Information Commissioner’s letter to me (22nd April 2010 )

May 2, 2010 at 7:11 pm

” your complaint does raise concerns over the security of personal data for which the City of Plymouth Liberal Democrats are the data controler for. This is because it appears they do not hold or have access to the personal information which is in the possession of the PPC for which they are responsible for. The seventh data protection principle says that “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF T. 0303 123 1113 F. 01625 524510

Information Commissioner’s Office mail@iCO.gsi.gOV.uk WWW.iCO.QOV.uk 22nd April 2010

Case Reference Number ENQ0292957

Dear Mr Harding ‘ Thank you for your further correspondence concerning the processing of the personal information by a prospective parliamentary candidate (PPC). Please accept my apologies for the delay in replying to you, our office is currently dealing with large volumes of work. This has meant that we have been unable to deal with incoming correspondence as promptly as we would like. As I understand it, you are concerned that the PPC for the Liberal Democrat party is unlawfully holding personal data that the City of Plymouth Liberal Democrats is the data controller of. You maintain that the PPC has ignored your requests for the data to be returned. I should perhaps explain that the data controller is defined in part I s.l of the Data Protection Act 1998 (DPA) as, “A person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed”. Section 4(4) of the DPA further states that: “It shall be the duty of a data controller to comply with the Data Protection Act Principles in relation to all personal data with respect to which he is the data controller” A data controller must be a ‘legal person’, i.e. a legal entity. This term not only comprises individuals but also organisations such as companies and other unincorporated bodies of persons and is the entity responsible for the processing of personal data in a given situation. There is often confusion about the term data controller, and it is frequently assumed that the data controller is the person at an organisation who has responsibility for dealing with the DPA. This is not the case as it is the ‘legal entity’ of the organisation itself which is classed as the data controller for the purposes of the DPA. In summary a data controller is the legal entity which literally ‘controls’ (that is: decides on the uses and purposes of) personal data. The DPA has eight principles of’good information handling’. These give people specific rights in relation to their personal information and put certain obligations on those organisations that are responsible for processing it. From the information you have provided it appears the PPC is not the data controller for the data, they also appear to be acting as an individual in relation to the processing of the data. If this is the case, they will not be required to comply with the data protection principles. Concerns would be raised if the PPC had obtained the data through deceit or without the knowledge of the data controller. However I understand from your initial correspondence that it is “normal practice for candidates to have access and use of this sensitive data…”

I should explain that your complaint does raise concerns over the security of personal data for which the City of Plymouth Liberal Democrats are the data controler for. This is because it appears they do not hold or have access to the personal information which is in the possession of the PPC for which they are responsible for. The seventh data protection principle says that “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

Finally, I should explain that the recovery of personal data is not a data protection issue. In this case I would recommend seeking legal advice on retrieving the personal data.

hope you understand the reasons for my view. If we can be of any further assistance please contact our helpline on 0303 123 1113. You may also find some useful information on our website at www.ico.qov.uk.

Yours sincerely Joylon Stone Case Officer DP Case Reception Unit

Advertisements

Entry filed under: Uncategorized.

My Resignation Email to Lib Dem HQ The Electoral Commission was never informed about the missing money


Calendar

May 2010
M T W T F S S
« Apr   Sep »
 12
3456789
10111213141516
17181920212223
24252627282930
31  

Most Recent Posts


%d bloggers like this: