Via email:
Case Reference Number
Dear ,
I am writing further to my receipt of your email correspondence of 20 March
2019 with regard to the data protection complaint that has been raised with the
ICO about how has handled an information rights request
submitted by .
Your organisation’s response
In your initial response to the ICO of 18 March 2019, you provided the ICO with
an account of how has dealt with this request.
You supplied me with details of the data download export function that
users can access via their profiles and of how used this function manually
as the means of providing with the disclosure of personal data he
received on 6 September 2018. This export would have included all information
connected to on s databases, including all
communications sent and received by the user through the
Further to this, however, you have added in your email of 20 March that emails
from staff team accounts could not have been included as part of this automated
email functionality. Although could have manually exported the emails
has exchanged with it, it did not so as your organisation did not
consider them to fall in scope of his request.
Our view
I have considered the information available to me in relation to this complaint
and I am of the view that has not complied with its obligations under
data protection law in this instance.
Page 1 of 3
was explicit in his right of access request of 1 September that he
was seeking all information had stored about him. Given that he will be
personally identifiable from any emails he will have exchanged directly with
staff, as well as from any internal emails in which he is discussed, I do
not feel sufficiently assured that he has been provided with a comprehensive
disclosure of everything to which he would have been entitled.
Action required
It is unclear to what extent is still processing information from which
is personally identifiable that it has not already disclosed to him as
part of its export download. However, in line with the above assessment, the ICO
now requires your organisation to revisit the way it has handled this complaint,
review any such personal data it still retains, and provide this to
as soon as possible.
I note in your response of 20 March that you appear to express concern about
the potential for inappropriately disclosing the personal data of staff here.
On this point, I would indeed stress that is only entitled to his
own personal data in response to his right of access request, and not that of any
third parties.
It is unlikely that this would be problematic regarding any emails he has
exchanged with the team directly, as he would have had sight of this
personal data already. In the case of any internal emails, should consider
if it possible for these to be redacted of any such third-party personal data if the
relevant staff members do not wish to give their consent for their data to be
included.
For your information, the scope of ’s right of access request would
only include personal data processed about him up to the date it was first made.
Any new emails, for example, he sent your organisation after 1 September would
not be covered.
Next steps
Our website contains significant advice and guidance about the processing of
personal data and an organisation’s obligations under data protection law, which
may help to inform any decisions makes about the processing of personal
data in the future.
Page 2 of 3
In addition to the guidance I have linked you to previously on determining what
is and is not personal data, please find below a further link to more general
information the ICO has published on an individual’s right of access under the
General Data Protection Regulation, which I hope is helpful.
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-
general-data-protection-regulation-gdpr/individual-rights/right-of-access/
In the absence of any evidence to support ’s claim that
disclosed third-party personal data to him when it initially responded to his
request, this is not a matter we would seek to take forward at this time. It may
be the case that we will need to contact you again if he is able to provide this
evidence at a later stage.
More generally, you should know that we keep a record of all the complaints
raised with us about the way organisations process personal information. The
information we gather from complaints may form the basis for action in the
future where appropriate.
Thank you for your assistance in addressing this data protection complaint.
Should you wish to discuss this case any further, or require any clarification,
please do not hesitate to contact me.
Yours sincerely,
Case Officer
Information Commissioner’s Office
Direct dial number:
You should be aware that the Information Commissioner often receives requests for
copies of the letters we send and receive when dealing with casework. Not only are we
obliged to deal with these in accordance with the access provisions of the data protection
framework and the Freedom of Information Act 2000, it is in the public interest that we
are open and transparent and accountable for the work that we do.
For information about what we do with personal data see our privacy notice at
www.ico.org.uk/privacy-notice .
Page 3 of 3