Dear
The Information Commissioner’s Office (ICO) is writing to you regarding
the complaint from about your handling of his request to
have his personal data erased.
The ICO’s role
Part of our role is to consider complaints from individuals who believe
their data protection rights have been infringed. We want to improve the
way organisations deal with the personal information they are responsible
for.
Our view
I have considered the information available in relation to this complaint
and I am of the view that you have complied with your data protection
obligations.
This is because:
You responded to ’s request within a calendar month.
You explained your legal obligations, under the European Union’s 4th
Anti-Money Laundering Directive, to continue processing
’s personal data.
Specifically we note that in your organisations privacy policy under
you state that you will retain a data subject’s personal data for
5 years after a business relationship has ended.
It is understood that as the European Union’s 4th Anti-Money Laundering
Directive was transposed into UK law in the form of the Money Laundering
Regulations 2017, it is also stated under
And section therefore states:
Therefore it is apparent that in your privacy policy you have aligned your
refusal to delete the data subject personal data in line with Article 6(c) of
the GDPR as you are required to continue to process this personal data
due to a legal obligation.
However, in your response to ’s request you omitted details
about ’s rights.
You did not explain to that he has the right to complain to
the relevant supervisory authority and his rights to seek a judicial review.
I note that your response provided a link to your privacy policy and this
contains the contact details for the relevant supervisory authority.
Unfortunately, this does not meet the obligations of providing the above
information when responding to requests.
Please can you confirm that you are the appropriate contact for any future
complaints. If so, please can you also provide your position.
We will keep a record of all the complaints raised with us about the way
you process personal information. The information we gather from
complaints may form the basis for action we may take in the future to
ensure you meet your information rights obligations.
Yours sincerely
Case Officer
Information Commissioner’s Office
Direct dial number:
If you would like to provide us with feedback of any kind, please let me
know
ICO Statement
You should be aware that the Information Commissioner often receives
request for copies of the letters we send and receive when dealing with
casework. Not only are we obliged to deal with these in accordance with
the access provisions of the data protection framework and the Freedom
of Information Act 2000, it is in the public interest that we are open and
transparent and accountable for the work that we do.
For information about what we do with personal data see our privacy
notice at www.ico.org.uk/privacy-notice