What is the purpose of a Corporation Sole? Why must an organisation represent the idea of an individual, rather than the organisation acting in its own capacity while the individual simply sits as its head? In other words, why do case workers of the ICO form the Information Commissioner's Office, rather than the Information Commissioner simply serving as the head of the Information Commission or Information Rights Office or something like that? What function does this notion of a corporation sole serve?
The Information Commissioner is the successor of the Data Protection Registrar, created by the Data Protection Act 1984. The office was renamed in 1998 and again in 2000, and the functions have changed along the way. The current governing legislation is the Data Protection Act 2018, schedule 12. There have been many suggestions of changing the structure - such as the ICO's Triennal Review of 2015, and the Leveson Inquiry Report (see sections 4.8 and 4.9, p1109 of volume 3) of 2012 - but that has not happened. So your sense that the &quot;corporation sole&quot; model is a bit unusual is shared by many distinguished minds, and even in 1984 it was probably anomalous, judging by a quick scan of contemporaneous legislation. For example, the &quot;Cable Authority&quot; established in the same year was created as a statutory corporate body, to regulate cable television. Ultimately, the Data Protection Registrar and the Cable Authority could do the same sorts of things, as far as employing people, acquiring property, entering into contracts, and so forth. There were special rules for how the Registrar and the Authority members would be appointed - these are different rules from one another, but they are both set up by primary legislation. The differences therefore fall to be explained as a matter of policy preference, since they are both legally viable ways to establish a body performing public functions &quot;at arm's length&quot; from ministers. The main difference is at the leadership level, since as far as doing the job, people employed in the ICO are in the same position regardless of whether they work for a corporation sole or aggregate. If there is one person in charge, then you have a single &quot;head&quot; salary to pay, a single selection process to run to find them, and a single point of accountability to government and to Parliament. If there is a board of directors then they all have to get chosen somehow, and responsibility can be more diffuse. But having several people can lead to better decision-making, and could make the organization appear less biased by having balanced representation. In fact, prior to the Act of 1984, the creation of a Data Protection Authority (rather than a sole registrar) had been proposed many times, most notably by the Lindop Committee which reported on the matter in 1978. The idea of a registrar was developed in the Government's 1982 paper, Data Protection: The Government's Proposals for Legislation (Cmnd 8539), which led up to the Act. That recommended that there be a single independent official who would be accountable for the work, but that he would be assisted by an expert committee. Additionally, a Data Protection Tribunal would take care of the resulting legal disputes. In the actual legislation, the expert committee was not made statutory, because the government felt that it would be too difficult to define what it ought to do in a way that would stand the test of time (see HL Deb 19 July 1983, vol 443 col 1084 for a Lords committee debate on this topic). The &quot;corporation sole&quot; legal structure gives maximal flexibility to how the Registrar would organize the office over time, while still doing the legal mechanics to give it independent personality.
