Would changing your signature bar you from getting a UKVI SAR? I am in the process of trying to submit a SAR (Subject Access Request) to UK Visas and Immigration (UKVI), but, I have read this paragraph: your signature and the date, within the last 6 months – please note your signature as well as your photo identification is used to verify that the person making the request is entitled to do so However, I have radically changed my signature since the last time I had to pass through UK Immigration (which is the last record they have on file of me). Would a DPO (Data Protection Officer) be able to reject my request on the basis that my signature is not at all what they have on file? (My photography is still recognizable from the one on their record though.)
The law, at section 52(4) Data Protection Act 2018 does not expressly require a signature. What is needed is confirmation of one's identity: Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may— (a) request the provision of additional information to enable the controller to confirm the identity, and (b) delay dealing with the request until the identity is confirmed. One option is to submit the request with an explanation as to why your signature has changed and wait and see if the data controller comes back for additional information. If you can't provide anything more, or they still won't process your request if you do, there's alway the option of appealing to the Information Commissioner's Office
The case that you mentioned isn't an example of what you're talking about. One thing that immediately comes to mind is the Shamima Begum case. She fled her London home to join the Islamic state but now she wants to come back to the UK (after realizing), but UK's Home Office revoked her citizenship, claiming that she could claim Bangladesh citizenship by descent even though she isn't a citizen of Bangladesh at the time of revocation. No, they are claiming that Shamima Begum is a citizen of Bangladesh at the time of revocation. According to section 5 of Bangladesh's Citizenship Act 1951, a child born abroad to a Bangladeshi citizen father is automatically (&quot;shall be&quot;) a Bangladeshi citizen by descent at birth. (Mothers were allowed to pass on citizenship after 2009, but that was after Begum was born.) Note that registration at a Bangladeshi consulate within 1 year of birth is only necessary in the case where the father is a Bangladeshi citizen by descent. I believe Begum's father was a Bangladeshi citizen otherwise by descent, in which case no registration or other action is necessary for her to be a Bangladeshi citizen at birth. It doesn't matter that she has never been to Bangladesh nor does it matter that she never claimed to be a Bangladeshi citizen. There were two men of Bangladeshi descent in a separate case who successfully fought their revocation of British citizenship, but the difference between their cases and Begum's case was that they were over 21, which she was under 21 at the time of revocation. Section 14 of Bangladeshi's Citizenship Act provides that someone with dual citizenship automatically loses Bangladeshi citizenship if they don't renounce their other citizenship, but this provision doesn't apply to those under 21. So these two men had Bangladeshi citizenship too, while they were under 21, but they lost it when they turned 21, before their supposed revocation of British citizenship, whereas for Begum, she hadn't lost Bangladeshi citizenship at the time of the revocation of her British citizenship, because she hadn't turned 21. (Perhaps you got the idea of &quot;claiming&quot; of citizenship from some report that one can &quot;claim&quot; Bangladeshi citizenship by descent while under 21, and these men failed to claim it, but Begum can still &quot;claim&quot; it. But if you read the text of the law, that is clearly not the case. For a child born to a father who was a Bangladeshi citizen otherwise than by descent, there is no &quot;claim&quot; of citizenship -- it is automatic and involuntary at birth.) As to your question, there are no universal restrictions to how a country can grant or take away citizenship. There is the 1961 Convention on the Reduction of Statelessness, which countries may voluntarily join, but only a minority of countries of the world are party to the convention. Article 8 of the Convention does prohibit countries that are party to the Convention from depriving someone's citizenship if it would &quot;render him stateless&quot;, though there are several exceptions including if the citizenship was obtained through fraud or misrepresentation. The language seems to require that the person already have another citizenship, not just have the ability to acquire one, though I am not sure how much leeway countries have to interpret this. In the case of the UK, it is a party to the Convention, and it has largely implemented the provisions of the Convention in its domestic law. With respect to deprivation of citizenship, section 40 subsection (4) of the British Nationality Act 1981 prohibits a deprivation order if the Secretary &quot;is satisfied that the order would make a person stateless.&quot; (Subsection (4A) has a looser restriction where British citizens by naturalization can be deprived of citizenship if the Secretary believes that the person is able to become the national of another country. I am not sure whether this is compatible with the Convention. In any case, this is not relevant to Begum's case as she was not a British citizen by naturalization.) So if the UK were to try to deprive citizenship of a British citizen otherwise than by naturalization like Begum, not on the basis that the person already has another citizenship but on the basis that they are &quot;eligible&quot; to &quot;claim&quot; one (which as I described above I do not believe is the case for Begum; I am talking hypothetically if such a case were to arise), that can already be challenged as a violation of British law, in British courts, without considering the UK's obligations under the Convention. If it's another country that's a party to the Convention, but their law expressly allows deprivation of citizenship for being &quot;eligible&quot; to acquire another citizenship even though the person doesn't have one (including, perhaps, British citizens by naturalization deprived citizenship under section 40(4A)), and a person in that situation is deprived of citizenship, they don't really have any recourse. A private party cannot &quot;sue&quot; a country over any violations of the Convention in an international court.
