Does the Companies Act 2006 trump an individual&#39;s right to be forgotten? I once was a contractor and ran a limited company. At the time all my details and my secretary's were published on the Companies House website. edit: This information includes full names and addresses. This limited company was wound up in 2008. Since then CH have removed all information about my company from public view, including director and secretary details. I occasionally still find other websites cribbed my company's details from Companies House back when and are to this day advertising these details if you look for them. They claim they can hold on to this information citing the Companies Act 2006. They may be &quot;nice enough&quot; to hide your details from search bots if you ask them. But does this Companies Act 2006 not fly in the face of article 17 of the GDPR (&quot;right to be forgotten&quot;)? Especially after such a long time? Do I have a stronger legal foothold by citing article 17 of the GDPR if I contacted these websites requesting actual removal (not hiding) of all personal data held on me and my previous secretary?
Companies House itself is exempt from certain GDPR provisions, including Article 17, by virtue of the Data Protection Act 2018, Schedule 2, Part 1, paragraph 5. (That's the Act which implements the GDPR in UK law.) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation. The list is in paragraph 1 of that Part, and has effect under section 15 of the Act. Because the registrar is obliged by an enactment, the Companies Act 2006, to make information available to the public, it's exempt from being asked not to. When Companies House data is processed by somebody else, they do not have this exemption. They are the &quot;data controller&quot; with respect to what they've retrieved (from the API or by scraping) and have freestanding obligations under the GDPR. They may still have other reasons why they are able to retain and process your data, such as a vital interest or a legitimate interest in protecting themselves or others from fraud, and therefore wanting to maintain a list of people associated with insolvent companies. For Article 17 specifically, there are exceptions relating to the public interest, statistics and research which might be invoked. But random websites cannot claim exemption from Article 17 just because the data comes from Companies House. There is nothing in the Companies Act which says that third parties are obliged to mirror Companies House data. This is explained in greater detail in the Companies House Personal Information Charter, which is where I found the citation above. They go on to say: If you have any concerns about company data on third party products and websites, please contact the organisation directly. We’re not able to advise other organisations on UK GDPR compliance, and we cannot advise you on whether other organisations are complying with the law.
Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good as me requesting a Ferrari, a Yacht and a Mansion. I can make that request. People will laugh. I will not get it. I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related You have no way to know who owns what email address. And it's none of your business. Your only interest should be in whether the address is owned by the person that is creating the account. You probably already do that by sending a confirmation link to the email address when people sign up. I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request The only way you have to comply with such a request is if the owner can prove their identity. As far as I understood, the &quot;Finnish city&quot; was three degrees away from that. They could not provide any proof they are who they said they are, they could not provide a finite list of accounts they claimed to own and they could not even provide proof they own those accounts. They literally just wrote an email with zero legal meaning. I want to figure out the right way to reply to emails like this one The correct way to handle this is have a feature on your website where the account owner can delete their own account. GDPR compliant. Then you make a text template explaining how to use that feature and reply with that template to every request, no matter how stupid (like this case) they are. If they cannot identify themselves to you by proving they have access to their &quot;own&quot; email, they have no business wasting your time. Legally, they could provide you with a different method of identification. In case of a Finnish school, that would probably need to be power of attorney from all children's legal guardians and a specific way to identify the accounts that is consistent with the data given (for example if they entered their full name and address on your website). You would probably in your rights to demand a certified translation if it's all in Finnish. Apart from the fact that you as a private US citizen have no real means to check the validity of all that paperwork, personally, if I saw hundreds of pages of certified translated paperwork, I would probably just comply. Not sure it it were actually enough, but it certainly gets an A+ for effort to delete data from a private website. But a real lawyer might give better advice with a real case on their hands. Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.) Indeed. You should not delete people's data because a random punk on the internet sent you an email. You need to identify who the request is from and if they are allowed to make such a request. Whether you have a legal duty to actually keep data, is up to you or your lawyer to find out. It depends on your data and laws. It is perfectly legal to make a website with a textfield that deletes any data you enter after a second. Destruction of data you own is only a problem if you break other laws with it. For example the IRS might not be amused if you destroyed invoices and other proof of taxable income. &quot;Some dude claimed I must in an email&quot; is not going to fly with them. That said, again, please, identify who you deal with, find out if their claim is valid. Don't do stuff because random internet punks write you an email. Because the next mail you get, will be from a Nigerian Prince. Please wisen up before opening that one. People on the internet, through stupidity or malice, might not have your best interests at heart. Don't believe random emails.
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
As a general rule, if a business, like a bank, is legally required to keep information confidential, and an employee breeches confidentiality, then your recourse is to sue the business for damages. See for example ch. 35 of Title 12. The bank cannot claim "It's not our fault, an employee did it" (the Latin for this is "respondeat superior", whereby a part is also responsible for the acts of their agents). As far as I know, there is no law against asking for information that can't be given. This does assume, however, that your mother does not have a legal right to the information (which could arise from some form of co-signing). Also, would assume that they have a normal privacy policy, and not one where they say "We will tell your mother if she asks" (they would have informed you of that, so read the privacy policy). This is a question best answered by your own attorney, to whom you would reveal all of the details.
Anything that helps you with your business and that you keep secret is a trade secret. The "keeping it secret" is an important part. Competitors are free to discover the same information themselves and use it, but stealing it from you is illegal. If a contractor needs to learn this information to do their job, you make them sign a non-disclosure agreement or confidentiality agreement which forbids them to pass that information on. That way, it remains a trade secret. If the contractor gives your trade secrets away, that is breach of contract and you can sue for damages. If a competitor pays your contractor to give them your trade secrets, that's not just illegal, it's criminal. On the other hand, if the contractor puts the information on his blog for example where everyone can read it, without having been enticed by someone to do this, then I believe your trade secret is gone and competitors can use it. Same as if you left documents on a park bench and your competitor finds them and reads them. You have to keep a trade secret a secret; if you fail to do so you lose. Asked about patents: If there is a non-disclosure or confidentiality agreement in place, then nobody can apply for a patent. The whole idea of a patent is that you get legal protection in exchange for disclosing your invention. Applying for a patent would mean violation of the non-disclosure agreement.
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.
This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked. Note that it is not necessary to consider &quot;enumeration&quot; here. Even just being able to check whether one person has a registered account raises the issue. The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added): Article 4(2): 'processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction So, disclosure of the fact that a user has a registered account amounts to &quot;processing&quot;. Article 6(1): Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of these, only (a) and (f) are likely to be of any relevance: (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give). That leaves us with (f). As noted by the Information Commissioner's Office, &quot;Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.&quot;. The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be &quot;necessary&quot; for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest. Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point. If the processing is unlawful then Article 18 is applicable: The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request. Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items: Article 13(1): Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: [...] (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.
That would require a change in the law. Names and salaries of public employees have been held to not be highly personal information exempt from the public records law. See Attorney General v. Collector of Lynn, 377 Mass. 151, Hastings &amp; Sons Publishing Co. v. City Treasurer of Lynn, 374 Mass. 812. This is part of the "diminished expectation of privacy in matters relating to their public employment" attaching to public employment.