Category Archives: GDPR

Gov says “no” to UK GDPR opt-out actions but…

A post by me on the Mishcon de Reya website – the government has declined to bring into operation Article 80(2) of the (UK) GDPR, but does that mean that the Supreme Court will be more likely to uphold the Court of Appeal judgment in Lloyd v Google?

Leave a comment

Filed under Data Protection, Data Protection Act 2018, DCMS, GDPR, UK GDPR

UK GDPR Resource

My firm Mishcon de Reya have created a version of the UK’s post-Brexit version of GDPR as there isn’t yet an official version. What’s more, we’ve added in links to the Recitals, and made it freely available.

The announcement is here. The actual UK GDPR is here.

Ain’t we kind?

Leave a comment

Filed under Data Protection, GDPR, UK GDPR

ICO and Article 27 representative liability

The ever-entertaining (but more importantly, ever-illuminating) Tim Turner has made available a recording of a webinar he did recently on the subject of representatives under Article 27 of the EU GDPR and the UK GDPR. Such representatives are required to be designated by controllers or processors who are outside the relevant jurisdiction, but who are subject to the extra-territorial provisions of Article 3(2) of EU GDPR or UK GDPR (thus, under Article 27 EU GDPR, a company outside the EU but offering goods or service to, or monitoring the behaviour of, data subjects in the EU, must appoint a representative in the EU, and under Article 27 UK GDPR, a company outside the UK but offering goods or service to, or monitoring the behaviour of, data subjects in the UK, must appoint a representative in the UK).

Tim’s webinar deals, in part, with what is expected of representatives, but also touches on their potential liability, and he points to – but doesn’t actually address – a remarkable assertion on the website of the Information Commissioner’s Office (ICO)

The EDPB’s view is that supervisory authorities are able to initiate enforcement action (including fines) against a representative in the same way as they could against the controller or processor that appointed them.

I describe this as remarkable, because it seems to completely misrepresent the guidance (of the European Data Protection Board) to which it refers (and links).

The issue of representative liability is an important one – many companies offer a contracted service under which they will act as a representative, and a commercial evaluation of such a service will inevitably need to consider whether being a representative exposes oneself to the possibility of regulatory action. Recital 80 of the EU GDPR and the UK GDPR says “The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor” and much debate is there to be had on what it means. But the EDPB’s view is pretty clear, and it’s nothing like the view attributed to it by the ICO

The GDPR does not establish a substitutive liability of the representative in place of the controller or processor it represents in the Union. It should however be noted that the concept of the representative was introduced precisely with the aim of facilitating the liaison with and ensuring effective enforcement of the GDPR against controllers or processors that fall under Article 3(2) of the GDPR. To this end, it was the intention to enable supervisory authorities to initiate enforcement proceedings through the representative designated by the controllers or processors not established in the Union. This includes the possibility for supervisory authorities to address corrective measures or administrative fines and penalties imposed on the controller or processor not established in the Union to the representative… [emphasis added]

(It goes on to say that a representative will be directly liable only to the extent that it is infringing its direct obligations – namely to provide information to a supervisory authority under Article 58(1)(a) of GDPR, and to maintain a record of processing activities under Article 30.)

Whether the ICO’s assertion represents what it thinks a proper reading of the UK GDPR (including recital 80) should be, is an interesting question. The EDPB is, of course, no part of the UK GDPR regulatory and legal scheme, so ICO is free to disregard its views. What it shouldn’t be free to do though, really, is to attribute to the EDPB a position totally at odds with what the EDPB actually says.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, EDPB, EU representative, GDPR, Information Commissioner, UK GDPR

Start the DSAR countdown (but how?)

A while ago I wrote a piece on the Mishcon de Reya website pointing out that the Information Commissioner’s Office (ICO) had silently changed its guidance on how to calculate the “one month” timescale for responding to a subject access request under the General Data Protection Regulation (or “GDPR” – which is now domestic law in the form of the amended retained version of the GDPR, aka “UK GDPR”).

The nub of that piece was that the ICO (following the legal precedents) was now saying that “You should calculate the time limit from the day you receive the request“. Which was a change from the previous position that “You should calculate the time limit from the day after you receive the request “.

I have noticed, however, that, although the ICO website, in its UK GDPR guidance, maintains that the clock starts from the date of receipt, the guidance on “Law Enforcement Processing” (which relates to processing of personal data by competent authorities for law enforcement purposes under part 3 of the Data Protection Act 2018 (DPA), which implemented the Law Enforcement Directive) states that the time should be calculated

from the first day after the request was received

It’s not inconceivable (in fact I am given to understand it is relatively common) that a some controllers might receive a subject access request (or other data subject request) which must be dealt with under both the UK GDPR and the Law Enforcement Processing provisions (police forces are a good example of this). The ICO’s position means that the controller must calculate the response time as starting, on the one hand, on the date of receipt, and, on the other hand, on the day after the date of receipt.

