Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty? Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store. Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head office. He requests any CCTV footage from the day in which he may appear. The corporate offices designated data protection officer receives his request and carefully reviews all of the day's footage to put together his formal response to Bob's request and soon realises why he is requesting the footage. Not wishing to cause a pr disaster for his employer, he decides to omit or accidentally not accidentally damage some of the most damning footage of the incidents. What legal consequences in practice might the DPO realistically face, apart from the pleasure of his employer and future job security? What recourse does Bob have if the DPO claims that all the footage provided is all the he appears in, even if it doesn't include the incidents motivating Bob's request, or to regretfully report to Bob that there was a technological failure and the footage from that day is irreparably destroyed? E&amp;W specified all welcome.
Spoliation of evidence, once a suit is filed The reason Bob requests the video from Alice Corp is not that he is concerned about his GDPR rights, it is because he wants to file a lawsuit. In fact, it would be super helpful if Bob had filed the lawsuit and served it together with the GDPR request, so there is a pending case... and added a paragraph that he demands the preservation of all evidence at that point. In either case, the sudden deletion of the files by their DPO Charly, after Alice Corp was put on legal notice that they have to preserve evidence, is spoliation, indeed, it would be the very definition: The intentional destruction or alteration of relevant evidence in existing or pending litigation. 1 The main remedy for spoliation is the imposition of a rebuttable presumption of fact that the lost or destroyed evidence would have been unfavourable to the party that destroyed it. This presumption can be rebutted by evidence showing that the “spoliator” did not intend to affect the litigation by destroying the evidence (McDougall v. Black &amp; Decker Canada Inc., 2008 CarswellAlta 1686 (Alta. C.A.)). So, we have the DPO performing spoliation, and thus the lawsuit for the beating will assume that the destroyed video showed exactly what Bob alleged that Alice Corp's security team did to him. in england-and-wales DPO Charly can be further sued for destroying evidence under Section 2 (16) Criminal Justice Act 1987. Spoliation might even happen before the case begins with filing &amp; summons According to an article by Chris Dale, discussion spoliation in england-and-wales the case of Earles v Barclays Bank Plc [2009] EWHC 2500 (Mercantile) (08 October 2009) was named as one of the best descriptions of spoliation in English law. That case indeed is illustrative, as it might be explicitly applicable to the case as described (emphasis mine): 28 [I]n this jurisdiction [Bermingham/England] as in Australia, there is no duty to preserve documents prior to the commencement of proceedings: British American Tobacco Australia Services Limited v. Cowell [2002] V.S.C.A. 197, a decision approved in this country by Morritt V.C. in Douglas v. Hello [2003] EWHC 55 at [86]. However, the leading text book in this area – Documentary Evidence by Charles Hollander QC- suggests in paragraph 10-06 of the 10th edition that &quot;there might be cases where it was appropriate to draw adverse inferences from a party's conduct before the commencement of proceedings.&quot; In my judgment there would have to be some clear evidence of deliberate spoliation in anticipation of litigation before one could legitimately draw evidential &quot;adverse inferences&quot; in those circumstances. There is no such evidential basis in this case. 29 After the commencement of proceedings the situation is radically different. In Woods v. Martins Bank Ltd [1959] 1 Q.B. 55 at 60, Salmon J. said &quot;It cannot be too clearly understood that solicitors owe a duty to the court, as officers of the court to make sure, as far as possible, that no relevant documents have been omitted from their client's list&quot;. 30 In the case of documents not preserved after the commencement of proceedings then the defaulting party risk &quot;adverse inferences&quot; being drawn for such &quot;spoliation&quot;: Infabricks Ltd v. Jaytex Ltd [1985] FSR 75. So, yes, we got it in a judgment from the High Court of Justice, Queens Bench Division, Birmingham District Registry, Mercantile Court: if it is extremely likely, that proceedings will begin shortly, destroying the video might be spoliation in anticipation of litigation, and thus be problematic even before proceedings started. As a remedy, an adverse inference might be drawn to the content of it. 1 - RESOURCE ID W-015-7809 © 2022 THOMSON REUTERS. ALL RIGHTS RESERVED.