Short answer: There is no difference. Long answer: Come, ride with me through the veins of history. I'll show you a god who falls asleep on the job. (And how can we win, when fools can be kings? Don't waste your time or time will waste you.) The word 'company' (as in a corporation) is derived from the word 'company' (as in a group of people, like the Company of the Ring). The word 'corporation' reflects the fact that the organisation has an independent existence for legal purposes, that is, it metaphorically has a 'body' ('corpus') or has been 'incorporated'. (If you have ever wondered why corporate culture is so boring then consider the common etymology of the words 'corporation' and 'corpse'.) Before there were incorporated companies, there were 'joint stock companies'. The term 'joint stock' referred to the fact that members of the company (analogous to what we would today call shareholders) jointly held the 'stock' (as in 'inventory') of the company. This use of the term 'stock' to describe a type of company makes no sense in today's language, but originally the term was used to distinguish a 'joint stock company' from a guild (also known as a company) where the members each maintained their own inventory. For example, in the Worshipful Company of Stationers and Newspaper Makers (the printers' guild in London, which managed censorship on behalf of the government in exchange for the right to suppress piracy), each printer had their own stock of paper and finished products; in contrast the Muscovy Company had a single stock of wool that it took over to Russia and a single stock of furs that it brought back to sell in London (the 'joint stock'). (The early joint stock companies were of course technically partnerships, which is why, in the Income Tax Assessment Act 1997, the definition of 'partnership' excludes a company and the definition of 'company' excludes a partnership, forming a neat circle which everybody ignores in practice because they want money. Incidentally, as you would imagine, a limited partnership, which may be incorporated, is a partnership rather than a company for tax purposes, unless it is a 'corporate limited partnership' in which case it is a company. But that is tax law, you must never go there Simba.) So anyway, back in the day, if you had put 10% of the capital into a joint stock company then you could be said to have a right to 10% of the 'stock' of the company. Over time, as the trade in interests in companies evolved, the term 'stock' came to refer to a member's rights in respect to the company, e.g. 'I own stock in the XYZ Company.' Since what you hold is a share in the stock of the company, it was said that the member held a 'share'. Subject to company law and the company's constitution, etc, a company could split or merge shares. So, if you had 100 shares in the company, the company might split each share into 10 shares, giving you 1,000 shares. Back before we had electronic computers and the Internet, keeping track of shares was a lot of work. If a person had 1,000 shares then you might have to move around 1,000 printed share certificates. Therefore the practice developed of converting a person's shares in a company into stock. Stock representing 1,000 shares could be documented as a single item instead of 1,000 items. (Of course, you could still sell one 1,000th of that stock if you wanted to.) Of course a shareholder could never convert their shares into stock. That would make no sense. Shares (or stock for that matter) do not exist outside of the records of the company. Therefore the company, or more precisely the directors on behalf of the company, must be the ones to convert shares into stock or vice versa. The terminology that developed, and which persists to this day outside of strict legal contexts, is: a 'share' is a single unit of ownership in the company; 'stock' is the whole of a person's ownership in the company. In Morrice v Aylmer (1875) LR 7 HL 717, the House of Lords confirmed that a bequest (in a will) of the deceased's 'shares' would imply a bequest of their 'stock'. So, even in a legal context, there's not much of a distinction. The one distinction of note is this: you cannot have partly-paid 'stock'. If shares are only partly-paid, then you have to keep track of them individually. You can't have the company converting a bunch of shares to stock, not distinguishing between which are paid up and by how much, and then converting them back into shares, with who-knows-what consequences (probably none to be frank, but we're talking about 19th-century information processing systems here). Therefore there was the rule that you can only convert shares to stock if they are fully paid-up. In Australia, in the 1995 draft of the Second Corporate Law Simplification Bill (written by the Attorney General's Department's 'Simplification Task Force') it was proposed to abolish 'stock' and force all Australian companies to convert stock into shares. This proposal became law in the Company Law Review Act 1998, and today is reflected in section 254F of the Corporations Act 2001, which says that a company cannot issue stock or convert shares into stock.
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.
The same page at the ICO website also lists what an organisation should do if they refuse to comply with a request: What should we do if we refuse to comply with a request? You must inform the individual without undue delay and within one month of receipt of the request. You should inform the individual about: the reasons you are not taking action; their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce this right through a judicial remedy. You should also provide this information if you request a reasonable fee or need additional information to identify the individual. Even if they did not inform you about this, the last two bullet points basically list your options. You can make a complaint (Art. 77 GDPR), or go to court (Art. 79 GDPR) requesting the online retailer to comply with your request. (Or do both). You can request a compensation for damages, but it is often difficult to prove if you have suffered (non-material) damages.