The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100). The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so. Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.
The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases. From Art 12(3) GDPR (emphasis mine): The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. You have not received a response in that timeframe, so the data controller has failed to meet its obligations. The polite thing to do would be to remind them that the time has run out, and that you would like a response ASAP. You can lodge a complaint with your supervisory authority. A letter from the data protection authority tends to speed things up a lot :) In principle, you could sue them to get a response. In practice, this is likely to be too expensive to be worth it.
Am I correct in arguing that the LHD never really had implied consent to begin with? In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent? No. They had implied consent and had not intent at the outset to dishonor it. They have violated the patient's privacy right when consent was expressly withdrawn, and they discovered that they cannot easily comply and therefore did not comply. The fact that they have made it expensive for themselves to comply with their legal obligations going forward does not imply that they lacked implied consent at the outset, so they should have no liability for the time period from when the training materials started to be used until the time when implied consent ended. They are only responsible going forward for their failure to honor the patient's wishes. It is not at all exceptional for a legal obligation to turn out to be more difficult to comply with when it arises than was anticipated when the systems that make the legal obligation difficult to comply with were implemented. Health care companies aren't expected to be prophets who can foresee the complex confluence of factors that has painted them in a corner, particularly when a situation has never come up before the current one. It is likely that no one person was ever even simultaneously aware of all the facts necessary to know that this could happen. Someone in the IT department will often not be intimately familiar with what is going on in the training part of the operation and what the privacy rules that apply are and even if someone was, that someone may have been in no position to do anything about it at the time. Health care providers aren't supposed to be evaluated with 20-20 hindsight. Given that they almost surely did not and could not easily have known that they had made a future express withdrawal of consent very difficult to effectuate, scienter can't be attributed to it. And, honestly, they are in more than enough trouble simply trying to deal with the problem post-express withdrawal of consent when they did start to violate privacy laws.
You are right, the entry and exit photos are only evidence that you were there. This is something they need to prove so the photos may only be for that. Their statement that you didn’t display a valid ticket/permit is, at present an unevidenced assertion. If you contest this, they will provide evidence that you didn’t (e.g. the actual records they refer to) and you would provide evidence that you did and, if it goes to court, the judge will decide what evidence they prefer. As this is not a criminal matter, they need to prove the offence on the balance of probabilities. However, there are almost certainly administrative remedies which will allow you to contest the fine without going to court. This would involve you sending them a copy of the permit and them assessing whether their belief that you didn’t display it is justified or not.
The 2018 Data Protection Act specifically implemented the GDPR EU Regulation in the UK - while the regulation itself was directly binding it required member states to create their own legislation for implementing the details - setting up the required supervisory and accreditation bodies etc. The various 'opening clauses' in the regulation also provided the means for the members states to implement specifics in local legislation (so long as that legislation exceeded the minimums set out in GDPR). At the end of the Brexit transition period the UK was no longer a member state (and it's citizens were no longer EU citizens), keeping the DPA 2018 as was would have actually meant that UK citizens weren't eligible for the very protections it was intended to provide them! Therefore the basis of the law needed updating (as well as certain minor provisions that no longer made sense) hence the &quot;UK GDPR&quot; provided a substitute. The fundamentals are the same and crucially it also codified the necessary basis for the UK's data protection laws to have what is referred to as &quot;adequacy&quot; - which means that the EU considers the UK GDPR/DPA to provide &quot;essentially equivalent&quot; levels of protection and therefore data is allowed to continue to flow between the UK and the EU.
If I have correctly untangled the law, Schedule 2 of the Data Protection Act part 3 identifies as a condition where you are not prohibited from revealing personal data: The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. The Animal Welfare Act 25(1) says An inspector may require the holder of a licence to produce for inspection any records which he is required to keep by a condition of the licence I can't tell if you are required to keep customer names, but if you are, it looks like the pieces fit together and you would have to provide the records. Call a solicitor to be sure, though.