Internet Usage for Information Gathering

Link: [1]File-List

22 September 2009

Case Reference Number ENQ0270256

Dear Mr Morris

Thank you for your email dated today.

Although your email is entitled ‘Freedom of Information request’, it
is not a request for recorded information held by the Information
Commissioner’s Office. As you are asking us to ‘advise on the use of
the internet to gather personal information and to use that information
acquired’, your request is best treated as part of normal course of
business. Therefore I have forwarded your email to our Customer Service
team, who will respond to you as soon as possible.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. file:///tmp/rad3CDC9_files/filelist.xml

Link: [1]File-List

23 September 2009

Case Reference Number ENQ0270256

Dear Mr Morris

Thank you for your correspondence dated 22 September 2009, regarding the
use of the internet to gather personal information.

As you might be aware, the Information Commissioner is a UK independent
supervisory authority reporting directly to the UK Parliament. The
Commissioner enforces and oversees the Data Protection Act 1998 (DPA)
within the UK and the Freedom of Information Act 2000 (FOIA) within
England, Wales and Northern Ireland.

The Information Commissioner advises on and enforces the Data Protection
Act 1998 (DPA) which is based around 8 principles of ‘good information
handling’.

The First Data Protection Principle requires that Data Controllers should
ensure that they have at least one legitimate basis for processing all
personal data, that the processing is ‘lawful’ and they must ensure
that any such processing is ‘fair’. When we talk about fair processing
we generally mean ensuring that the Data Subject is made fully aware,
wherever possible, of anything that is going to happen to their data which
they wouldn’t necessarily expect.

In the general circumstances you have outlined, an organisation processing
personal data would need to ensure that they complied with the 8
principles, including the above principle.

With regards to the FOIA, I must inform you that this legislation only
applies to ‘public authorities’. Further details about the FOIA, can
be accessed via the following link:

http://www.ico.gov.uk/for_the_public/acc...

If you require any further advice or assistance please contact our
Helpline on 01625 545745.

Yours sincerely

Andrew Walsh

Case Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. file:///tmp/rad0F7AA_files/filelist.xml

Link: [1]File-List

07 October 2009

Case Reference Number ENQ0270256

Dear Mr Morris

Thank you for your email dated 29 September 2009, regarding the alleged
activities of large interest search engines and their use of personal
data.

As I have previously outlined, the Information Commissioner advises on and
enforces the Data Protection Act 1998 (DPA) which is based around 8
principles of ‘good information handling’. If you believe an
organisation is not complying with the Data Protection principles, you may
wish to submit a complaint to this office so that we can consider the
matter. Details of how and when to complain can be accessed via the
following link:

http://www.ico.gov.uk/complaints/data_pr...

As we cannot progress your complaint without the information we have asked
for it will now be closed until you return the form to us.

If you require any further advice or assistance please contact our
Helpline on 01625 545745.

Yours sincerely

Andrew Walsh

Case Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. file:///tmp/radBDB13_files/filelist.xml

Link: [1]File-List

20 October 2009

Case Reference Number IRQ0271725

Dear Mr Morris

I am writing in response to your email dated 22 September 2009 in which
you write;

‘Will you please therefore supply all recorded information concerned
with the above subject.”

This is further to your first email in which you write;

“Can you advise on the use of the internet to gather personal
information and to use that information acquired. I understand that
companies that provide search engines for the internet may also sweep the
internet for personal data and to pass it on to others. Do these companies
meet the requirements of the FOI Act and the data protection act? What is
the position of the ICO with respect to such matters?”

Your original email was treated as a normal course of business enquiry.
However, as you have asked for all recorded information concerning this
topic, we have considered this request under the Freedom of Information
Act 2000.

We do not hold any information that specifically answers your questions.
You have been provided with a response to your enquiry by Andrew Walsh on
23 September 2009 and 7 October 2009.

