February 23, 2014 · 11:10 am

Conservative Party website – unfair processing?

The Conservative Party website is hosting a survey, but I question whether it complies with data protection and associated laws.

The first principle of the Data Protection Act 1998 (DPA) requires that any processing of personal data be fair (and lawful). If an organisation is collecting data from individuals then the person from whom it is obtained must be told the identity of the data controller, and the purpose or purposes for which the data are intended to be processed. These legal provisions (Schedule 1, DPA) are the source of the privacy notices (sometimes called “fair processing notices”) with which we are all familiar when we, for instance, make purchases, or submit forms, or, indeed, complete online surveys. As the Information Commissioner himself says, in the introduction to the ICO Privacy Notices Code of Practice

As a minimum, a privacy notice should tell people who you are, what you are going to do with their information and who it will be shared with

the Code goes on to stress that

the requirement…is strongest…where the information is sensitive

One of the things that makes personal data “sensitive” is if it consists of information as to a person’s political opinions (section 2(b), DPA) – the reasons for this barely need spelling out, but I would just note that history tells us much about the potential for abuse of information about the political affiliations or inclinations of individuals.

With all this in mind it is concerning to note that the website of the Conservative Party invites people to complete and submit an online survey, which includes, among other things, questions about the political opinions of those completing it, but whose privacy notice consists merely of

By entering your email address you agree to receive communications from us, from which you can opt-out using the “unsubscribe” link in each email we send. We will not share your details with anyone outside the Conservative Party
This is inadequate in a number of ways, but primarily because it gives no indication whatsoever what the purposes for which the (sensitive) data are to be processed. One assumes, noting the reference to receiving emails in the future, that it is for the purposes of marketing (and the ICO has made clear that political parties do engage in marketing).  Failure to gather data fairly will mean that such future marketing use would also be in default breach of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Searching the rest of the website I do see that there is a generic privacy policy, which does refer to “online polls and surveys”, but that merely says that
in addition to your answers, we collect your Internet Protocol (IP) address…[to] to help validate the results and help prevent multiple entries from individuals
It is difficult to imagine that the people responsible for this survey have had regard to the ICO’s invaluable guidance for political parties for campaigning or promotional purposes, which advises, for instance that parties should be
transparent about your use of the individual’s information
In the field of market research there is a practice known as “sugging” which the Association for Qualitative Research describes thus

Sugging (selling under the guise of market research) …[occurs] when organisations building databases, or generating sales leads, claim to be conducting market research

One does wonder if that is what is going on here, but in the absence of an adequate privacy notice, it is not possible to tell.

UPDATE: 23.03.14

It looks like they’ve amended the survey now, with a link to a privacy policy. Whether it’s a coincidence they did so around the time The Independent ran a story on the issue is difficult to say.

Anyway, it seems the ICO is investigating, so watch this space.

2 Comments

Filed under Data Protection, marketing, PECR

Tagged as ,

February 1, 2014 · 10:01 am

Big Pharma and care.data

Patients’ identifiable medical data will end up in the hands of large pharmaceutical companies, under the care.data initiative. With “Big Pharma” beholden to shareholders, and its abysmal record on transparency, is this another reason to consider opting out?

We are often told by those publicly defending the care.data programme (I’m thinking particularly of NHS Chief Data Officer Geraint Lewis, and NHS National Director for Patients and Information Tim Kelsey, who at least are prepared to engage with critics – although the latter has a habit of resorting to personal attacks at times) that patients’ identifiable/amber/pseudonymised data will not be made available to commercial organisations to use for their own purposes. So, we are told, it cannot be used for the purposes of selling or administering any kind of insurance, or for marketing purposes. As the pdf of FAQs, to which we are often referred (by Geraint in particular) says

