SAR before claim: tactical and legal considerations A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data Protection Act 2018, and may be tempted to do so in order to have all available information at his disposal for maximum perspective and advantage in proceedings. Is there any way in which a SAR to a data controller with whom one has had no dealings for some years could disadvantage C in subsequent proceedings? For example, could either B or a judge draw any inference from C’s decision to submit a SAR?
I can't comment on tactical considerations, but legally there is nothing preventing submitting a Subject Access Request to support litigation. The case law has developed (and been somewhat inconsistent) over the years, culminating with the &quot;no other purpose&quot; rule being clarified by the Court of Appeal in Dawson-Damer v. Taylor Wessing LLP, [2017] EWCA Civ 74 by saying that... ...a SAR would not be invalid if it had been made with the collateral purpose of assisting with litigation. Delivering the leading judgment, Arden LJ noted (at paragraph 107) that the EC Data Protection Directive “makes it clear that the rights given by the Directive are to protect fundamental rights conferred by EU law. We have been shown nothing in the DPA or the Directive which limits the purpose for which a data subject may request his data, or provides data controllers with the option of not providing data based solely on the requester’s purpose”. Source and further reading
Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data. That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature. Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract. Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.
No Let's consider a similar scenario. If you made a beverage which poisoned a number of people, would you be absolved of liability because you gave it away for free? Of course not. As there is no contract between you, they would have to bring an action against you in the tort of negligence or negligent misstatement OR under consumer protection law. To succeed at tort they would need to prove that you owed them a duty of care; from Donoghue v Stevenson "You must take reasonable care to avoid acts or omissions which you can reasonable foresee would be likely to injure ... persons who are so closely and directly affected by my act that I ought reasonably have them in contemplation ...". Most cases will founder on your inability to foresee the use to which your software may be put. Consumer law is jurisdiction specific but they generally contain warranties that what you provide (gratis or otherwise) is fit for purpose, merchantable and that you do not make false and misleading statements. There is a chance that a case brought under this sort of law could succeed as you have not limited the purpose, specifically declared that it is not of merchantable quality and have (presumable) said what it does so that, if it doesn't do what you said, you have been misleading and deceptive.
There are two related aspects to this question: can multiple legal bases cover the same processing purpose, and how must this information be presented in the privacy notice? In the following, this answer will address the following sub-questions, listed here alongside a short summary. Do you need a clear mapping between processing purposes and corresponding legal bases? Yes, such a mapping is effectively necessary to satisfy your GDPR obligation to be able to demonstrate that all your processing activities are covered by a legal basis. If one legal basis doesn't work out, can you fall back to a different one? No. This is nonsensical considering how the individual legal bases work. However, it is possible that similar processing activities serve different purposes under different legal bases, and it can be worth evaluating different legal bases when trying to determine which one you should rely on. How should legal bases be presented in a privacy notice? While a Termly-style generic list of potential legal bases is common, there are good reasons to believe that this fails to achieve the GDPR's transparency goals. It is better to clearly associate each processing purpose with its legal basis. Appendix: positive examples of structuring a privacy notice Do you need a clear mapping between processing purposes and corresponding legal bases? Yes, the data controller must always have a clear understanding regarding which processing activity is conducted under which legal basis. Under Art 5 GDPR, personal data shall only be “collected for specified, explicit and legitimate purposes” and processed “lawfully, fairly and in a transparent manner”. “The controller shall be responsible for, and be able to demonstrate compliance with [these obligations]”. To be able to demonstrate that each processing activity is covered by a legal basis, it is necessary in practice to have a document that spells out the specific legal basis relied upon for each processing purpose. Some data controllers are formally required to maintain such Art 30 Records of Processing Activities (ROPAs), but keeping track of core information makes sense for all data controllers. The ICO writes in their guide on lawful basis for processing: You need therefore to keep a record of which basis you are relying on for each processing purpose, and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies. This will help you comply with accountability obligations, and will also help you when writing your privacy notices. It is your responsibility to ensure that you can demonstrate which lawful basis applies to the particular processing purpose. If one legal basis doesn't work out, can you fall back to a different one? Probably not. Processing for different purposes. In some cases, it will happen that data is processed for one purpose initially, and for another purpose under a different legal basis subsequently. For example, a web shop might collect payment information in order to execute a contract to buy goods. But once that contract is fulfilled, it is likely that the webshop will have to archive some of that information for multiple years due to legal obligations around financial recordkeeping. While in both cases the processing activity is similar (storage of the information), the purpose is different and so the legal basis can differ. In this context, it is useful to consider Art 6(4), which discusses when data that collected for one purpose can be reused for another purpose. This is possible whenever those purposes are “compatible”. Multiple legal bases for the same purpose. Some data controllers try to apply multiple legal bases to the same processing purpose, in the hope that some will stick. For example: We're showing personalized ads based on your consent. But if you decline consent we will show you personalized ads because we have a legitimate interest in making money. And if you object to the legitimate interest then showing you personalized ads is necessary for performance of a contract we have with you, namely in