And if all of this sounds a bit silly, and inconsequential, I would argue that it is certainly the former, but not necessarily the latter: failure to comply within a statutory timescale is a breach of a statutory duty, and therefore actionable, at least in principle. If the ICO really does believe that the timescale works differently under different legal schemes, then how, for instance can it properly determine (as it must, when required to) under Articles 57(1)(f) and 77(1) of the UK GDPR, or section 51(2) of the DPA, whether there has been a statutory infringement?

Statutory infringements are, after all, potentially actionable (in this instance either with regulatory action or private action by data subjects) – the ICO maintains a database of complaint cases and publishes some of this (albeit almost two years in arrears), and also uses (or may use) it to identify trends. If ICO finds that a controller has made a statutory infringement, that is a finding of potential significance: if that same finding is based on an unclear, and internally contradictory, interpretation of a key aspect of the law, then it is unlikely to be fair, and unlikely to be lawful.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, GDPR, Information Commissioner, subject access, UK GDPR, Uncategorized

Students challenge International Baccalaureate on data protection grounds

My firm is acting for the students, and there’s a link to the detailed grounds in this explanatory piece.

Leave a comment

Filed under accuracy, Data Protection, fairness, Further education, GDPR, transparency

The problems with GDP are GDP are GDP are…

No one sensible professes that data protection practice is always easy, and discussions around whether the UK will, come 1 January 2021, have or be close to having, an adequacy decision from the European Commission are complex and highly political. However, I hadn’t, until today, encountered the argument that GDPR itself was a barrier to, er, attaining adequacy status.

But that is the remarkable assertion in this recent Diginomica piece:

GDPR Is a European data protection success story, yes? Well, yes…but it could also be a complicating factor in trying to secure a post-Brexit data adequacy deal between the UK and the EU.

It is a complicating factor, I suppose, in the same way that, say, a speed limit is for those who drive too fast.

The reason that an “adequacy deal” is being sought is because GDPR itself says, in Article 45, that the Commission may decide, after taking into account a number of factors, that a third country (such as the UK will become) offers an adequate level of protection for personal data. In the absence of an adequacy decision, GDPR imposes restrictions on the transfer of data to third countries.

GDPR is the reason we are seeking an adequacy deal, not the barrier to it.

Leave a comment

Filed under adequacy, Data Protection, GDPR, international transfers

Litigation disclosure != subject access disclosure

I’m not a lawyer, yet alone a Scottish lawyer, but a recent judgment, on data protection matters, from Sheriff A Cubie in the Glasgow and Strathkelvin Sheriffdom has significance beyond Scotland (and, of course, data protection law – by which we mean the General Data Protection Regulation (GDPR), or from 1 January 2021, the UK GDPR, and the Data Protection Act 2018 (DPA) – apply across the UK).

The issue before the court was whether data protection obligations, which might in general militate against disclosure of personal data, override disclosure obligations in general court proceedings. The basic answer, and one that most data protection practitioners and lawyers understand, is that they don’t. Article 6(1)(c) of the GDPR makes clear that processing is lawful if it is necessary for compliance with a legal obligation to which a controller is subject. More specifically, paragraph 5 of Schedule Two to the DPA says that the bulk of the GDPR provisions conferring rights on data subjects and obligations on controllers simply “do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.”

The Sheriff was faced with a situation [which sounds like a line from a Western] of possible contempt of court by an unnamed Scottish Council in social work referral proceedings concerning children. Upon receipt of an application (in Scottish law, a “motion for specification of documents”), which it had not opposed, the Council had disclosed social work records to solicitors for the mother in the proceedings, but subjected the records (apparently having received internal legal advice) to substantial redaction of personal data, of the sort which would have taken place if the records had been required to be disclosed under an Article 15 subject access request.

The Sheriff “invited” a senior Council officer and someone from its legal department to answer his enquiries as to how the redactions came to be made. At that hearing, it transpired that the disclosure exercise had been passed to the Council’s Data Protection Officer to deal with – that officer had sought advice from the Council’s legal department, which advised that the exercise should be treated as if it was redaction for the purposes of a subject access request. Before the court, the Council apologised unreservedly, and announced that it had begun an internal investigation into how it had happened.

Nothing earth-shattering, and this post is not to suggest that sometimes it might be necessary to redact personal data during litigation disclosure, but an interesting observation about the risks of confusing or conflating disclosure regimes.

