Category Archives: Information Commissioner

ICO statutory duty to promote economic growth

From time to time I can be a bit critical of the Information Commissioner’s Office (ICO). Indeed, in the past I may have criticised them for appearing to promote things or exercise their functions in a way that exceeded what their core role is. For instance, I may have queried why they frequently appear to be cheer-leading for innovation and digital economic expansion (not that I think those things are inherently to be avoided).

But it’s important to note that their functions are not limited to regulation of specific laws. Rather, under section 108 of the Deregulation Act 2015, and (made under that Act) The Economic Growth (Regulatory Functions) Order 2017, the ICO, as well as a host of other regulators, has a statutory duty to exercise her regulatory functions (other than those under FOIA, interestingly) with regard to the desirability of promoting economic growth. In particular, she has to consider the importance for the promotion of economic growth of exercising the regulatory function in a way which ensures that regulatory action is taken only when it is needed, and any action taken is proportionate.

Additionally, under section 110 of the Deregulation Act 2015 ICO (and other regulators) must also have regard to this guidance: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/603743/growth-duty-statutory-guidance.pdf

When people (again, I should include myself) question, for instance, the paucity in the UK of low-level GDPR fines for low-level infringements, they should take into account these provisions.

Whether this aspect of the Deregulation Act 2015 is actually reconcilable with the provisions of the GDPR (and, now, the UK GDPR) is a separate question. In principle, there need not be a clash between the promotion of economic growth and the regulation of compliance with the duty to observe the fundamental right to protection of personal data, but in practice, such clashes tend to occur.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Information Commissioner, Uncategorized

Dashcams and domestic purposes

What do people use dashcams and cameras on cycle helmets for? I’m sure that some (especially in the latter group) use them to capture footage of interesting journeys they have made. But a considerable proportion of users – surely – use them in the event that the user is involved in a road traffic incident. Indeed the “National Dash Cam Safety Portal”, although provided by a commercial organisation selling cameras, is operated in partnership with, and enables upload of footage to, police forces in England and Wales, and its FAQ clearly inform people of the evidential nature and implications of such footage. And a recent piece on the “Honest John” website suggests that one in four dashcam submissions result in a prosecution. Whatever the intentions were of the people who used those dashcams to record that footage, it is undeniable that the outcome of the processing of personal data involved had a significant effect on the rights of those whose data was processed.

Article 2 of the UK GDPR says that the law’s scope does not extend to processing of personal data “by a natural person in the course of a purely personal or household activity”, and the case law of the Court of Justice of the European Union (at least insofar as such case law decided before 1 January 2021 is retained domestic law – unless departed from by the Court of Appeal or the Supreme Court) makes clear that use of recording cameras which capture footage containing personal data outwith the orbit of one’s property cannot claim this “purely personal or household activity” exemption (see, in particular the Ryneš case).

Yet the position taken by the authorities in the UK (primarily by the Information Commissioner’s Office (ICO)) largely fails to address the difficult issues arising. Because if the use of dashcams and helmet cams, when they result in the processing of personal data which is not exempt under under the “purely personal and household exemption, is subject to data protection law, then those operating them are, in principle at least, obliged to comply with all the relevant provisions of the UK GDPR, including: compliance with the Article 5 principles; providing Article 13 notices to data subjects; complying with data subject request for access, erasure, etc. (under Articles 15, 17).

But the ICO, whose CCTV guidance deals well with the issues to the extent that domestic CCTV is in issue, implies that use of dashcams etc, except in a work context, is not subject to the UK GDPR. For instance, its FAQs on registering as a data protection fee payer say “the use of the dashcam in or on your vehicle for work purposes will not be considered as ‘domestic’ and therefore not exempt from data protection laws”. It is very difficult to reconcile the ICO’s position here with the case law as exemplified in Ryneš.

And what raises interesting questions for me is the evidential status of this dashcam and helmet cam footage, when used in prosecutions. Although English law has traditionally tended to take the approach that evidence should be admitted where it is relevant, rather than excluding it on the grounds that it has been improperly obtained (the latter being a species of the US “fruit of the poisoned tree” doctrine), it is surely better for a court not to be faced with a situation where evidence may have been obtained in circumstances involving illegality.

