Jump to content


Enforcing a S10 notice


style="text-align: center;">  

Thread Locked

because no one has posted on it for the last 3039 days.

If you need to add something to this thread then

 

Please click the "Report " link

 

at the bottom of one of the posts.

 

If you want to post a new story then

Please

Start your own new thread

That way you will attract more attention to your story and get more visitors and more help 

 

Thanks

Recommended Posts

For obvious reasons I don't want to name the company involved but I am probably going to have to force them to comply with a S10 notice (stop processing my data) I issued. They've come up with a number of reasons why they don't have to stop, none of which are actually applicable as they are probably processing sensitive personal data, a fact which they have so far conveniently ignored.

 

What is the best way to enforce - court or ICO? If it's court, I'm absolutely certain they'll instruct counsel, which I'm perfectly happy to admit scares me to death. The value of my claim at the moment is probably minuscule but if I won the repercussions to this company would be enormous, hence being sure they will defend vigourously.

 

There are a number of issues which I also need to clarify before going any further so would really appreciate if someone could answer some questions :-

 

1. Is it actually established that photographs can be sensitive personal data? The photographs in question could show my approximate age, ethnic origin, and that I am disabled.

2. Does it matter if the data being processed hasn't actually been disclosed to a third party (other than the company's employees, obviously) yet? If it were disclosed to the wrong sort of person, it could do enormous harm.

3. Does it matter if the data is usually processed automatically, i.e. unseen by human eyes? At some point the photographs are printed and so must be able to be disclosed to a third party.

 

I'm sure I'll think of many more questions eventually, but anyone who wants to contribute has my sincere thanks.

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

Could i ask who the company is? Why would a company be taking photographs?

 

Only time ive known of this is something like MMF doing something like this... They do actually do it.

IE taking photos to prove theyve attended a house.

 

We could do with some help from you.

 

Have we helped you ...?         Please Donate button to the Consumer Action Group

 

**Fko-Filee**

Receptaculum Ignis

 

Link to post
Share on other sites

Could i ask who the company is? Why would a company be taking photographs?

 

Only time ive known of this is something like MMF doing something like this... They do actually do it.

IE taking photos to prove theyve attended a house.

 

Sorry but answering your questions would identify me to the company concerned and I know they monitor the forums.

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

No it wouldn't, This forum is completely anonymous... YES some companies monitor for PR reasons ie Brighthouse & Vodafone however I understand...

 

Just tell us though is it retail or a debt collection agency?

 

We could do with some help from you.

 

Have we helped you ...?         Please Donate button to the Consumer Action Group

 

**Fko-Filee**

Receptaculum Ignis

 

Link to post
Share on other sites

Hi

Have you thought of contacting the ICO informally to get their take on this?

 

As you are aware, processing data without permission is allowed in a fairly narrow set of circumstances. (prevention, detection of crime etc.)

 

If you fall outside those parameters they should comply.

If you are asked to deal with any matter via private message, PLEASE report it.

Everything I say is opinion only. If you are unsure on any comment made, you should see a qualified solicitor

Please help CAG. Order this ebook. Now available on Amazon. Please click HERE

Link to post
Share on other sites

The ICO would not give an informal opinion, just spouted a copy and paste job from their website which I am perfectly capable of finding myself.

 

There is no doubt that they should not be processing my data but convincing them of that is proving to be challenging.

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

That is a shame. If court is not an option for you then the ICO is the only channel open to you and at least at the end of it (if it doesn't go your way) you would have an explanation as to why they are processing.

If you are asked to deal with any matter via private message, PLEASE report it.

Everything I say is opinion only. If you are unsure on any comment made, you should see a qualified solicitor

Please help CAG. Order this ebook. Now available on Amazon. Please click HERE

Link to post
Share on other sites

I wouldn't say an absolute no to court - I've been there before and know how challenging it is so would want to have as near to an iron cast case as possible before even considering it. Making such a case is going to involve answering the questions in my first post. What I've found so far (mostly on BAILLI) is that a photograph could be considered 'sensitive personal data' if it showed e.g. that someone was disabled but I would like something a little more definitive.

I also found a case where someone was trying to enforce a S10 notice and the judge appeared to think there was no facility within the Data Protection Act to do that - so long as the other party responds within the time limits it doesn't seem to matter what happens next. He though the only enforcement was destroying etc the data, which doesn't help if you don't want them to acquire it in the first place.

I shall have to do more research, but if anyone can link to anything relevant it would be greatly appreciated.