Acme is bound by Bob's actions so long as they were conducted with "apparent authority" from the perspective of Client C and involved his work duties, even if he carried them out contrary to company policy - unless Client C knew for a fact that Bob was violating company policy and didn't have authority within the company to do so when he was doing these things. Acme, directly, or Acme's insurance carrier, in a subrogation suit after it has settled the claim from Client C, could probably sue Bob, especially if he willfully violated company policy for the purpose of harming client C. This is rarely done, but ultimately Bob owes duties to Acme which he violated which probably give rise to liability, although proving that and collecting the judgment would both be difficult. If Bob had authority within the organization to deviate from company policy, however, which he would have a good cause to claim that he did, this would be a full defense to such a suit, since Bob was always acting as a disclosed agent of Acme. Client C probably cannot sue Bob directly, whether or not it sues Acme. In contract matters (which this would include) a disclosed agent is not responsible for the acts he carries out on behalf of his principal. For example, an employee who signs a promissory note on behalf of a company in an official capacity as a disclosed agent of the company isn't responsible for paying the note. This is different than the rule in tort cases where the principal and anyone whose actions personally caused the tort caused the problem is liable. For example, if the employee got into a car accident that was his fault while he was driving on the job for the company, both the company and the employee would be liable to the person who was hurt. The circumstances that you describe sound more like a breach of contract than they do like a tort, so Bob would probably not have any personal liability to Client C. Could Bob or Acme (or both) face any criminal liability? Unless Bob was the CEO or other senior officer of the company, Acme wouldn't face criminal liability, because he is too far down the chain of command to cause Acme the entity to have the requisite criminal intent. Realistically, failing to "verify that equipment rental invoices match delivery records before notifying the client to approve the invoices for payment" does not amount to a crime no matter who does it. This might be careless or a breach of contract, but it is not fraud or theft because it lack the necessary criminal intent. If Bob actively photoshopped equipment rental invoices with a specific intent to defraud Client C, he would probably be criminally liable for fraud, although even that isn't an open and shut case as it still basically involves failure to perform a contract according to its terms and a mere breach of contract is generally not a crime unless you intended not to perform it in the first place, when you entered into the contract.
EU Member State Data Protection Authorities (&quot;DPAs&quot;) have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing administrative fines could enforce their (fine imposing) decisions outside the EU, even if the decision in question was confirmed by a court. For instance, in the Netherlands there is not a strong legal basis for the (mutual) recognition and enforcement of foreign administrative decisions. I could imagine that the same applies to other EU Member States. However, please note (possible) civil liability Your question seems to refer to enforcement of the GDPR under instruments of administrative / public law. Please note however that the GDPR can also be enforced by private individuals and organizations, e.g. through tortious liability claims. See for example Amsterdam District Court 2 september 2019, ECLI:NL:RBAMS:2019:6490 for a situation (albeit purely national), in which the Court awarded damages for a GDPR breach to a data subject. Possibly, a similar case could be brought against an entity outside the EU that processes data of EU data subjects, contingent upon the outcome of certain questions of International Private Law. With regard to civil damages, there is an extensive international legal framework that covers the cross-border enforcement of rewards for civil damages. Likely, such rewards for damages could more easily be enforced outside the EU. However, I must note that such (private) cross-border enforcement of the GDPR has not happened in practice (yet) either (as far as I know). (Please note that this answer assumes (per the question) that the GDPR is applicable and only deals with the question of the territorial aspects of subsequent enforcement. See about the territorial scope of the GDPR: What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?).
