Data controllers’ compliance with Section 10 notices: the ICO now assess.

I’ve written previously about the Information Commissioner’s assessment of organisations’ compliance with S10 notices. S10 is a mechanism by which a data subject can force a data controller to stop processing his/her personal data, or stop it from processing in a certain way, where such processing is causing substantial, unwarranted damage or distress.

Previously the ICO has always insisted that they can only assess organisations’ technical compliance with S10(3), i.e. whether the organisation has responded to the notice and whether such response was within the 21 day timescale. The ICO would not consider whether the organisation had broken the law by failing to comply with a valid notice.

The ICO have now changed their policy. The attached Lines to Take document now states:

an individual may make a request for an assessment under s.42 of the DPA where:

  • A data controller has not responded to a notice at all.
  • A data controller has not responded within the 21 day timeframe.
  • A data controller has not provided its reasons for refusing to comply with a notice.
  • A data controller has failed to comply with the data subjects request to cease processing.

That last point is new!

This draft Casework Advice Note goes into more detail.

Section 10(4) refers to the power of the court to order compliance with a section 10 notice.
The Commissioner is still able to make a s42 assessment on processing that may be in breach of the sixth principle (complying with a section 10 notice).

Failure to comply with a justified notice or failure to respond to a valid section 10 notice is a breach of the sixth principle.
The Commissioner can make an assessment of whether processing has been or is being carried out in compliance with the provisions of the DPA – in this case a breach of the sixth principle arising from a failure to comply with a data subject’s section 10 rights.

We can make an assessment of:

  • any non-compliant processing causing unwarranted damage or distress which means that the notice is justified; and/or
  • the data controller’s compliance with the procedural obligations under 10(3) to:
    • respond within 21 days of receiving the objection;
    • explain whether it intends to comply with the objection; and,
    • if it does not intend to comply with the objection in some way, give reasons for the decision.

You CAN also:

  • carry out a s42 assessment on whether the data controller has complied with its obligations under s10(1)

They’ve put “CAN” into Bold for the following reason (also in the draft Casework Advice Note):

Problems with the previous line on ASK knowledge base
The previous line said that:

‘the only situation where the ICO can get involved with a request made under section 10 is where the organisation hasn’t provided any response within 21 days, we cannot assist with any matters relating to compliance with the request….’

This line may have arisen as a result of our preferences or priorities in terms of the types of complaints we take on as an office where there is a technical limitation on our legal powers, or iit may be that we decided for operational reasons that we would not make assessments on a data controller’s compliance with their section 10(1) obligations.
Just because s10 refers to the powers of the court to order compliance with a section 10 notice does not preclude the Commissioner from making an assessment on processing that is in breach of principle 6.
Other sections of the DPA that relate to principle 6 refer to the order making powers of the court. For example, section 7(9) allows the court to order compliance with a SAR, but wouldn’t prevent the Commissioner from making her own assessment on whether or not a data controller should comply with a section 7 request.

It would seem that I have forced the ICO to reconsider their approach. Their internal dialogue on my complaint is entertaining. I particularly like the implied criticism:

In the present case, rather than referring his complaint about Sky’s processing to the Commissioner for an assessment, the data subject has tried to sort out the matter himself by issuing a section 10(1) notice.

How irresponsible of me 😀

Southern Rail’s disgusting treatment of wheelchair users

My valued friend and co-campaigner told me about his disgusting experience at the hands of Southern Rail staff. I have reblogged the below from the excellent Transport for All website.

I very much hope Southern Rail – and other rail providers – take it seriously. Their response to it doesn’t inspire confidence though; they clearly hadn’t even read it…


A very unpleasant experience for a wheelchair user at Clapham Junction

Blog by TfA member Chris. This blog and its content reflect the views of the author only.

Clapham Junction is a busy and important transport hub in South London, and I’m pleased to say that it has step-free access to all platforms, and wheelchair ramps on every platform.

But lifts and ramps are not enough to make a station disabled-friendly. The attitude and behaviour of the station staff matter hugely.

Last weekend I had an extremely unpleasant experience at Clapham Junction Station. It was not my first experience of rudeness and unhelpfulness from Southern Railway staff at this station, but it was certainly the worst.

I’m a wheelchair user. I arrived at platform 15 on Saturday afternoon, and asked a member of staff on the platform for assistance with a ramp to board a train.

His response to my request was curt and unfriendly: “Next train“, with a jab of the finger in the direction of the track, and with that he disappeared.

In itself this small moment of rudeness was not surprising, it’s what I have got used to at Clapham Junction when I interact with Southern Railway staff. But then things got much worse.

The train pulled in and I positioned myself by the door with the wheelchair logo, as I wanted to be placed in the wheelchair space on the train.

The member of staff I had spoken to didn’t come with a ramp. I couldn’t see him until everyone had boarded, and then I saw that he was at the back of the train with the ramp. I waved to him. He refused to move. I pointed to the doors with the wheelchair logo. He shouted that I had to board at the back of the train (where there was no wheelchair space). Some of his colleagues told me that I had to get on at the back. I said no, I wished to travel in the wheelchair space. The man with the ramp did not budge, and kept gesturing me to come towards him.

I did not want to travel in a part of the train without a wheelchair space because I do not consider this a safe or comfortable way to travel, so we reached an impasse. The man with the ramp let the train go, without me onboard.

He then came over and addressed me angrily, and with a staggering level of rudeness, telling me I should have boarded exactly where he wanted me to. I told him that I had wanted to be placed in the wheelchair space, as that was the only safe place for me to travel.

He was not displaying a name badge. I asked him three times for his name. Three times he refused, and then he walked away briskly, refusing to communicate with me any further.

He then placed the ramp flat down on the platform, near the platform edge, for several minutes, perpendicular to the track, in such a way that customers could easily trip over it, and possibly even fall onto the tracks.

After this I encountered a second member of staff. He too was extremely rude to me when I explained that his colleague had refused to allow me to board the train where the wheelchair space was. He told me that I was obliged to board the train exactly where the platform staff had decided.

He also make this extraordinary statement: “If you don’t know the rules, you shouldn’t come here“. This statement was too bizarre and silly to argue with, but it was also an act of intolerable rudeness.

This second member of staff also refused to give his name, and was not showing a name-badge.

Later they put me onto a train, in the wheelchair space as I had requested at first, and I was able to make my journey at last.

Disabled people should be able to travel with the same ease, flexibility, safety and comfort as everyone else. But I find again and again that I come up against unhelpfulness, rudeness, ignorance and inflexibility when I want to travel on Southern Railway train services. I do not believe that this company takes its responsibility to its disabled customers at all seriously.

A great deal needs to change before train services are truly accessible, and before wheelchair users can use them without stress, distress and annoyance. Transport for All continues to campaign for full accessibility across all of London’s transport networks. Please join us if you would like to support our campaigns – you can find out here how to become a member.


Reblogged from the Transport for All website.