Potentially identifiable data – these data do not include identifiers but may be considered identifiable (e.g. due to a patient in an area having a rare disease or a rare combination of characteristics). There are strict controls around the limited release of such data. For example, there must be a contract in place, the data are only released to approved organisations, and restricted to a specific purposes that will benefit the health and social care system
Let’s ignore for now the awkward question of how these restrictions can effectively be enforced. Let’s also ignore the fact that this data will not simply be “released” – organisations will pay for it, and a commercial organisation, with fiduciary obligations to its owners or shareholders, is not going to pay for something unless there is potential financial benefit.
What I wanted to highlight is that purposes that will benefit the health and social care system will generally boil down to two things: commissioning of services, and research. Regarding the latter, as the NHS Health Research Authority says this can take many forms, and be undertaken by many different bodies, but it will be no big revelation if I point out that vast amounts of research are conducted by, or under the control of, huge pharmaceutical companies – Big Pharma. Doctor and journalist Ben Goldacre has been campaigning for a number of years, following up the lead of others such as Iain Chalmers to expose the fact that an enormous amount of data and results from research – specifcally, admittedly, of clinical trials – is withheld by Big Pharma. This led to the setting-up of the AllTrials campaign. As Ben said, on the publication of a damning report by the Public Accounts Committee into the withholding of trial results for Tamiflu
[the] report is a complete vindication of AllTrials’ call for all the results, of all the trials, on all the uses of all currently prescribed treatments. None of the proposed new legislation or codes of conduct come anywhere close to this simple, vital ask. Industry has claimed it is on the verge of delivering transparency for over two decades. While obfuscating and delaying, ever more results have been withheld. Some in industry now claim that results from even a decade ago may be lost and inaccessible. This is both implausible and unacceptable…We cannot make informed decisions about which treatment is best when vitally important information is routinely and legally kept secret. Future generations will look back at this absurd situation in the same way that we look back on mediaeval bloodletting
This is the same industry which will be able to purchase patients’ identifiable medical data, uploaded from their GP records for research purposes. Will the NHS ever see the results of this research if, for instance, those results could have a potentially adverse effect on the companies’ share prices? Will there be any legal or contractual mechanisms in place to ensure that we don’t see similar obfuscating and delaying, and withholding of results?
Is it really the insurance and marketing companies we need to worry about?

Leave a comment

Filed under care.data, Confidentiality, data sharing, NHS, Privacy

Tagged as ,

January 31, 2014 · 4:55 pm

The care.data leaflet campaign – legally necessary?

Readers of this blog [sometimes I imagine them1] may well be fed up with posts about care.data (see here, here and here). But this is my blog and I’ll cry if I want to. So…

Doyen of information rights bloggers, Tim Turner, has written in customary analytic detail on how the current NHS care.data leafleting campaign was not necessitated by data protection law, and on how, despite some indications to the contrary, GPs will not be in the Information Commissioner’s firing line if they fail adequately to inform patients about what will be happening to their medical data.

He’s right, of course: where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) then it is not obliged, pace the otherwise very informative blogpost by the Information Commissioner’s Dawn Monaghan, to give data subjects a privacy, or fair processing notice.

(In passing, and in an attempt to outnerd the unoutnerdable, I would point out that Tim omits that, by virtue of The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000, if a data subject properly requests a privacy notice in circumstances where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) and would, thus, otherwise not be required to issue one, the data controller must comply2.)

Tim says, though

The leaflet drop is no way to inform people about such a significant step, but I don’t think it is required

That appears to be true, under data protection law, but, under broader obligations imposed on the relevant authorities under Article 8 of the European Convention on Human Rights (ECHR), as incorporated in domestic law in the Human Rights Act 1998, it might not be so (and here, unlike with data protection law, we don’t have to consider the rigid controller/processor dichotomy in order to decide who the relevant, and liable, public authority is, and I would suggest that NHS England (as the “owner of the care.data programme” in Dawn Monaghan’s words) seems the obvious candidate, but GPs might also be caught).

In 1997 the European Court of Human Rights addressed the very-long-standing concept of the confidentiality of doctor-patient relations, in the context of personal medical data, in Z v Finland (1997) 25 EHRR 371, and said

the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8). Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general…Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community

This, I think, nicely encapsulates why so many good and deep-thinking people have fundamental concerns about care.data.