I'm not going to comment on the specifics of this law; rather, I think this question shows a misconception of the way the legal system works in general. Here's the question: do you actually have "legally privileged" material on your phone? If not, what's keeping you from claiming that is that it's not true, and lying to a police officer is a bad idea. And just putting a letter from your lawyer on the phone doesn't mean you've established a legal privilege--attorney-client privilege is not a magic spell, it's a reasonable system of protection that only covers certain communications. The bottom line is: the statute in general, and that clause in particular, were included in the law to protect real, important, and substantial legal right. The courts interpret the law in light of that purpose. If the police officer finds a solution that protects your rights while still carrying out the purpose of the statute, the court will be unlikely to fault him or her. In this case, if you tell the officer that there is a letter from your attorney in a particular folder, the obvious solution is for the officer not to open that folder. Problem solved. In practice, in the United States at least, these cases are dealt with routinely; computers are seized, and attorneys and judges work together to ensure that privilege is protected while still allowing reasonable access to seized materials. I would imagine the same is true in the U.K. The bottom line is: the law is not a game, and technical "gotchas" are rarely effective. Common law systems allow judges enough leeway to avoid this sort of pointless technicality.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
In answer to your questions, always get potential clients to sign a contract which covers the GDPR personal data processing requirements at a minimum, prior to giving them a copy of a consultant resume to retain. If you were sat in a meeting with them it is much simpler to record in your logs that the client had sight of the resume but was not left a copy of it in any format, than it is to keep track of which clients have a copy of which data and chasing up to ensure it is erased/destroyed when appropriate. To ensure clients treat the resumes as confidential, make sure they are labelled in the header and footer as confidential. They could also be kept in an envelope clearly marked confidential. There could also be a footnote in small print that informs anyone with a copy, who the data controller is, and that processing is strictly subject to the terms of the 'client contract' or whatever you call it, and that it should be returned or shredded within X days of receipt for example. If you have a computer system generate these it could even specify the client's name and the specific date it should be shredded by. Your notice could include a reminder that the personal data is protected under the E.U. General Data Protection Regulation (GDPR) 2016 and that (client name) as a data processor could be held liable in the event of unauthorised disclosure or processing, if they act outside or contrary to lawful instructions of the data controller. Whilst this won't enforce responsible processing at least it will ensure that your business has done its best to ensure any recipients are fully aware of their responsibilities to protect the information and it would be very difficult for a client to claim they weren't aware the information was confidential or that they had legally binding responsibilities to protect it. It's also worth noting that simply sending CV's/resumes (or other personal data) out via email (unless suitably encrypted) would not meet the requirement in GDPR recital 39 for personal data to be "processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing." Email technology whilst convenient does not offer any guarantees regarding privacy and confidentiality, therefore instead of sending resumes as email attachments it might be better to use a web-based extranet system which authenticates users before granting access to view resumes. Emails could just let clients know there is a new resume or X number of resumes waiting for them to review and give them a link/button to login. The records of processing activities are in GDPR Article 30 on page 50, and it does not specify a retention period nor that we can choose the retention period, but simply states that data controllers make the records available to the supervisory authority when requested to do so - this may imply indefinite retention of processing records even beyond the life of the processing system (e.g. discontinued products/services), however we may need to await further clarification on this issue from supervisory authorities to be sure.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame. There is an implied time limit though: personal data may only be processed/stored for as long as the data is necessary to achieve the purposes for which it was collected. Afterwards, it must be deleted. A controller with good data management will be able to limit their effort by having as short retention periods as possible for their different records. Furthermore, a lot of data is not personal data, or falls out of scope of the GDPR because it is not processed with automated means or forms part of a filing system. For example, if thousands of old invoices were archived in paper form in boxes that are only sorted by year, there might be an argument that this isn't a filing system in the sense of the GDPR and that a DSAR would not have to involve looking through all the archived invoices (compare also Art 11). In your scenario, there is a clear retention period of six years. You are asking for records about how that data might have been used further in the past. To the degree that such data is actually available, that could reasonably be personal data and should be included in a response to a DSAR. E.g. they might have information like this: “File #1234 was included in a data set that was sold to EvilCorp in 2007. The entries in File #1234 that are older than 2014 have been purged, so we do not know which entries were included in the data set. The current name on File #1234 is Dave.” This information about the sale would be personal data because it relates to you, and you are identifiable. Of course, the controller might not be set up to perform this search unless specifically asked. However, more unspecific information might not be personal data. For example: “About 70% of our files were included in a data set that was sold to EvilCorp in 2007. We no longer have records indicating whether your file was included.” Since there is no link between the sale and your personal data, I don't think it would have to be included in a DSAR response. The primary reason why you should be told about sales of personal data is that per Art 15(1)(c), you should be informed about “the recipients or categories of recipient to whom the personal data have been or will be disclosed” in a DSAR response. So when making a data subject access request, it could make sense to explicitly referencing this paragraph. So you would be interested in receiving a copy of your personal data as per Art 15 GDPR, and in particular any available information per Art 15(1)(c) GDPR about the recipients or categories of recipients to whom your personal data has been or may have been disclosed in the past. Quite likely the response will be underwhelming, e.g. by just giving a broad category such as “potential creditors who are contractually obligated to use the data only in accordance with our policies”. Whether such responses are compliant (I don't necessarily think so) will not be clear until there's a good precedent, and that would require that someone sorts this out in court.