(NON-)UPDATE 03.04.21: I’ve still had no response to my complaint on this, after almost four months. I’ve asked the ICO’s Data Protection Officer to escalate it.
(NON-)UPDATE 17.02.21: a couple of people have asked me what the ICO’s response to this was. Good question – and I haven’t had one yet. I had an email at the start of January apologising for the delay in replying, but nothing since then. I’ve chased. END UPDATE
For some time now I’ve wondered how the Information Commissioner’s Office (ICO) complies with data protection law when operating its Facebook page. It’s not a challenge unique to ICO – anyone running a corporate page is likely to be faced with similar challenges. However, as the UK’s supervisory authority under Article 51 of the GDPR (or, from 1 January 2021, under Article 51 of the UK GDPR, the person responsible for monitoring the application of the UK GDPR), the ICO should, understandably, be looked to as an exemplar.
With this in mind, I have raised an enquiry/complaint with the ICO, and will, of course, update this blog when I get a response.
I wish to raise an issue with you regarding your compliance with, at least, Articles 5(1)(a)(b)(c) and (f) of the GDPR.
I note that you operate a Facebook organisation page: https://www.facebook.com/ICOnews (the “ICO Facebook Page”), on which you invite and respond to comments. Following the findings of the Court of Justice of the European Union (CJEU) in Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Case C‑210/16), you are a joint controller with Facebook for the purposes of the processing of – at least – the personal data of those who comment on the ICO Facebook Page (the “Facebook data”). I am one of those.
I also note that in your “ICO Privacy Notice“, you do not state, in respect of your processing of the Facebook data, that you are a controller, although you do, rather cryptically, say “We see all this information [sent to us via social media] and decide how we manage it”, but you otherwise appear to disavow controller status when you say “When contacting the ICO through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.” This is, I would suggest, an abrogation of your obligations under Article 13 GDPR.
Following the findings of the CJEU in Wirtschaftsakademie it can be said that the creation of an organisation page on Facebook involves the definition of parameters by the administrator which has an influence on the processing of personal data for the purpose of, at least, permitting visitor comments or visitor interactions, such as clicking “like” buttons. Consequently, the administrator of a Facebook organisation page such as the ICO Facebook Page contributes to the processing of the personal data of visitors to its page.
I assert that you process, as a controller, my personal data as a person who has commented on the ICO Facebook Page. I also believe that, as a controller, you are involved in the transfer of the Facebook data, which must be taken to include my personal data, to a third country, namely, the United States (Facebook itself says that information controlled by Facebook Ireland (which it sees as the primary controller for the processing of personal data on UK Facebook pages) will be transferred or transmitted to, or stored and processed in, the United States). Facebook appears to effect such transfers by means of standard data protection clauses approved by the European Commission (https://www.facebook.com/help/566994660333381).
Please could you inform me whether:
1) you agree that you are controller (jointly or severally) with Facebook for the processing of my personal data when I comment on your Facebook page?
2) you take the view more generally that you are controller (jointly or severally) with Facebook for the processing of my personal data when I visit your Facebook page (for instance for the processing involved in the placing of cookies and similar technologies)?
3) as a controller (assuming you accept that you are one) you are transferring my personal data out of the EEA?
4) if the answer to 3) is “yes”, how you are complying with conditions laid down in Chapter 5 of GDPR?
I appreciate this might appear to be a flippant or mischievous matter, but I assure you of my good faith and keen interest. I appreciate that ICO has a general task to promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. It would be helpful, when answering this enquiry, if you could say whether you take the view that you cannot adequately perform this task without using Facebook to do so.
The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.
informationrightsandwrongs 