If this was a passing issue, perhaps there would not need to be too much concern. However, it is clear that use of mobile video recording devices (and use of footage in criminal, and indeed civil, proceedings) is increasing and will continue to do so, at the same time as access to such devices, and the possibility for their covert or surreptitious use, also increases. It is, no doubt, a tremendously tricky area to regulate, or event to contemplate regulating, but that is no reason for the ICO to duck the issue.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under CCTV, crime, Data Protection, Information Commissioner, police

Start the DSAR countdown (but how?)

A while ago I wrote a piece on the Mishcon de Reya website pointing out that the Information Commissioner’s Office (ICO) had silently changed its guidance on how to calculate the “one month” timescale for responding to a subject access request under the General Data Protection Regulation (or “GDPR” – which is now domestic law in the form of the amended retained version of the GDPR, aka “UK GDPR”).

The nub of that piece was that the ICO (following the legal precedents) was now saying that “You should calculate the time limit from the day you receive the request“. Which was a change from the previous position that “You should calculate the time limit from the day after you receive the request “.

I have noticed, however, that, although the ICO website, in its UK GDPR guidance, maintains that the clock starts from the date of receipt, the guidance on “Law Enforcement Processing” (which relates to processing of personal data by competent authorities for law enforcement purposes under part 3 of the Data Protection Act 2018 (DPA), which implemented the Law Enforcement Directive) states that the time should be calculated

from the first day after the request was received

It’s not inconceivable (in fact I am given to understand it is relatively common) that a some controllers might receive a subject access request (or other data subject request) which must be dealt with under both the UK GDPR and the Law Enforcement Processing provisions (police forces are a good example of this). The ICO’s position means that the controller must calculate the response time as starting, on the one hand, on the date of receipt, and, on the other hand, on the day after the date of receipt.

And if all of this sounds a bit silly, and inconsequential, I would argue that it is certainly the former, but not necessarily the latter: failure to comply within a statutory timescale is a breach of a statutory duty, and therefore actionable, at least in principle. If the ICO really does believe that the timescale works differently under different legal schemes, then how, for instance can it properly determine (as it must, when required to) under Articles 57(1)(f) and 77(1) of the UK GDPR, or section 51(2) of the DPA, whether there has been a statutory infringement?

Statutory infringements are, after all, potentially actionable (in this instance either with regulatory action or private action by data subjects) – the ICO maintains a database of complaint cases and publishes some of this (albeit almost two years in arrears), and also uses (or may use) it to identify trends. If ICO finds that a controller has made a statutory infringement, that is a finding of potential significance: if that same finding is based on an unclear, and internally contradictory, interpretation of a key aspect of the law, then it is unlikely to be fair, and unlikely to be lawful.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, GDPR, Information Commissioner, subject access, UK GDPR, Uncategorized

Windrush and data protection

As far as I know the Information Commissioner has never investigated this issue (I’ve made an FOI request to find out more), but this, on the Mishcon site, is an overview of the key issue.

Leave a comment

Filed under accuracy, adequacy, Data Protection, fairness, Home Office, human rights, Information Commissioner

FOI 101 on “held”

I note that the First-tier Tribunal has recently had to school the Information Commissioner’s Office (ICO) on one of the real basics of the Freedom of Information Act (FOIA).

A request had been made to the Parliamentary and Health Service Ombudsman (PHSO) for past versions of a Joint Working Team (JWT) Manual setting out how the PHSO and the Local Government and Social Care Ombudsman (LGSCO) should work together. Rather oddly, the PHSO searched for these, and couldn’t find them. More oddly, the PHSO decided that this meant that it didn’t “hold” the information, for the purposes of FOIA (and directed the requester to LGSCO). Even more oddly, the ICO then upheld the PHSO’s refusal, saying

Copies of the JWT manuals are stored on the LGSCO website and the PHSO argue that it has no control over the production of the manual. The Commissioner is therefore satisfied that the PHSO do not hold copies of the JWT manuals published in March and June 2019

I use the word “oddly”, because one of the first thing FOIA practitioners and lawyers learn is that whether information is “held” for the purposes of FOIA turns on two situations – namely, whether

(a)it is held by the authority, otherwise than on behalf of another person, or

(b)it is held by another person on behalf of the authority.

