights to access their own personal information. The case would be likely to result in a similar or higher liability under the new legislation.