As far as I know the Information Commissioner has never investigated this issue (I’ve made an FOI request to find out more), but this, on the Mishcon site, is an overview of the key issue.
Category Archives: Data Protection
My firm is acting for the students, and there’s a link to the detailed grounds in this explanatory piece.
(NON-)UPDATE 03.04.21: I’ve still had no response to my complaint on this, after almost four months. I’ve asked the ICO’s Data Protection Officer to escalate it.
(NON-)UPDATE 17.02.21: a couple of people have asked me what the ICO’s response to this was. Good question – and I haven’t had one yet. I had an email at the start of January apologising for the delay in replying, but nothing since then. I’ve chased. END UPDATE
For some time now I’ve wondered how the Information Commissioner’s Office (ICO) complies with data protection law when operating its Facebook page. It’s not a challenge unique to ICO – anyone running a corporate page is likely to be faced with similar challenges. However, as the UK’s supervisory authority under Article 51 of the GDPR (or, from 1 January 2021, under Article 51 of the UK GDPR, the person responsible for monitoring the application of the UK GDPR), the ICO should, understandably, be looked to as an exemplar.
With this in mind, I have raised an enquiry/complaint with the ICO, and will, of course, update this blog when I get a response.
I wish to raise an issue with you regarding your compliance with, at least, Articles 5(1)(a)(b)(c) and (f) of the GDPR.
I note that you operate a Facebook organisation page: https://www.facebook.com/ICOnews (the “ICO Facebook Page”), on which you invite and respond to comments. Following the findings of the Court of Justice of the European Union (CJEU) in Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Case C‑210/16), you are a joint controller with Facebook for the purposes of the processing of – at least – the personal data of those who comment on the ICO Facebook Page (the “Facebook data”). I am one of those.
I also note that in your “ICO Privacy Notice“, you do not state, in respect of your processing of the Facebook data, that you are a controller, although you do, rather cryptically, say “We see all this information [sent to us via social media] and decide how we manage it”, but you otherwise appear to disavow controller status when you say “When contacting the ICO through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.” This is, I would suggest, an abrogation of your obligations under Article 13 GDPR.
Following the findings of the CJEU in Wirtschaftsakademie it can be said that the creation of an organisation page on Facebook involves the definition of parameters by the administrator which has an influence on the processing of personal data for the purpose of, at least, permitting visitor comments or visitor interactions, such as clicking “like” buttons. Consequently, the administrator of a Facebook organisation page such as the ICO Facebook Page contributes to the processing of the personal data of visitors to its page.
I assert that you process, as a controller, my personal data as a person who has commented on the ICO Facebook Page. I also believe that, as a controller, you are involved in the transfer of the Facebook data, which must be taken to include my personal data, to a third country, namely, the United States (Facebook itself says that information controlled by Facebook Ireland (which it sees as the primary controller for the processing of personal data on UK Facebook pages) will be transferred or transmitted to, or stored and processed in, the United States). Facebook appears to effect such transfers by means of standard data protection clauses approved by the European Commission (https://www.facebook.com/help/566994660333381).
Please could you inform me whether:
1) you agree that you are controller (jointly or severally) with Facebook for the processing of my personal data when I comment on your Facebook page?
2) you take the view more generally that you are controller (jointly or severally) with Facebook for the processing of my personal data when I visit your Facebook page (for instance for the processing involved in the placing of cookies and similar technologies)?
3) as a controller (assuming you accept that you are one) you are transferring my personal data out of the EEA?
4) if the answer to 3) is “yes”, how you are complying with conditions laid down in Chapter 5 of GDPR?
I appreciate this might appear to be a flippant or mischievous matter, but I assure you of my good faith and keen interest. I appreciate that ICO has a general task to promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. It would be helpful, when answering this enquiry, if you could say whether you take the view that you cannot adequately perform this task without using Facebook to do so.
The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.
No one sensible professes that data protection practice is always easy, and discussions around whether the UK will, come 1 January 2021, have or be close to having, an adequacy decision from the European Commission are complex and highly political. However, I hadn’t, until today, encountered the argument that GDPR itself was a barrier to, er, attaining adequacy status.
But that is the remarkable assertion in this recent Diginomica piece:
GDPR Is a European data protection success story, yes? Well, yes…but it could also be a complicating factor in trying to secure a post-Brexit data adequacy deal between the UK and the EU.