section 7(23)(f)(ii)(ξ) of our terms of service where “Service shall make reasonable effort to ensure that Content shown is relevant to User”. This doesn't work. Specifically in the case of consent, consent can only ever serve as a legal basis if the data subject has an actual choice. If the data controller just falls back to a different legal basis in case consent is declined or withdrawn, that choice is hollow. Similarly, having a fallback for legitimate interests makes no sense. The core aspect of a legitimate interest is that there must be a balancing test between the legitimate interests and the data subject's rights and interests. A legitimate interest can only serve as a legal basis if it outweighs the data subject's interests. A core factor here is whether the data subject can reasonably expect their data to be processed for the given purpose. Data subjects can object to the legitimate interests, which may make it necessary to re-run the balancing test taking into account the objecting data subject's individual circumstances. But it is quite possible that the legitimate interest still overrides the data subject's interests, so that processing can continue. On the other hand if the objection prevails, it is difficult to conceive a scenario where there could exist some fallback legal basis to continue despite the successful objection. Specifically for the issue of using Art 6(1)(b) necessity for performance of a contract instead of other legal bases, the EDPB has published guidelines 2/2019. They explain that whether processing is indeed “necessary” must be considered from the perspective of the data subject, so that many purposes like “service improvement” or advertising cannot be covered by this legal basis. Something does not become truly necessary for a contract just because it was unilaterally inserted into a terms of service document. Determining an appropriate legal basis. However, thinking in terms of fallbacks can be quite useful for determining an appropriate legal basis. In general, legal obligations or necessity for performance of a contract should be considered first, falling back to a legitimate balancing test otherwise. Consent is a choice of last resort when no other legal basis would apply, since consent can authorize nearly any processing activity, no matter how risky or disadvantageous to the data subject, if the consent was obtained in a valid manner. How should legal bases be presented in a privacy notice? The GDPR is slightly ambiguous here. Per Art 13(1)(c), your privacy notice must provide the purposes of the processing for which the personal data are intended as well as the legal basis for the processing It is possible to interpret this in two ways: you list the purposes of processing, and separately any legal bases that you may rely on for any purposes; or you list the purposes of processing, and for each purpose you also list which legal bases you rely on for that specific purpose. Providing an abstract list of legal bases. You very commonly see the first approach, that essentially just summarizes Art 6(1) GDPR for the convenience of the reader. This boilerplate approach is of course attractive for privacy policy generators that do not understand the context your specific processing purposes. While the relevant EDPB guidelines on transparency don't take a clear stand on this matter, I have doubts that this first approach is fully GDPR compliant. This fails to provide required transparency. The Art 13 and Art 14 information obligations are an expression of the Art 5 GDPR principles like “lawfulness, fairness and transparency”. Merely listing any potentially applicable legal bases does not make it transparent to the data subject what data is being processed under which rules. But knowing the legal basis covering a particular processing activity has direct impact on the data subject's rights such as the right to revoke consent, to object to legitimate interests, or to erasure. This fails to specify the actual legal basis. Such a generic listing might also fail to fully satisfy the conditions for certain legal bases. Where the legal basis is a “legal obligation”, it is not sufficient to generically refer to legal obligations in abstract. Rather, Art 6(3) says that The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by: (a) Union law; or (b) Member State law to which the controller is subject. Thus, I would expect a fully compliant privacy notice to actually reference those laws, at least in a general sense (e.g. compliance with court orders, or for financial recordkeeping). Specifically in the case where legitimate interests are used as the legal basis, Art 13(1)(d) says that those legitimate interests shall be provided. Guidance from the EDPB WhatsApp decision. While the Transparency Guidelines linked above are not excessively helpful here, there is a body of regulatory interpretation for example in the form of the EDPB binding decision 1/2021 regarding WhatsApp. In section 5.1, it is discussed whether the WhatsApp privacy notice at the time satisfied Art 13(1)(d). Here, the EDPB quite unambiguously argues that only the second approach – per-purpose information – can be compliant. From para 56 and 59 in the decision: The EDPB is of the view, […] that providing full information on each and every processing operation respectively is the only approach that will ensure that the data subjects can: (a) exercise choice as to whether or not they might wish to exercise any of their data subject rights and, if so, which one(s); (b) assess whether or not they satisfy any conditionality associated with the entitlement to exercise a particular right; (c) assess whether or not theyare entitled to have a particular right enforced by the data controller concerned; and (d) assess whether or not they have a ground of complaint such as to be able to meaningfully assess whether or not they wish to exercise their right to lodge a complaint with a supervisory authority. […] The EDPB considers that in the Legal Basis Notice WhatsApp IE has not specified the provided information with regard to the corresponding processing operation such as information about what categories of personal data are being processed for which processing pursued under basis of each legitimate interest respectively. Practical impact. Termly's templates fall short of this standard, but their fine print also makes it clear that their service does not provide legal advice and that they aren't responsible for anything. It may also be worth considering that your privacy notices will likely face less scrutiny than WhatsApp, as in the decision cited above. That a very strict standard was applied to WhatsApp also has to do with Facebook's/Meta's/WhatsApp's history of playing games around appropriate legal bases and its extremely large user base, also involving children, making it very important to provide clear and comprehensive notices. Appendix: positive examples of structuring a privacy notice My suggestion would be to think about these transparency