Does showing the county council my customer records break the Data Protection Act? I run a home boarding dog business. As part of their home check for licensing conditions the local council demanded to see my customer records. As these include names,addressees, telephone numbers and email details as well as details of their pet dog I refused saying this was against the Data Protection Act to do so without the customers' written permission. The council employee told me it was her right to see the records under the Animal Welfare Act. Am I correct to refuse under the Data Protection Act? I showed her the blank forms of the information the customer provides but not the actual completed forms, which she demanded to see. Would someone be able to advise me of my and more importantly my customers' legal rights in this situation please?
If I have correctly untangled the law, Schedule 2 of the Data Protection Act part 3 identifies as a condition where you are not prohibited from revealing personal data: The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. The Animal Welfare Act 25(1) says An inspector may require the holder of a licence to produce for inspection any records which he is required to keep by a condition of the licence I can't tell if you are required to keep customer names, but if you are, it looks like the pieces fit together and you would have to provide the records. Call a solicitor to be sure, though.
Of course it is illegal. You are attempting to access somebody's data without their knowledge and certainly without their consent. In the U.K. it is a crime under the Computer Misuse Act 1990, the Police and Justice Act 2006 and the Serious Crimes Act 2015. The clue here should be in the term Serious Crimes. The Human Rights Act, and indeed the ECHR, should never come into it unless it was state sponsored or corporate spying. And even then certain states have given themselves Orwellian totalitarian authority to do as they please.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
According to The official government page &quot;Freedom of information (FOI)&quot; FOI only applies to FOI bodies. These are mostly bodies that are publicly funded (for example, government departments). If you want to apply for records that are held about you by a private organisation, you can apply under data protection laws. FOI allows the public to have information about what the Government is doing and it is often used by journalists, campaigners and opposition parties. ... Organisations that are covered by FOI FOI laws apply to public bodies unless they are exempt. FOI bodies include: Government departments Bodies that were set up by an Act of the Oireachtas (for example, the Consumer and Competition Authority was set up by the Consumer and Competition Protection Act 2014), or established by a Minister or the Government A company where the majority of the shares are held by or on behalf of a Minister of the Government, or any of its subsidiaries A higher education institute that is publicly funded Some non-public bodies that get a lot of public funding Unless the company you are dealing with is an &quot;FOI Body&quot; it seems that the Irish FOI will not apply. The official Irish Government page on &quot;How to access your personal data under the GDPR&quot; states: Make your request in writing Ask as soon as possible and in writing. This can either be by letter or email. Seeking your personal data is known as making an access request or a data subject access request. You should state in the letter or email that it is an access request. This means that both you and the data controller will have a record of the request and its content if an issue later arises. Some large companies allow you to automatically download your personal information directly through their website. Contact the relevant data protection officer Many large organisations have a Data Protection Officer (or DPO) and they are generally the best person to contact about your request for information. You should be able to find their contact details in the privacy policy or ‘contact us’ section of the organisation’s website. Where there is no specific email address for a data access request, you should use the organisation’s general contact details. ... How will the company or organisation deal with my request? The data controller must respond to your request within one month. However, if you complain to the Data Protection Commission, the organisation may be given some extra time if it missed the deadline as a result of COVID-19. If the request is complex or involves a large amount of information, the data controller can extend the time to respond by a further two months. You should receive a written explanation for any extension within the initial one-month period. If your request is very broad and requires the data controller to provide a large amount of information and documents, you may be asked to reduce the number of documents containing personal data requested. However, you can insist on receiving all the information and documentation held. If you do, it may take longer to comply with your access request. In general, the data controller should respond to your access request in the same format the request was made, or in the way in which you specifically asked for a response. For example, if you emailed your request, the data controller should provide the information by email, unless you request otherwise. ... What can I do if I am unhappy with the outcome of an access request? If you are unhappy with the way your access request was processed, you can make a complaint to the Data Protection Commission (DPC)](https://www.dataprotection.ie/). The DPC is Ireland’s independent authority with responsibility for upholding the right of people in the EU to have their personal data protected. It monitors compliance with GDPR and other data protection legislation and deals with complaints in relation to data protection breaches. The DPC website contains helpful explanations of data protection law. You may be unhappy with the way your request was handled because: There was no response or a delayed response to your access request The response to the request was incomplete You believe the data controller wrongly relied on exemptions to not share your personal data with you How do I make a complaint? Complete the DPC’s online complaint form. You will be asked to provide evidence to support your complaint. This includes: Evidence of your access request Correspondence between you (or your legal representative) and the data controller and information in support of your belief that the data controller holds your personal Information The GDPR provides the right of access to one's personal information under Article 15, but leaves the details of times for response and handling of complaints to the national data protection authority and to national law. In the case of Ireland this is the Irish DPC. The GDPR dos not provide a right of private action (that is the right to bring an individual lawsuit) to enforce its data access provisions.That can only be done through a complaint to a national data protection authority.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
This depends on the context – GDPR rarely restricts the use of specific kinds of data (see Art 9) but instead regulates the processing of this data, and the purposes for which it is processed. Personal data is any information relating to an identifiable person (Art 4(1)). So to show that some information is not personal data, you must show either that it doesn't relate to the identifiable person, or that it's not possible to identify the person. Whether a person is identifiable depends on the means of identification that are reasonably likely to be used, taking into account the cost and effort of these means (Recital 26). This recital also mentions that singling out a person is a kind of identification. If you have lots of birthdays so that there are no unique birthdays, or if the birthdays are stored without contextual information that would allow identification, this can indicate that it's not personal data. Some examples to illustrate my views: Scenario 1: you are collecting statistical data in a shopping mall and are collecting birthdays from passer-bys, without any additional information. This information is anonymous and not personal data, since you have no reasonable means to identify the persons. Scenario 2: in an office, there's a publicly visible calendar on the wall with the birthdays of all staff members. However, the calendar doesn't say whose birthday it is. This information is likely personal data, since it's reasonably possible to infer the correct person based on contextual information. At least HR would also have the birthday for all staff members on file, so that the company clearly has the means to identify anyone. (This doesn't mean such a public calendar is illegal, just that there must be a legal basis.) It is more difficult to determine whether information also relates to an identifiable person, i.e. whether this information is about that person. This depends not just on what the information is, but how the information is used. AFAIK there has yet to be EU-wide guidance by the EDBP, but the ICO has listed some hints. I think that a birthday of an identifiable person will almost always relate to that person.