From a German perspective, it would be absolutely normal and expected that you're providing identity &amp; contact information publicly. Per §5 TMG (Impressumspflicht / Anbieterkennzeichnung) this is required for German tele-media offerings, such as websites or email providers, even if non-commercial. Whereas for you as an upstanding and diligent email provider an abuse@... address should be enough, the German context expects a street address where you could be served with a lawsuit… There absolutely are privacy and free speech issues with this compelled self-doxxing. But by running an email service, you're not just acting as a private person. Your privacy interests and the transparency and security interests of other people have to be balanced. Now since you are not in Germany, the TMG does not apply to you. You have no legal obligation to provide this information. However, the ISP also has no legal obligation to to deliver your email. The ISP does have an obligation to apply appropriate organizational and technical safety measures. It seems that one organizational measure they have found appropriate is that they will only deliver emails from providers that provide public contact information, as would be the norm in Germany. I am not entirely sure how the GDPR applies here. The GDPR doesn't really allow or prohibit disclosures of personal data, it just requires that every purpose of processing for personal data has a legal bases per GDPR Art 6. One such legal basis is a legitimate interest, which boils down to a balancing test between your rights and freedoms and other people's interests. I'm also not sure if the contact information should be classified as personal data in this context, because the contact info primarily relates to your role as an email provider. I'm also not sure if the ISP is processing your personal data in the sense of the GDPR when they merely require you to publish it on your own site. They would be processing it as soon as they scrape, store, or otherwise use this info.
The existence of a law/legal system is the province of sovereign states. We do not have a world government so there is no world legal system. There is such a thing as international law, however, that is based on what the sovereign nations of the world agree is international law (usually in a treaty) and the degree to which they have implemented them in domestic law. For example, the International Criminal Court has no jurisdiction over US nationals because the United States of America has refused to ratify the treaty that created it. There are also supra-national entities like the EU whose directives are binding on their member states and such states are required, as a condition of their membership, to enforce such directives domestically. A sovereign state's courts will decide when a person and their activities falls within their jurisdiction based on the circumstances of the particular case. For example, an Australian citizen can be prosecuted in Australia for paying a bribe to a foreign official in a foreign country even while working on behalf of a foreign company even if such activity is locally lawful. Why? Because Australia is a sovereign nation and it says it can. Sometimes it is impossible for a person to comply with the laws of multiple nations. For example, if the EU requires that certain data about their citizens is to be made confidential but the laws of the USA require a US corporation to disclose this information then it is impossible to comply with both. A person in such a position must decide which laws they will break. It is partly for that reason that multi-national corporations are usually multiple corporations i.e. they have a different corporate subsidiary in each jurisdiction (tax is another reason). For example, if all EU citizens do business with Google (Europe) then Google (USA) can rightfully claim that it has no data about European citizens to disclose.
What does it accomplish? It guarantees that all corporations doing business in New York can be served. (A company's having an agent for the service of process does not prohibit people from serving the corporation directly. The secretary may be "the agent upon which process may be served" but is not "the sole agent upon which process must be served." And besides, process need not be served on an agent; it can be served on the company itself, at its office or on one of its officers.) With this requirement, New York makes it impossible for a company to avoid service of process by closing or moving its offices, by sending its officers and employees out of state, or by making itself unavailable by any means. No matter what steps a company might take to avoid service of process, the process server can always resort to serving the company's agent: the Secretary of State.
As I understand it, legal procedure in Common Law jurisdictions (e.g. the UK) is primarily based on evidence given by a person. Paperwork exists to verify that someone has not misremembered something, but even when you have paperwork you need to have someone testify that this is the right paperwork and it hasn't been forged. A piece of paper on its own means nothing. In practice of course the two sides will agree to accept routine matters rather than dragging lots of third parties (e.g. the post office employees) into court to no point. In the case of a letter where you need to prove it was received, the sender will testify that they sent the letter and that the copy they have introduced into evidence is a true copy. The proof of delivery merely shows that the item wasn't lost in the post. If one party testifies that they sent a letter and the other testifies that they merely received an empty envelope then someone is lying, which is a crime meriting further investigation.