obligations in a tabular manner where you have an Excel sheet with columns for purpose, data involved, retention periods, and legal basis: purpose data retention legal basis personalized ads cookie identifiers, interest profile 6 months Art 6(1)(a) consent server security logs IP address 3 months Art(6)(1)(f) necessary for legitimate interest showing comments to other users username, comment until you delete the comment Art 6(1)(b) necessary for performing service ... ... ... Many data controllers will have exactly such information anyway when they keep Art 30 Records of Processing. Based on these records, it is then possible to write an accurate and understandable privacy notice that clearly relates processing purposes with other required information. I have seen privacy notices that use exactly such a tabular approach, though it's more common to provide a sub-section per purpose. For example: Purposes for which we process your personal data: Personalized ads. If you give consent (Art 6(1)(a) GDPR), we will show you personalized ads. For this we will set a cookie identifier (→ about cookies), and collect a profile of your interests based on the content that you interact with. The profile will be deleted 6 months after you last interact with our site. ... Showing comments to other users. When you post public comments, we will show them to other users. Providing this service is necessary to perform our contract with you (Art 6(1)(b) GPDR). The comment will publicly display your username, the date when you posted the comment, and the contents of the comment. The comment will be shown indefinitely, but you can delete it at any time (→ help center). Such an approach also fits well with a “layered approach” to transparency, where you split the information of the privacy notice across multiple pages, so that data subjects only have to read about those processing activities that are relevant to them. For example, an online marketplace company might have different notices covering browsing the listings on their site, buying a product, seller-side activities, and their employee recruiting processes. Another reasonably good approach I've seen is to have a section per aspect required by the GPDR, and to then provide a list that goes through each processing purpose. This is essentially a flattened version of the above table: Processing purposes: personalized ads server security logs showing comments to other users Legal basis for processing purposes: for personalized ads: your consent pursuant to Art 6(1)(a) GDPR for server security logs: our Art 6(1)(f) GDPR legitimate interest in ensuring the security of our services against hacks, DDoS attacks, or other criminal acts for showing comments to other users: Art 6(1)(b) necessity for performing our contract with you: showing comments is a core feature of our website, as covered by our terms of service (→ link). Which data is processed: for personalized ads: cookie identifiers, interest profile based on the content you interact with for server security logs: your IP address, a timestamp, and which pages you visit on our site for showing comments to other users: your username, date when you posted the comment, and the contents of the comment How long your data is kept: ...
Art.5(1)(f) contains: Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). Art. 25 and Art. 32 also contain similar requirements. What is appropriate has to be determined, as the GDPR does not contain an exact definition. However as processor you don't have to worry about that, as Art.5(2) Contains: The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). But you need to inform the controller if you think an instruction violates the GDPR. But it is up to the controller to decide what to do. Art. 28(3) requires a contract between controller and processor which requires the processor to: (...) that the processor: (c) takes all measures required pursuant to Article 32; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. But again, the controller is responsible for this contract.
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.
National security letters can compel the production of some kinds of (non-&quot;content&quot;) user data, and (according to Wikipedia) typically contain a nondisclosure requirement forbidding the recipient of the letter from disclosing it. I assume that a witness has received and complied with a national security letter, and a non-government party wants to ask the witness questions which outside the courtroom, the witness would be forbidden to answer by the national security letter. The witness, or the government if represented in the lawsuit in question, may object to the questions. The purpose which justifies the secrecy requirements of a national security letter is also likely to justify the exercise of state secrets privilege. If the judge thinks a statute might otherwise be violated, they might intervene in the absence of any objection, or consider alternative remedies like an in camera hearing. If the court does not intervene to prevent the evidence being given, and the witness is charged with breaching the secrecy law, this would raise complex questions about the interpretation of the law imposing criminal penalties. The common law doctrine of absolute privilege for witnesses giving evidence in judicial proceedings applies in the United States, and could be raised in defence to any criminal charges.
I'm not going to comment on the specifics of this law; rather, I think this question shows a misconception of the way the legal system works in general. Here's the question: do you actually have "legally privileged" material on your phone? If not, what's keeping you from claiming that is that it's not true, and lying to a police officer is a bad idea. And just putting a letter from your lawyer on the phone doesn't mean you've established a legal privilege--attorney-client privilege is not a magic spell, it's a reasonable system of protection that only covers certain communications. The bottom line is: the statute in general, and that clause in particular, were included in the law to protect real, important, and substantial legal right. The courts interpret the law in light of that purpose. If the police officer finds a solution that protects your rights while still carrying out the purpose of the statute, the court will be unlikely to fault him or her. In this case, if you tell the officer that there is a letter from your attorney in a particular folder, the obvious solution is for the officer not to open that folder. Problem solved. In practice, in the United States at least, these cases are dealt with routinely; computers are seized, and attorneys and judges work together to ensure that privilege is protected while still allowing reasonable access to seized materials. I would imagine the same is true in the U.K. The bottom line is: the law is not a game, and technical "gotchas" are rarely effective. Common law systems allow judges enough leeway to avoid this sort of pointless technicality.