If interpreted as any information relevant to your questions, this may be
in a number of places. Searching our case management system for ‘request
for assessment’ cases made under the Data Protection Act 1998 relating
to internet companies, brings back 627 cases. This is likely to represent
only a small proportion of the information that may be of relevance to
your request. If it took 5 minutes per case to manually search these, it
would take in excess of 50 hours to extract any information. Section 12 of
the Freedom of Information Act 2000 makes clear that a public authority is
not obliged to comply with a request if the authority estimates that the
cost of complying with it would exceed the ‘appropriate limit'. The
‘appropriate limit’ for the ICO, as determined in the ‘Freedom of
Information and Data Protection (Appropriate Limit and Fees) Regulations
2004’ is £450. We have determined that £450 would equate to 18 hours
work.

 

In order to locate any information that may be of relevance to you, we
would require further information about what information you specifically
require. This would be treated as a new request for information.

If you are dissatisfied with this response and wish to request a review of
our decision or make a complaint about how your request has been handled
you should write to the Internal Compliance Team at the address below or
e-mail [2][email address]

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request
received after this time will only be considered at the discretion of the
Commissioner.

If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the Case Reception Team, at the address below or visit the
‘Complaints’ section of our website to make a Freedom of Information
Act or Environmental Information Regulations complaint online.

 

A copy of our review procedure is attached.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. file:///tmp/rad82913_files/filelist.xml
2. mailto:[email address]

Link: [1]File-List

18 November 2009

Case Reference Number IRQ0275338

Dear Mr Morris

I am writing in response to your email dated 23 October 2009 in which you
write;

“Can you advise with respect to the main search engines including yahoo
Google etc.”

This is further to previous emails in which you ask;

“Can you advise on the use of the internet to gather personal
information and to use that information acquired. I understand that
companies that provide search engines from the internet may also sweep the
internet for personal data and to pass it on to others. Do these companies
meet the requirements of the FOI Act and data protection act? What is the
position of the ICO with respect to such matters?”

Firstly, to clarify, Yahoo and Google are not subject to the Freedom of
Information Act 2000.

I have spoken to our Data Protection Policy department and they have
confirmed that we hold meetings with Yahoo, Google and other stakeholders
to ensure compliance with all aspects of the Data Protection Act 1998. Any
personal information collected by search engines must be processed in
accordance with the Data Protections Principles, set out in the Data
Protection Act 1998. Both Yahoo and Google have privacy notices at the
bottom of their homepages setting out how they collect and process
personal data. These can be found below;

[2]Google’s Privacy Policy

[3]Yahoo’s Privacy Policy

The ICO has produced a Code of Practice on privacy notices which can be
found here;

[4]http://www.ico.gov.uk/upload/documents/l...

 We do not hold any information specifically relating to search engines
sweeping the internet for personal data to pass on to third parties.

I have further performed a search of our case management system looking
through individual cases submitted about Yahoo and Google for information
relevant to your request. We have received 31 ‘Requests for
Assessment’ made under section 42 of the Data Protection Act 1998
relating to Google, of which three were closed ‘compliance unlikely’
(where we have investigated the matter, determined that compliance with
the Data Protection Act 1998 is unlikely to have been achieved). Looking
at these, in one of these cases the possible breach does not actually
relate to Google. In the remaining two cases the possible breaches relate
the forth principle (accuracy) and the sixth principle (subject access).

For Yahoo we have received 11 ‘Requests for Assessment’, of which two
were closed ‘compliance unlikely’. Of these, Yahoo was not the data
controller of one, and the other possible breach related to the seventh
principle (security).

We do not hold any information within our case management system within
the scope of your request.

I hope this is helpful. If you are dissatisfied with the response you have
received and wish to request a review of our decision or make a complaint
about how your request has been handled you should write to the Internal
Compliance Team at the address below or e-mail
[5][email address]

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request
received after this time will only be considered at the discretion of the
Commissioner.

If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the Case Reception Team, at the address below or visit the
‘Complaints’ section of our website to make a Freedom of Information
Act or Environmental Information Regulations complaint online.

 

A copy of our review procedure is attached.

Yours sincerely

Adam Stevens

Assistant Internal Compliance Manager.

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 01625 545 700 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. file:///tmp/radBC1C9_files/filelist.xml
2. http://www.google.co.uk/intl/en/privacy....
3. http://m.uk.yahoo.com/_ylt=A03uvxlnzwNLe...
4. http://www.ico.gov.uk/upload/documents/l...
5. mailto:[email address]