It is a complicating factor, I suppose, in the same way that, say, a speed limit is for those who drive too fast.
The reason that an “adequacy deal” is being sought is because GDPR itself says, in Article 45, that the Commission may decide, after taking into account a number of factors, that a third country (such as the UK will become) offers an adequate level of protection for personal data. In the absence of an adequacy decision, GDPR imposes restrictions on the transfer of data to third countries.
GDPR is the reason we are seeking an adequacy deal, not the barrier to it.
I’m not a lawyer, yet alone a Scottish lawyer, but a recent judgment, on data protection matters, from Sheriff A Cubie in the Glasgow and Strathkelvin Sheriffdom has significance beyond Scotland (and, of course, data protection law – by which we mean the General Data Protection Regulation (GDPR), or from 1 January 2021, the UK GDPR, and the Data Protection Act 2018 (DPA) – apply across the UK).
The issue before the court was whether data protection obligations, which might in general militate against disclosure of personal data, override disclosure obligations in general court proceedings. The basic answer, and one that most data protection practitioners and lawyers understand, is that they don’t. Article 6(1)(c) of the GDPR makes clear that processing is lawful if it is necessary for compliance with a legal obligation to which a controller is subject. More specifically, paragraph 5 of Schedule Two to the DPA says that the bulk of the GDPR provisions conferring rights on data subjects and obligations on controllers simply “do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.”
The Sheriff was faced with a situation [which sounds like a line from a Western] of possible contempt of court by an unnamed Scottish Council in social work referral proceedings concerning children. Upon receipt of an application (in Scottish law, a “motion for specification of documents”), which it had not opposed, the Council had disclosed social work records to solicitors for the mother in the proceedings, but subjected the records (apparently having received internal legal advice) to substantial redaction of personal data, of the sort which would have taken place if the records had been required to be disclosed under an Article 15 subject access request.
The Sheriff “invited” a senior Council officer and someone from its legal department to answer his enquiries as to how the redactions came to be made. At that hearing, it transpired that the disclosure exercise had been passed to the Council’s Data Protection Officer to deal with – that officer had sought advice from the Council’s legal department, which advised that the exercise should be treated as if it was redaction for the purposes of a subject access request. Before the court, the Council apologised unreservedly, and announced that it had begun an internal investigation into how it had happened.
Nothing earth-shattering, and this post is not to suggest that sometimes it might be necessary to redact personal data during litigation disclosure, but an interesting observation about the risks of confusing or conflating disclosure regimes.
And I end by noting that the Sheriff himself fell into error: he cites at several points, subject access provisions from part 3 of the DPA. Part 3 deals with law enforcement processing under Directive 2016/680, and has no relevance here. The subject access right emanates from, and is full described in, Article 15 GDPR.
I’ve written a piece for OpenDemocracy questioning the legality of the government’s practice of circulating some FOI requesters’ names across all departments.
A new piece by me and a colleague on the Mishcon de Reya website, about the ICO’s new SAR guidance https://www.mishcon.com/news/ico-guidance-on-subject-access-requests
A couple of NB points where this guidance differs from the draft version:
ICO suggests one of the factors to take into account when deciding whether a request is excessive is “Whether refusing to provide the information or even acknowledging it is held may cause substantive damage to the individual”. To me, this is pretty extraordinary, and might have the effect of putting the requester to proof as to damage caused by non-compliance.
ICO also has shifted its position, and suggest that staff time perse (rather than disbursements) might be charged for in the event of excessive or manifestly unfounded requests.
I have my own views on whether these propositions are positive or negative. I suspect though that we will see challenges.
*UPDATE, 17.11.20: ICO has now “reissued” its FOI response, saying that there was an error in the original, and that section 31 (dealing, broadly, with prejudice to regulatory functions), rather than section 30, of FOIA applies. If this was a plain example of a typo, I would not have drawn attention, but the original response specifically showed that the author thought that criminality would arise in a case of DPO conflict of interest.
I would add two things. First, the exemption is still questionable in my view – I can’t see how disclosing whether organisations have been investigated regarding DPO conflicts (and if so, the numbers involved) could conceivably cause or be likely to cause prejudice to ICO’s regulatory functions. Second, I raised this, as NADPO chair, as a matter of concern with ICO, but, despite the withdrawal of the offending response, I have heard nothing yet. END UPDATE*
As chair of NADPO* (the National Association of Data Protection and Freedom of Information Officers) I’m understandably interested in information and news about data protection officers (DPOs). In particular, what the Information Commissioner’s Office (ICO) (as the regulatory body most DPOs will interact with) says on this subject will be especially notable.