And I end by noting that the Sheriff himself fell into error: he cites at several points, subject access provisions from part 3 of the DPA. Part 3 deals with law enforcement processing under Directive 2016/680, and has no relevance here. The subject access right emanates from, and is full described in, Article 15 GDPR.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, GDPR, law enforcement

ICO SAR guidance – open to challenge?

A new piece by me and a colleague on the Mishcon de Reya website, about the ICO’s new SAR guidance https://www.mishcon.com/news/ico-guidance-on-subject-access-requests

A couple of NB points where this guidance differs from the draft version:

ICO suggests one of the factors to take into account when deciding whether a request is excessive is “Whether refusing to provide the information or even acknowledging it is held may cause substantive damage to the individual”. To me, this is pretty extraordinary, and might have the effect of putting the requester to proof as to damage caused by non-compliance.

ICO also has shifted its position, and suggest that staff time perse (rather than disbursements) might be charged for in the event of excessive or manifestly unfounded requests. 

I have my own views on whether these propositions are positive or negative. I suspect though that we will see challenges.

Leave a comment

Filed under access to information, Data Protection, Data Protection Act 2018, GDPR, Information Commissioner

ICO (bizarrely) suggests DPO conflict of interest is criminal offence

*UPDATE, 17.11.20: ICO has now “reissued” its FOI response, saying that there was an error in the original, and that section 31 (dealing, broadly, with prejudice to regulatory functions), rather than section 30, of FOIA applies. If this was a plain example of a typo, I would not have drawn attention, but the original response specifically showed that the author thought that criminality would arise in a case of DPO conflict of interest.

I would add two things. First, the exemption is still questionable in my view – I can’t see how disclosing whether organisations have been investigated regarding DPO conflicts (and if so, the numbers involved) could conceivably cause or be likely to cause prejudice to ICO’s regulatory functions. Second, I raised this, as NADPO chair, as a matter of concern with ICO, but, despite the withdrawal of the offending response, I have heard nothing yet. END UPDATE*

As chair of NADPO* (the National Association of Data Protection and Freedom of Information Officers) I’m understandably interested in information and news about data protection officers (DPOs). In particular, what the Information Commissioner’s Office (ICO) (as the regulatory body most DPOs will interact with) says on this subject will be especially notable.

When I saw that someone had made a Freedom of Information (FOI) request to the ICO about whether the latter had investigated or taken enforcement action against any controllers for reasons relating to potential conflict of interest regarding DPO positions, I was intrigued to see what the response would be (I knew no fines had been issued, but I wanted to know how many investigations might have taken place – indeed, I had blogged about the ICO’s own DPO role a few months previously).

However, the ICO’s response to the FOI request is, let’s say, odd. They have refused to disclose (in fact, have refused even to confirm or deny whether they hold) the requested information, citing the FOI exemption that applies to information held for the purposes of investigations into whether someone should be charged with a criminal offence: remarkably, the ICO seems to think that a conflict of interest such as envisaged by Article 38(6) of the General Data Protection Regulation (GDPR) would amount to a criminal offence – “it is likely that, if proven, an offence under the DPA [Data Protection Act 2018] may have been committed”. This cannot be the case though – there are no offence provisions under the DPA which come close to criminalising a potential conflict of interest regarding a DPO role, and it would be extraordinary if parliament had decided to make it an offence.

Why the ICO should suggest that there are such provisions is not at all clear, and – if it is not just a stray error – might indicate a rather worrying lack of understanding of both data protection and FOI law.

One final point to note – even the part of the FOI response which didn’t mistakenly assume criminal law provisions were engaged, said, in respect of the part of the request which asked for any information the ICO holds “to assist public authorities protect [sic] against a conflict of interest with the role of the DPO”, that staff at the ICO had been consulted and “there is no information held”. However, on the ICO’s website, in plain view, is guidance on the subject (admittedly not in any detail, but clearly in scope of this request).

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

*I notice that the cookie notice on the NADPO site has somehow slipped into error – I am on the blower to our webdev as we speak.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, DPO, Freedom of Information, GDPR, Information Commissioner, Uncategorized

One third of personal data breaches reported “late” to ICO

By me, on the Mishcon de Reya website.

…a recent request to the ICO under the Freedom of Information Act 2000 (FOIA) has revealed that, from the available data, of the 21705 personal data breaches notified to the ICO since May 2018, 14,365 were notified within 72 hours, and 7340 were not – meaning that approximately one third of personal data breaches are reported later than within 72 hours

Leave a comment

Filed under Breach Notification, Data Protection, data security, GDPR, Information Commissioner