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

1. Let's take a step back here. What is the significance of proving that something is 'sensitive personal data' rather than just 'personal data'? In both cases, the data protection principles set out in Schedule 1 of the DPA apply. One of the data protection principles is fair and lawful processing. In order for processing to be fair and lawful one of the conditions set out in Schedule 2 must be met in both cases. The significance of proving that personal data is 'sensitive' is that one of the conditions in Schedule 3 must be met too.

 

The case you are looking for is the High Court judgment in Douglas v Express available here http://www.bailii.org/ew/cases/EWHC/Ch/2007/1908.html, specifically paragraphs 80 and 81. This is the case where JK Rowling tried to argue that photographs of her infant son were 'sensitive personal data'. The court agreed it was 'sensitive personal data' however there was no breach of the DPA because one of the conditions in Schedule 3 applied (paragraph 5, personal data which has been made public).

 

If the photographs were taken in a public place the same reasoning would apply to you. For this reason I do not think proving that the data is 'sensitive' gets you anywhere. I think you are much better off focussing on whether or not any of the conditions in Schedule 2 are satisfied (http://www.legislation.gov.uk/ukpga/1998/29/schedule/2) which applies to all 'personal data'.

 

2 and 3. Contrary to popular belief, the DPA does not contain any general prohibition on disclosing data to third parties. Similarly I do not think it matters whether or not the data is processed by computer or by humans.

 

To bring a DPA claim around disclosure to third parties you would need to hang your hat on one of the general data protection principles in Schedule 1, for example failure to take proper measures to prevent unauthorised processing or transfer outside the European Union.

PLEASE HELP US TO KEEP THIS SITE RUNNING

EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHERS

 

Link to post
Share on other sites

Having reconsidered the Schedule 2 conditions, none of them are met. I haven't given consent for the processing, there's no contract or legal obligation and it's certainly not in my interests. There's no exemption applicable in Condition 5 and whilst they might argue that condition 6 applies because it's necessary for their interests, I believe that because the processing is so prejudicial to mine (and many others') interests and the processing is actually not necessary for them to carry on their business (though the alternative would be somewhat more expensive) even condition 6 isn't met.

 

On the sensitive personal data issue I would agree that a one off or even occasional photograph taken in a potentially public place probably wouldn't amount to sensitive personal data but, unless I were being watched by e.g. a private detective, I wouldn't expect someone to be potentially keeping track of every time I go out and who I'm with. I believe that goes way beyond information that I've made public and is therefore potentially sensitive personal data for which their only option to continue processing would be my explicit consent.

 

If this were being done by an individual, I wouldn't be bothering with data protection, I'd be contacting the police, but as it's all done automatically by a company I'm stuck with arguing data protection issues instead.

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

In any event, condition 6 doesn't apply once you have served a s10 notice. I imagine the company would hang their hat on consent though agree it is very questionable whether that could apply here. I can't imagine they would roll over on this since I'm not sure how the result you are looking for could be achieved technically unelss they take down the whole system (maybe if you can provide them with numberplates they can ensure photos are automatically deleted from their system or whatever).

 

I understand what you are saying about sensitive data, but the case posted above does suggest that if you are out and about with someone in public, that counts as making it public. The case posted above seems states that the Schedule 3 exemption would apply to photographs of standard daily activities and suggests (although technically obiter) that only particularly sensitive/confidential activities would be caught. Its probably arguable but not your strongest argument.

 

Civil harassment is still a possible option even if it is all automated. A few years ago someone successfully sued British Gas for sending them lots of automated letters saying they hadn't paid their gas bill, when they were not a BG customer and BG failed to remove them from their systems. BG tried to say it can't be harassment because it wasn't intentional, but the courts didn't like that on the basis that you can't have an out of control machine sending harassing letters. The case was extensively reported in the press if you google for it.

 

If you do want to sue them you need to be very careful to ensure that you draft your claim in such a way that it is a claim for financial damages (not a general court order or injunction or aynthing like that) for less than 10k. You need to ensure small claims track to drastically reduce the chances of having to pay their legal costs if unsuccessful.

PLEASE HELP US TO KEEP THIS SITE RUNNING

EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHERS

 

Link to post
Share on other sites

  • 1 month later...

I've decided to go with the ICO on this, and drop the sensitive personal data issue.

 

We are currently arguing over whether the data held by the third party company is personal data at all since the ICO seem to have missed the fact that my name and address is included!

RMW

"If you want my parking space, please take my disability" Common car park sign in France.

Link to post
Share on other sites

 Share

  • Recently Browsing   0 Caggers

    • No registered users viewing this page.

  • Have we helped you ...?


×
×
  • Create New...