Now, I am not a lawyer, let alone a human rights lawyer, but it does occur to me that a failure to inform patients about what would be happening with their confidential medical records when GP’s were required to upload them, and a failure to allow them to opt-out, would have potentially infringed patients’ Article 8 rights. We should not forget that, initially, there was no intention to inform patients at all (there had no attempt to inform patients about the similar upload of hospital medical data, which has been going on for over twenty years). It is, surely, possible therefore, that NHS England is not just “helping” GPs to inform patients without having any responsibility to do so (as Dawn Monaghan suggests), but that it recognises its potential vulnerability to an Article 8 challenge, and is trying to avoid or mitigate this. Whether the leaflets themselves, and the campaign to deliver them, are adequate to achieve this aim is another matter. As has been noted, the leaflet contains no opt out form, and there seem to be numerous examples of people (often vulnerable people, for instance in care homes, or refuges) who will have little or no chance of receiving a copy.

At the launch of the tireless MedConfidential campaign last year, Shami Chakrabarti, of Liberty, spoke passionately about the potential human rights vulnerabilities of the care.data programme. Notifying patients of what is proposed might not have been necessary under data protection law, but it is quite possible that the ECHR aspect of doing so was one of the things on which the Health and Social Care Information Centre (HSCIC) has been legally advised. Someone made an FOI request for this advice last year, and it is notable that HSCIC seem never to have completed their response to the request.

1I make no apologies for linking to one of Larkin’s most beautiful, but typically bleak and dystopian, pieces of prose, but I would add that it finishes “…These have I tried to remind of the excitement of jazz, and tell where it may still be found.”

2Unless the data controller does not have sufficient information about the individual in order readily to determine whether he is processing personal data about that individual, in which case the data controller shall send to the individual a written notice stating that he cannot provide the requisite information because of his inability to make that determination, and explaining the reasons for that inability

2 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Europe, human rights, Information Commissioner, NHS, Privacy

Tagged as , ,

January 31, 2014 · 2:54 pm

The Windmills of Mr Cameron

The Prime Minister revealed recently that, when it comes to justifying the introduction of disproportionately intrusive surveillance legislation, he draws comfort from fictional depictions of crime detection:

In the most serious crimes [such as] child abduction communications data… is absolutely vital. I love watching, as I probably should stop telling people, crime dramas on the television. There’s hardly a crime drama where a crime is solved without using the data of a mobile communications device

Although this relevation has drawn some criticism, I think such criticism is unfair. Mr Cameron’s policy approach has a precedent. Hansard shows that, more than forty years ago, his predecessor adopted similarly populist bullshit robust research. Harold Wilson, in a debate on proposed changes to laws regarding investigation of serious crimes

image

is recorded as saying

The Prime Minister: In the most serious crimes a spectral assistant is absolutely vital. I love watching, as I probably should stop telling people, crime dramas on the television. There’s hardly a crime drama where a crime is solved without a private detective consulting his dead partner who has returned as ghost whom no one else but he can see. If we don’t modernise the law to permit this sort of practice we will never know how many dead people could still have fulfilled their calling to support their surviving crime-busting partners while wearing dandyish white suits

So, Loz Kaye, Paul Bernal, OnlyOneIssue et al…enough with your cynicism. Get out your history books and recognise that there’s a venerable tradition of people with too much time and money on their hands imagining that fiction is reality.

Leave a comment

Filed under satire, surveillance, Uncategorized

January 23, 2014 · 11:22 am

Staffs Police to drop controversial naming “drink drivers” twitter campaign

ICO confirms hashtag campaign prior to conviction was unlikely to be compliant with the Data Protection Act. Other forces to be advised via ACPO of issues raised by the case

Over the Christmas period Staffordshire Police ran a social media campaign, in which drivers arrested and charged with drink-driving offences were named on twitter with the “hashtag” #drinkdriversnamedontwitter. It seemed to me, and others, that this practice arguably suggested guilt prior to any trial or conviction. As I said at the time

If someone has merely been charged with an offence, it is contrary to the ancient and fundamental presumption of innocence to shame them for that fact. Indeed, I struggle to understand how it doesn’t constitute contempt of court to do so, or to suggest that someone who has not been convicted of drink-driving is a drink driver

and I asked the Information Commissioner’s Office (ICO)

whether the practice is compliant with Staffordshire Police’s obligations under the first data protection principle (Schedule 1 of the Data Protection Act 1998 (DPA)) to process personal data fairly and lawfully

The ICO have now issued a statement. Their spokesman says

The ICO spoke to Staffordshire Police following its #DrinkDriversNamedOnTwitter campaign. Our concern was that naming people who have only been charged alongside the label ‘drink driver’ strongly implies a presumption of guilt for the offence, which we felt wouldn’t fit with the Data Protection Act’s fair and lawful processing principle.