If either of those applies, then information is held.

In this case, as Her Honour Judge Shanks realised very quickly, when the requester appealed the ICO decision to the First-tier Tribunal, surely a joint working manual, setting out “guidance on key processes and on jurisdictional and policy considerations which have been agreed by the two Ombudsmen”, would be held by both offices? And, if copies were not physically held by the PHSO, any copies physically held by the LGSCO would be held on behalf of the PHSO. Furthermore, HH Judge Shanks noted

Indeed, leaving aside any technical arguments I am puzzled as to why the PHSO did not just get hold of the documents from the LGSCO and pass them over to Mr McDougall, thereby saving a great deal of unnecessary time and expense.

The ICO has good guidance for public authorities on this very topic. Let’s hope they refer to it themselves in future similar cases.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Freedom of Information, Information Commissioner, Information Tribunal

ICO SAR guidance – open to challenge?

A new piece by me and a colleague on the Mishcon de Reya website, about the ICO’s new SAR guidance https://www.mishcon.com/news/ico-guidance-on-subject-access-requests

A couple of NB points where this guidance differs from the draft version:

ICO suggests one of the factors to take into account when deciding whether a request is excessive is “Whether refusing to provide the information or even acknowledging it is held may cause substantive damage to the individual”. To me, this is pretty extraordinary, and might have the effect of putting the requester to proof as to damage caused by non-compliance.

ICO also has shifted its position, and suggest that staff time perse (rather than disbursements) might be charged for in the event of excessive or manifestly unfounded requests. 

I have my own views on whether these propositions are positive or negative. I suspect though that we will see challenges.

Leave a comment

Filed under access to information, Data Protection, Data Protection Act 2018, GDPR, Information Commissioner

ICO (bizarrely) suggests DPO conflict of interest is criminal offence

*UPDATE, 17.11.20: ICO has now “reissued” its FOI response, saying that there was an error in the original, and that section 31 (dealing, broadly, with prejudice to regulatory functions), rather than section 30, of FOIA applies. If this was a plain example of a typo, I would not have drawn attention, but the original response specifically showed that the author thought that criminality would arise in a case of DPO conflict of interest.

I would add two things. First, the exemption is still questionable in my view – I can’t see how disclosing whether organisations have been investigated regarding DPO conflicts (and if so, the numbers involved) could conceivably cause or be likely to cause prejudice to ICO’s regulatory functions. Second, I raised this, as NADPO chair, as a matter of concern with ICO, but, despite the withdrawal of the offending response, I have heard nothing yet. END UPDATE*

As chair of NADPO* (the National Association of Data Protection and Freedom of Information Officers) I’m understandably interested in information and news about data protection officers (DPOs). In particular, what the Information Commissioner’s Office (ICO) (as the regulatory body most DPOs will interact with) says on this subject will be especially notable.

When I saw that someone had made a Freedom of Information (FOI) request to the ICO about whether the latter had investigated or taken enforcement action against any controllers for reasons relating to potential conflict of interest regarding DPO positions, I was intrigued to see what the response would be (I knew no fines had been issued, but I wanted to know how many investigations might have taken place – indeed, I had blogged about the ICO’s own DPO role a few months previously).

However, the ICO’s response to the FOI request is, let’s say, odd. They have refused to disclose (in fact, have refused even to confirm or deny whether they hold) the requested information, citing the FOI exemption that applies to information held for the purposes of investigations into whether someone should be charged with a criminal offence: remarkably, the ICO seems to think that a conflict of interest such as envisaged by Article 38(6) of the General Data Protection Regulation (GDPR) would amount to a criminal offence – “it is likely that, if proven, an offence under the DPA [Data Protection Act 2018] may have been committed”. This cannot be the case though – there are no offence provisions under the DPA which come close to criminalising a potential conflict of interest regarding a DPO role, and it would be extraordinary if parliament had decided to make it an offence.

Why the ICO should suggest that there are such provisions is not at all clear, and – if it is not just a stray error – might indicate a rather worrying lack of understanding of both data protection and FOI law.