When I saw that someone had made a Freedom of Information (FOI) request to the ICO about whether the latter had investigated or taken enforcement action against any controllers for reasons relating to potential conflict of interest regarding DPO positions, I was intrigued to see what the response would be (I knew no fines had been issued, but I wanted to know how many investigations might have taken place – indeed, I had blogged about the ICO’s own DPO role a few months previously).
However, the ICO’s response to the FOI request is, let’s say, odd. They have refused to disclose (in fact, have refused even to confirm or deny whether they hold) the requested information, citing the FOI exemption that applies to information held for the purposes of investigations into whether someone should be charged with a criminal offence: remarkably, the ICO seems to think that a conflict of interest such as envisaged by Article 38(6) of the General Data Protection Regulation (GDPR) would amount to a criminal offence – “it is likely that, if proven, an offence under the DPA [Data Protection Act 2018] may have been committed”. This cannot be the case though – there are no offence provisions under the DPA which come close to criminalising a potential conflict of interest regarding a DPO role, and it would be extraordinary if parliament had decided to make it an offence.
Why the ICO should suggest that there are such provisions is not at all clear, and – if it is not just a stray error – might indicate a rather worrying lack of understanding of both data protection and FOI law.
One final point to note – even the part of the FOI response which didn’t mistakenly assume criminal law provisions were engaged, said, in respect of the part of the request which asked for any information the ICO holds “to assist public authorities protect [sic] against a conflict of interest with the role of the DPO”, that staff at the ICO had been consulted and “there is no information held”. However, on the ICO’s website, in plain view, is guidance on the subject (admittedly not in any detail, but clearly in scope of this request).
The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.
*I notice that the cookie notice on the NADPO site has somehow slipped into error – I am on the blower to our webdev as we speak.
By me, on the Mishcon de Reya website.
…a recent request to the ICO under the Freedom of Information Act 2000 (FOIA) has revealed that, from the available data, of the 21705 personal data breaches notified to the ICO since May 2018, 14,365 were notified within 72 hours, and 7340 were not – meaning that approximately one third of personal data breaches are reported later than within 72 hours
When data protection law (e.g. Chapter V of the General Data Protection Regulation (GDPR) and Article 25 of the prior Data Protection Directive) talks about a “transfer” of personal data to a third country, no one quite knows what it means: “transfer” is not defined. There’s been a fair bit of legal and academic discussion about this.
But, as far back as 2002 it has been established law that, if I upload personal data onto an internet page, so that that data becomes accessible to people outside the EU, this does not constitute a transfer of data to a third country. The Court of Justice of the European Union held so, in the case of Lindqvist (C-101/01), pointing out that, if that were the case
every time that personal data are loaded onto an internet page, that transfer would necessarily be a transfer to all the third countries where there are the technical means needed to access the internet
with the result that, if even one third country in the world did not ensure adequate protection of personal data, EU Member States – following, as they must, EU data protection law – would be obliged to prevent any personal data being placed on the internet. As a matter of public policy, and indeed of common sense, that could not have been the intention of the legislator.
But notably (and oddly, given its generally relaxed approach to international transfer issues) the Information Commissioner’s Office (ICO), eighteen years on from Lindqvist appears to take an opposing view, saying
Putting personal data on to a website will often result in a restricted transfer. The restricted transfer takes place when someone outside the EEA accesses that personal data via the website…If you load personal data onto a UK server which is then available through a website, and you plan or anticipate that the website may be accessed from outside the EEA, you should treat this as a restricted transfer.
Which is all well and good, but, if that is indeed the case, then how does ICO find a basis in Chapter V of GDPR for its transfer of my personal data (and others’) to, say, Syria, or South Sudan, or Cambodia, or anywhere else in the world? There is no adequacy decision in place, (presumably) no standard contractual clauses or other appropriate safeguards, and no apparent Article 49 derogation. Is this, then, an unlawful transfer?
I’m just mightily relieved we haven’t got some bizarre constitutional crisis on the immediate horizon, under which these issue are going to get even more complex.