We have received reassurances from Staffordshire Police that the hashtag will no longer be used in this way, and are happy with the procedures they have in place. As a result, we will be taking no further action. We’ve also spoken with ACPO about making other police forces aware of the issues raised by this case.

I think this is a very satisfactory result. The ICO have, as I said previously, shown that they are increasingly willing to investigate contraventions of the DPA not limited to security breaches. No one would defend drink driving (and it was not the naming itself that was objectionable, but the tweeting of the names in conjunction with the hashtag) but the police should not be free to indicate or imply guilt prior to conviction – that is quite simply contrary to the rule of law.

What I still think is disappointing though, is that after an initial prompt response from the Attorney General’s twitter account (which missed my point), there has been no word from them as to whether the practice was potentially prejudicial to any forthcoming trial. Maybe they’d like to rethink this, in light of the statement from the ICO?

1 Comment

Filed under Data Protection, human rights, Information Commissioner, police, Uncategorized

Tagged as , , ,

January 22, 2014 · 12:19 pm

A Wrong Petition?

Who exactly is a newspaper targeting with its petition, and is it gathering personal data fairly?

The Northumberland Gazette, in a no doubt well-intentioned campaign, is urging its readers to petition the Information Commissioner (IC)

to do more to stop robocalls

“Robocalls” being

unwanted, automated, recorded calls, which are a blight in [sic] people’s lives

There are a couple of problems with this. Firstly, as Tim Turner pointed out, the IC cannot increase his own powers: that is a matter for Parliament, and, indeed, he would, er, be exceeding his powers if the IC increased his own powers. Christopher Graham (or, rather, the role he fills) is a creature of statute, not a superhero. Moreover, the IC has himself been lobbying for Parliament to increase his powers to deal adequately with contraventions of the Privacy and Electronic Communications (EC Directive) Regulations 2003 . If the newspaper wants the IC to have greater powers it should certainly assist the IC in seeking them, but I think it should do so with better information, and by encouraging people to lobby their MP, rather than by submitting their details into a google doc.

In my experience people often end up on spammers’, and “robocallers'”, lists, because they submit their personal details to meaningless and unclear websites. Privacy notices, where given, are a pain to read, but if fine properly, they should tell you who is collecting the data, and for what purposes, and what your rights are.

In fact, failure to provide such information when gathering personal data is likely to constitute a contravention of the first data protection principle in the Data Protection Act 1998 (DPA). It’s notable, and ironic, that the Northumberland Gazette seems to provide no privacy notice whatsoever in connection with its petition. One hopes that those submitting a form don’t end up on more spammers’ lists, and find themselves complaining to the IC about an apparent breach by the newspaper of their rights under the first DPA principle.

Leave a comment

Filed under Uncategorized

January 20, 2014 · 3:14 pm

care.data – what am I worried will happen?

I was invited today on twitter to say what I was worried will happen as a result of the care.data programme. I’ve written about this previously, and some of my concerns are laid out in those posts. But here’s a little list:

  • I am worried that even the most robust and secure data security measures can fail, or be overridden. Patients’ identifiable data could be compromised.
  • I am worried that there is a limit to how much users of the data could be restrained from making secondary, not-beneficial-to-patients, usage of data to which they are given access (Geraint Lewis, NHS Chief Data officer, was asked how, for instance, insurance companies would be prevented from doing this – he pointed to the Information Commissioner’s powers to impose Monetary Penalty Notices to a maximum of £500,000 for suitably serious contraventions of the Data Protection Act 1998. But a penalty for misuse of data will only be a net penalty if it outstrips profit from the usage.)
  • I am worried that some people will avoid seeking medical treatment, particularly for sensitive or serious ailments, if they in turn worry about who might have access to their data.
  • I am, in more general terms, worried about the lack of transparency that has surrounded the programme, and the lack of clear information. I am worried that, if the risks are so low and the benefits so high, why were initial attempts made to sneak this under the public’s radar?
  • I am worried that the amassing of and use of personal data in itself carries risks.
  • I am worried that I am wrong about all this, and that I am attacking a programme which will potentially deliver personal and societal benefits.

