Data protection complaints against UK Labour Party

The request was successful.

Dear Information Commissioner’s Office,

In relation to the UK Labour Party, please could you let me know the total number of complaints made to the Information Commissioners office (ICO) for the periods 2015 - 2016, 2016- 2017 and 2017 to the present date in connection with the Labour Partys;

1) failure to comply with the statutory 40 day deadline for responding to subject access requests (SAR)

2) the total number of complaints made to the ICO in connection with the accuracy of data retained by the Labour Party in relation to (a) members of the Labour Party and (b) other data subjects. If the ICO can not provide a breakdown of (a) and (b) then please provide the total number of complaints made.

3) the total number of complaints made to the ICO in connection with the length of time data is retained in relation to (a) members of the Labour Party and (b) other data subjects. If the ICO can not provide a breakdown of (a) and (b) then please provide the total number of complaints made.

4) in relation to any failures, issues
or concerns by or about the Labour Party to:

(i) comply with the statutory 40 day deadline for SAR,
(ii) the accuracy of retained data,
(iii) the length of time data is retained,
please could you let me know;

(a) how many information notices requiring the Labour Party to provide the Information Commissioner’s Office with specified information within a certain time period were issued. If none please state none.

(b) on how many occasions the ICO issued the Labour Party with
undertakings committing them to a particular course of action in order to improve its compliance. If none, please state none.

(c) On how many occasions did the ICO serve enforcement notices and ‘stop now’ orders where there has been a breach, requiring the Labour Party to take (or refrain from taking) specified steps in order to ensure they comply with the law. If none, please state none.

(d) How many conduct consensual assessments (audits) have the ICO undertaken to check that the Labour Party are complying. If none, please state none.

(c) how many assessment notices have the ICO issued to conduct compulsory audits to assess whether the Labour Partys processing of personal data follows good practice. If none, state none.

(d) How many monetary penalty notices, requiring The Labour Party to pay up to £500,000 for serious breaches of the Data Protection Act has the ICO issued. If none, please state none.

(e) Have the ICO prosecuted the Labour Party for commiting any criminal offences under the Act.

(f) have the ICO reported the Labour Party to Parliament on issues of concern.

Yours faithfully,

Mrs G B Millward

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

 

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

 

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

 

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

 

If you have requested advice - we aim to respond within 14 days.

 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

 

Copied correspondence - we do not respond to correspondence that has been
copied to us.

 

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

 

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

 

Yours sincerely

 

The Information Commissioner’s Office

 

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[2]http://www.ico.org.uk/tools_and_resource...

 

Twitter

Find us on Twitter at [3]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. http://www.ico.org.uk/tools_and_resource...
3. http://www.twitter.com/ICOnews

Information Commissioner's Office

1 Attachment

13 March 2018

 

Case Reference Number IRQ0726488

 

Dear Mrs Millward

Information request

I write in response to your email of 13 February 2018 in which you
submitted a request for information to the Information Commissioner’s
Office (ICO). Your request has been dealt with in accordance with the
Freedom of Information Act 2000 (FOIA).
 
Your request
 
“In relation to the UK Labour Party, please could you let me know the
total number of complaints made to the Information Commissioners office
(ICO) for the periods 2015 - 2016, 2016- 2017 and 2017 to the present date
in connection with the Labour Partys;
 
1) failure to comply with the statutory 40 day deadline for responding to
subject access requests (SAR)
 
2) the total number of complaints made to the ICO in connection with the
accuracy of data retained by the Labour Party in relation to (a) members
of the Labour Party and (b) other data subjects. If the ICO can not
provide a breakdown of (a) and (b) then please provide the total number of
complaints made.
 
3) the total number of complaints made to the ICO in connection with the
length of time data is retained in relation to (a) members of the Labour
Party and (b) other data subjects. If the ICO can not provide a breakdown
of (a) and (b) then please provide the total number of complaints made.
 
4) in relation to any failures, issues or concerns by or about the Labour
Party to: (i) comply with the statutory 40 day deadline for SAR, (ii) the
accuracy of retained data, (iii) the length of time data is retained,
please could you let me know; 
 

 1. how many information notices requiring the Labour Party to provide the
Information Commissioner’s Office with specified information within a
certain time period were issued. If none please state none.

 2. on how many occasions the ICO issued the Labour Party with
undertakings committing them to a particular course of action in order
to improve its compliance. If none, please state none.

 3. On how many occasions did the ICO serve enforcement notices and ‘stop
now’ orders where there has been a breach, requiring the Labour Party
to take (or refrain from taking) specified steps in order to ensure
they comply with the law. If none, please state none.

 4. How many conduct consensual assessments (audits) have the ICO
undertaken to check that the Labour Party are complying. If none,
please state none.

 
(c) how many assessment notices have the ICO issued to conduct compulsory
audits to assess whether the Labour Partys processing of personal data
follows good practice. If none, state none.
 
(d) How many monetary penalty notices, requiring The Labour Party to pay
up to £500,000 for serious breaches of the Data Protection Act has the ICO
issued. If none, please state none.
 
(e) Have the ICO prosecuted the Labour Party for commiting any criminal
offences under the Act.
 
(f) have the ICO reported the Labour Party to Parliament on issues of
concern.”

Our response

I can confirm we hold information that falls in the scope of your request.

In response to request 1, 2 and 3 please find attached a csv file
containing our data protection casework completed for the 2015/16
financial years to present, where the party concerned was the Labour Party
and where the nature of the concern raised was ‘subject access’,
‘inaccurate data, or ‘retention of data’. I have added an extra column to
identify whether the concerns raised where the nature was ‘subject access’
related to the data controller exceeding the 40 calendar day deadline for
responding to subject access requests or if it was in relation to a
different ‘subject access’ issue.