One final point to note – even the part of the FOI response which didn’t mistakenly assume criminal law provisions were engaged, said, in respect of the part of the request which asked for any information the ICO holds “to assist public authorities protect [sic] against a conflict of interest with the role of the DPO”, that staff at the ICO had been consulted and “there is no information held”. However, on the ICO’s website, in plain view, is guidance on the subject (admittedly not in any detail, but clearly in scope of this request).

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

*I notice that the cookie notice on the NADPO site has somehow slipped into error – I am on the blower to our webdev as we speak.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, DPO, Freedom of Information, GDPR, Information Commissioner, Uncategorized

One third of personal data breaches reported “late” to ICO

By me, on the Mishcon de Reya website.

…a recent request to the ICO under the Freedom of Information Act 2000 (FOIA) has revealed that, from the available data, of the 21705 personal data breaches notified to the ICO since May 2018, 14,365 were notified within 72 hours, and 7340 were not – meaning that approximately one third of personal data breaches are reported later than within 72 hours

Leave a comment

Filed under Breach Notification, Data Protection, data security, GDPR, Information Commissioner

Manhattan (and Syrian) Transfer

When data protection law (e.g. Chapter V of the General Data Protection Regulation (GDPR) and Article 25 of the prior Data Protection Directive) talks about a “transfer” of personal data to a third country, no one quite knows what it means: “transfer” is not defined. There’s been a fair bit of legal and academic discussion about this.

But, as far back as 2002 it has been established law that, if I upload personal data onto an internet page, so that that data becomes accessible to people outside the EU, this does not constitute a transfer of data to a third country. The Court of Justice of the European Union held so, in the case of Lindqvist (C-101/01), pointing out that, if that were the case

every time that personal data are loaded onto an internet page, that transfer would necessarily be a transfer to all the third countries where there are the technical means needed to access the internet

with the result that, if even one third country in the world did not ensure adequate protection of personal data, EU Member States – following, as they must, EU data protection law – would be obliged to prevent any personal data being placed on the internet. As a matter of public policy, and indeed of common sense, that could not have been the intention of the legislator.

But notably (and oddly, given its generally relaxed approach to international transfer issues) the Information Commissioner’s Office (ICO), eighteen years on from Lindqvist appears to take an opposing view, saying

Putting personal data on to a website will often result in a restricted transfer. The restricted transfer takes place when someone outside the EEA accesses that personal data via the website…If you load personal data onto a UK server which is then available through a website, and you plan or anticipate that the website may be accessed from outside the EEA, you should treat this as a restricted transfer.

Which is all well and good, but, if that is indeed the case, then how does ICO find a basis in Chapter V of GDPR for its transfer of my personal data (and others’) to, say, Syria, or South Sudan, or Cambodia, or anywhere else in the world? There is no adequacy decision in place, (presumably) no standard contractual clauses or other appropriate safeguards, and no apparent Article 49 derogation. Is this, then, an unlawful transfer?

I’m just mightily relieved we haven’t got some bizarre constitutional crisis on the immediate horizon, under which these issue are going to get even more complex.

Leave a comment

Filed under Data Protection, GDPR, Information Commissioner

ICO tells ICO off for terrible FOI compliance

As any fule kno, a public authority has to comply with a Freedom of Information Act 2000 (FOIA) request within 20 working days. Where the authority fails to do so, the requester can ask the Information Commissioner’s Office (ICO) to issue a decision notice.

And so, here we have a newly published decision where the ICO is telling itself that it has overshot the twenty working day limit by almost seven months:

“it is clear that, in failing to issue a full response to this request within 20 working days, the ICO has breached section 10 of the FOIA.”

Unsurprisingly, the ICO doesn’t appear to be taking enforcement action against itself. Surprisingly, though, there seems to be no indication in the notice itself that this is an extraordinary, and extraordinarily poor, state of affairs.

I’d like to imagine this is single aberration, but it isn’t. On 12 March this year I also made a FOIA request to ICO, and I am still to get a (complete) answer. And only a couple of months ago ICO again had to rule against itself, after it took six months to respond to a request.

Leave a comment

Filed under Freedom of Information, Information Commissioner