But, ultimately, I am not sure it is for me to say specifically what I am worried will happen. I don’t know specifically what will happen with a lot of things I worry about.

Surely it is for the proponents of care.data to say why I should be reassured. And I’m not.

4 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Information Commissioner

Tagged as ,

January 18, 2014 · 11:11 am

If not that, then this?

Does the dropping of criminal charges against police officers under data protection and computer misuse legislation open the door to investigation of their employer’s civil liabilities?

The BBC reports that criminal charges have been dropped against three Nottinghamshire police officers. The charges appear to have been originally brought under the Data Protection Act 1998 (DPA) and Computer Misuse Act 1990 (CMA), and, according to the Police Federation it seems they were dropped because

prosecutors had found issues with training and advice on data protection for officers

Under section 55 of the DPA it is an offence to knowingly or recklessly, without the consent of the data controller, obtain or disclose personal data or the information contained in personal data. But the elements of the offence are not made out if the person doing this acted, for instance, in the reasonable belief that he or she had a lawful right to obtain or disclose the data, or if the obtaining was necessary for the purpose of preventing or detecting crime. Similarly, the offence of unauthorised access to computer material under section 1 of the CMA is only committed if the person knows that the access is unauthorised. If inadequate training and advice on access to data is given to employees of a data controller, then it will be difficult – as this story seems to reveal – to bring prosecutions. Effectively, the mens rea element of the offence is lacking.

However, perceptive readers of this blog might have noticed something: if incidents of inappropriate access to personal data have occurred, as appears to have been the case here, and the individuals accessing the data have been inadequately trained, does that not raise issues about the employer’s (the data controller’s) compliance with the seventh data protection principle in Schedule One of the DPA? This provides that

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data

The Information Commissioner’s Office (ICO) has repeatedly stressed that appropriate staff training is essential for compliance with the seventh principle. The ICO has the power, under section 55A of the DPA, to serve a civil monetary penalty notice on a data controller which has seriously contravened the DPA, where the contravention is of a kind likely to cause substantial damage or substantial distress. One wonders whether the ICO will now look into Nottinghamshire Police’s compliance with the Act, in view of the fact that incidents serious enough to bring now-dropped criminal charge took place, and the fact that they appear to have taken place against a background of inadequate staff training.

5 Comments

Filed under Breach Notification, Data Protection, Information Commissioner, monetary penalty notice, police, Privacy

Tagged as ,

January 13, 2014 · 4:42 pm

Why I’ve opted-out of care.data

Last week, after months of (over)thinking about it, I sent my GP a letter, based on the excellent template by the tireless MedConfidential refusing consent for identifiable data from my electronic medical records to be transferred to the Health and Social Care Information Centre (HSCIC).

I won’t rehearse the eloquent arguments against the current care.data proposals that you can read on MedConfidential’s site, and elsewhere (for instance GP Neil Bhatia’s excellent site). Nor will I rehearse arguments in favour. I have written about the subject in the past, and I don’t want to add to the general clamour. What I do want to say is why I have opted-out:

  • I’ve been struck by the inaccuracy and disingenuousness of the information which is being given to us in support of care.data. We are told, for instance, that “Your date of birth, full postcode, NHS Number and gender rather than your name will be used to link your records in a secure system, managed by the HSCIC. Once this information has been linked, a new record will be created. This new record will not contain information that identifies you”. This is cleverly worded: it does not say (because it would not be true) that this data will be anonymised, but it certainly tries to give that impression.
  • I have, ever since I first became aware of this issue, noted that there has been a lack of openness on the part of proponents. This has manifested itself in many ways, and people should be aware that the current leafleting campaign (as flawed as it is – note that it is not personally addressed to individuals, but simply sent to households, and doesn’t contain a form enabling people to opt-out) would not have come about were it not for concerns raised about this lack of openness.
  • I’ve noted the emotive campaign launched by leading charities in support of the campaign. But I’ve also noted the response by MedConfidential  which highlights that the charities’ campaign doesn’t draw attention to secondary usage of the information gathered, which could potentially be by pharmaceutical and other commerical companies, universities and other academic organisations, information intermediaries and think-tanks. On a general level, I do not think that amassing of personal data can ever be without potential risks and drawbacks, some of which include – the risk of breaches of data security, the risk of people failing to seek medical advice because of privacy fears, commercial use – and none of which are addressed in the charities’ campaign.
  • Finally, and, for me, crucially, if I fail to opt-out now, I’ve lost my chance – my data once uploaded cannot be deleted. However, opting out now does not preclude opting in in future. So, should I subsequently become convinced that societal and individual benefits from this amassing of electronic personal data outweigh my strong concerns about privacy and consent, I can change my mind in a way I couldn’t if I failed to opt out now.