The attached dataset contains the following information:
 

* Our reference number for the work completed;
* the type of work and legislation it falls under;
* the name of the organisation responsible for the processing of
personal information;
* the sector the organisation represents;
* the nature of the issues involved;
* the date the work was completed; and
* the outcome following our consideration of the issues.

A description of the case outcomes we use is available here:
[1]https://ico.org.uk/media/about-the-ico/d...
 
We have extracted this data from our electronic casework management system
to enable us to respond to your request. We predominantly use this system
to track and progress individual cases. We don’t use this data in
isolation to decide whether regulatory action is appropriate in any
particular case, but we might use it to help identify potential trends or
to see the size and progress of our caseload. The data provided reflects
the data on the date it was extracted and can be subject to change over
time.
 
Some cases may have more than one outcome, for example where we are given
additional evidence which requires us to reopen a case and revise our
view. However, all outcomes are recorded as related activities on a single
case. You will see that where this has occurred, the duplicate case
reference numbers are shown grouped together and in date order so that you
can identify which is the final outcome.
 
In relation to 2 (a) and (b) and 3 (a) and (b), we would only hold this
information if it was provided to us by the complainant in the course of
their complaint, therefore it is difficult to provide an accurate figure
in response to these parts of your requests. However, we have examined the
information held on the cases where the nature of the concern is
'inaccurate data' or 'retention of data' and I have provided figures for
cases where the complainant has made clear that they are, or had been, a
member of the Labour Party. Of the complaints where the nature of the
concern raised was ‘inaccurate data’, three appear to have been raised by
members of the Labour Party. Of the complaints where the nature of the
concern is ‘retention of data’, one appears to be from a member of the
Labour Party.
 
In relation to part 4 of your request, I have addressed each request in
turn below.

4) in relation to any failures, issues or concerns by or about the Labour
Party to: (i) comply with the statutory 40 day deadline for SAR, (ii) the
accuracy of retained data, (iii) the length of time data is retained,
please could you let me know;
 
 

 1. how many information notices requiring the Labour Party to provide the
Information Commissioner’s Office with specified information within a
certain time period were issued. If none please state none.  

None 
 

 2. on how many occasions the ICO issued the Labour Party with
undertakings committing them to a particular course of action in order
to improve its compliance. If none, please state none.  

None 
 

 3. On how many occasions did the ICO serve enforcement notices and ‘stop
now’ orders where there has been a breach, requiring the Labour Party
to take (or refrain from taking) specified steps in order to ensure
they comply with the law. If none, please state none.

 
None – in the period you have specified we have not issued an Enforcement
Notice to the Labour Party for failures in relation to failures to comply
with the 40 day SAR deadline, accuracy of data or the length of time data
is retained. It may interest you to note that we have issued an
Enforcement Notice to the Labour Party in relation to breaches of the
Privacy and Electronic Communications Regulations (PECR) in 2010. Further
details are available here:
[2]http://webarchive.nationalarchives.gov.u...
 

 4. How many conduct consensual assessments (audits) have the ICO
undertaken to check that the Labour Party are complying. If none,
please state none. 

None
 
(c) how many assessment notices have the ICO issued to conduct compulsory
audits to assess whether the Labour Partys processing of personal data
follows good practice. If none, state none.
 
None
 
(d) How many monetary penalty notices, requiring The Labour Party to pay
up to £500,000 for serious breaches of the Data Protection Act has the ICO
issued. If none, please state none.
 
None 
 

 5. Have the ICO prosecuted the Labour Party for commiting any criminal
offences under the Act.  

No
 
(f) have the ICO reported the Labour Party to Parliament on issues of
concern.”
No
 
As a matter of further advice and assistance, we do publish information
about the work we do on our website. You can find datasets which include
the public concerns and organisations self-reported incidents we have
dealt with here:
[3]https://ico.org.uk/about-the-ico/our-inf...

You can filter these datasets by the information you are interested in
such as the name of the organisation, the case outcome or the nature of
the concern.

Any enforcement action we take is usually published on our website here:
[4]https://ico.org.uk/action-weve-taken/

This concludes our response to your request. I hope the information
provided is helpful.

Review Procedure

If you are not satisfied that your request for information has been dealt
with correctly, please write to the Information Access Team at the address
below, reply directly to this email (with the reference number contained
within the square brackets left intact), or email us at
[5][ICO request email], quoting the reference number
IRQ0726488.

Your request for a review should be submitted to us within 40 working days
of receipt by you of this response.  Any such request received after this
time will only be considered at the discretion of the Commissioner.

Ultimately if you are not satisfied that your request for information has
been dealt with correctly you have a further right of appeal to this
office in our capacity as the statutory complaint handler under the
relevant legislation.  To make such an application, please write to our
Customer Contact Team at the address below, or visit the ‘Report a
Concern’ section of our website.
 
A copy of our review procedure is available here
[6]https://ico.org.uk/media/about-the-ico/p...
 
Yours sincerely

Ian Goddard
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4246823  F. 01625 524510  [7]ico.org.uk  [8]twitter.com/iconews
Please consider the environment before printing this email

References

Visible links
1. https://ico.org.uk/media/about-the-ico/d...
2. http://webarchive.nationalarchives.gov.u...
3. https://ico.org.uk/about-the-ico/our-inf...
4. https://ico.org.uk/action-weve-taken/
5. mailto:[ICO request email]
6. https://ico.org.uk/media/about-the-ico/p...
7. http://ico.org.uk/
8. https://twitter.com/iconews