13 Comments

Filed under Confidentiality, Data Protection, data sharing, Privacy

Tagged as ,

January 6, 2014 · 5:01 pm

Unintended data protection consequences of Defamation Act and ICO proposals?

Might changes to defamation law, and to the Information Commissioner’s practices, lead to an increase in court claims about accuracy of personal data?

A statement is not defamatory unless its publication has caused or is likely to cause serious harm to the reputation of the claimant

This is the bold subsection (1) to section 1 of the Defamation Act 2013, which was commenced in England and Wales on 1 January 2014. This – in part the culmination of a strong campaign – is a potentially significant change to domestic libel law, meaning that (in the words of the explanatory notes to the Act)

the bar [is raised] for bringing a claim so that only cases involving serious harm to the claimant’s reputation can be brought

But often where a bar is raised in one place, a gap will be found in another. I wonder if, along with another development -namely, the Information Commissioner’s proposals to change its approach to regulation of the Data Protection Act 1998 (DPA) – it might lead to an increase in DPA claims.

11KBW’s Robin Hopkins wrote an important article last year, whose title helpfully summarises its argument: The Data Protection Act in defamation cases: increasingly relevant, potentially primary? In it, he identified a possible trend, citing two cases in particular as illustration – The Law Society and others v Rick Kordowski [2011] EWHC 3185 (QB) and Desmond v Foreman, & Ors [2012] EWHC 1900 (QB), of

The Data Protection Act 1998…increasingly being deployed as part of a claimant’s arsenal in defamation claims […] in some circumstances, the DPA may appropriately play the lead role rather than a supporting one in a complaint about unjustifiable and damaging communications about individuals

There are a number of potential claims which an aggrieved individual can make using the DPA. For our purposes here, though, the relevant provisions are those at section 14, dealing with inaccuracy

If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data

Clearly, inaccuracy – normally in the form of an untruth – is an important part of a defamation claim. If, now, those claims formerly made in defamation which were not worth the wick, let alone the candle are (statutorily) barred by virtue of section 1 of the Defamation Act 2013, will persistent claimants seek another route? Inaccuracy of personal data is a prima facie contravention of the fourth data protection principle in Schedule One of the DPA, and section 14 is a legitimate and specific legal route by which a person may have that inaccuracy corrected.

It should be noted, though, that the court does retain discretion (n.b use of “may” in section 14) as to whether to order rectification etc. An alternative route has traditionally been, of course, by means of making a request for assessment, under section 42 of the DPA, to the Information Commissioner (IC), as to whether processing of one’s personal data has been or is being carried out in compliance with the DPA. Upon receipt of a valid request of this type, the IC is required (“shall make…”) to make an assessment (although he retains discretion as to what is an appropriate manner for it to be made). I say “traditionally” because, as David Erdos argued in a guest post on this blog recently, the IC, in a consultation on a future approach to dealing with DPA complaints and concerns

proposes to decide on its own account whether or not to assess the merits of a concern validly sent to it for assessment under the Data Protection framework

but, as David, notes, this proposal does not appear to be in accordance with the IC’s legal obligation to make an assessment in relevant circumstances.

Nonetheless, and to the extent that such a proposal (or a tweaking of it) might be held to be lawful, it certainly seems to signal a desire on the IC’s part to  (in Tim Turner’s words)

start ignoring more individual complaints, and concentrate on what it considers to be strategic priorities

If that is so, then might complainants who wish to challenge the accuracy of their personal data, more readily look to bring section 14 claims against the data controller? Might the IC be shifting its burden not only on to data controllers themselves, but also on to the already overloaded justice system?

Leave a comment

Filed under Data Protection, defamation, Information Commissioner

Tagged as , ,