Stephen Rippingale-Peters

Dear Information Commissioner’s Office,

I am currently collating information for a report and would be grateful if you would provide the me with information for the report.

Each answer should include information going back 5 years pre GDPR regime, and then separate answers for post GDPR regime.

This will enable me to guage whether the GDPR regime has had any or any initial impact on those sectors. I do understand that it is early days post GDPR and I intend to cover this in the final question.

My questions relate the the following 4 Sectors:

(a) Law Firms (to include Solicitors as sole traders and Barristers)
(b) Government Departments (Central Government)
(c) Private Investigations Industry (excluding manned guarding / uniformed security)
(d) Credit Reference Agencies with at least one branch in the UK

Questions:

(1) Please provide a breakdown for the number of complaints received, whether enforced or not, for each of the above sectors, separated by pre and post GDPR regimes.

(2) Please provide a breakdown for the number of complaints received, where any kind of enforcement action was taken by the ICO, for each of the above sectors, separated by pre and post GDPR regimes.

(3) Please confirm the sum total of fines imposed, to date, on each of the above sectors pre and post GDPR.

(4) Please confirm the sum total of fines recovered / paid, to date, on each of the above sectors, pre and post GDPR.

(5) In the last 2 months prior to GDPR coming into force in the UK, what were the total number of complaints received by the ICO and in the 2 months post GDPR coming into force, what where the total number of complaint received by the ICO. (This is generally, across all sectors not just those listed above).

Yours faithfully,

Stephen Rippingale-Peters

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

8 August 2018

 

Case Reference Number IRQ0773540

 

Dear Mr Rippingale-Peters
 

Thank you for your recent request for information. We received your
request on 4 August.

 

We will be considering your request under the Freedom of Information Act
2000. You can expect us to respond in full by 4 September. This is 20
working days from the date we received your request. If, for any reason,
we can’t respond by this date, we will let you know and tell you when you
can expect a response.

 

If you have any questions please contact me using the IRQ case reference
number above or by replying to this email and leaving the subject field
unchanged.

 

Thank you for your interest in the work of the Information Commissioner's
Office.

Yours sincerely

 
 
 

Jessica Duckworth
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4146497  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice

 
 
 

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Stephen Rippingale-Peters

Dear Information Commissioner’s Office,

Can you update this request.

Yours faithfully,

Stephen Rippingale-Peters

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit [1]http://ico.org.uk/about_us/how_we_comply

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found at
[3]http://www.ico.org.uk/tools_and_resource...

Twitter

Find us on Twitter at [4]http://www.twitter.com/ICOnews

 

References

Visible links
1. http://ico.org.uk/about_us/how_we_comply
2. https://ico.org.uk/global/privacy-notice/
3. http://www.ico.org.uk/tools_and_resource...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

28 September 2018

 

Case Reference Number IRQ0773540

 

Dear Mr Rippingale-Peters

Further to our acknowledgement of 8 August, I can confirm that your
request for information, contained in your e-mail of 4 August, has been
passed to me for attention.
 
As explained we had hoped to be in a position to respond to your request
by 4 September, but unfortunately this was not possible, due to the volume
of information that needs to be considered. 
 
Please be assured that we are doing everything we can to process your
request as quickly as possible and I endeavour to respond by 15 October.
 
We very much regret this delay, and hope that it does not cause you too
much inconvenience.
 
Thank you for your patience.
 
Yours sincerely

 
 

Jessica Duckworth
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4146497  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice

 
 
 

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Stephen Rippingale-Peters

Dear Information Commissioner’s Office,

Please provide me with an update, as you had hoped to respond by today. I would be grateful if you would refer this matter internally for review as well. The information requested should be held on computerised systems, and past requests (albeit many years ago) saw very similar information returned to me within the statutory period.

Yours faithfully,

Stephen Rippingale-Peters

Information Commissioner's Office

24 December 2018

 

Case Reference Number IRQ0773540

 

Dear Mr Rippingale-Peters

Thank you for your recent request for information. We received your
request on 4 August. I apologise for the delay in responding to you.
 
We have considered your request under the Freedom of Information Act 2000.
 
Your request
 
“I am currently collating information for a report and would be grateful
if you would provide the me with information for the report. Each answer
should include information going back 5 years pre GDPR regime, and then
separate answers for post GDPR regime. This will enable me to guage
whether the GDPR regime has had any or any initial impact on those
sectors. I do understand that it is early days post GDPR and I intend to
cover this in the final question. My questions relate the the following 4
Sectors: (a) Law Firms (to include Solicitors as sole traders and
Barristers) (b) Government Departments (Central Government) (c) Private
Investigations Industry (excluding manned guarding / uniformed security)
(d) Credit Reference Agencies with at least one branch in the UK
Questions: (1) Please provide a breakdown for the number of complaints
received, whether enforced or not, for each of the above sectors,
separated by pre and post GDPR regimes. (2) Please provide a breakdown for
the number of complaints received, where any kind of enforcement action
was taken by the ICO, for each of the above sectors, separated by pre and
post GDPR regimes. (3) Please confirm the sum total of fines imposed, to
date, on each of the above sectors pre and post GDPR. (4) Please confirm
the sum total of fines recovered / paid, to date, on each of the above
sectors, pre and post GDPR. (5) In the last 2 months prior to GDPR coming
into force in the UK, what were the total number of complaints received by
the ICO and in the 2 months post GDPR coming into force, what where the
total number of complaint received by the ICO. (This is generally, across
all sectors not just those listed above).”
 
Our response 
 
I can confirm that we hold information in the scope of your request. In
order to answer your request as clearly as possible.
 
Number of complaints received, whether enforced or not
 
Up to December 2017, the data you require is available on our website, in
our datasets. Therefore it is technically exempt under s21 FOIA as it is
reasonably available to you by other means.
 
[1]https://ico.org.uk/about-the-ico/our-inf...
 
We don’t hold information prior to this in line with our retention
schedule.
 
For the remainder of the data you require:
 
a) Law Firms (to include Solicitors as sole traders and Barristers)
       
Remainder of 2017 – 97
 
2018 Pre-GDPR (25 May) – 167
 
Post GDPR (to the date of your request) - 192
 
b) Government Departments (Central Government)
 
Remainder of 2017 – 180
 
2018 Pre-GDPR (25 May) – 343
 
Post GDPR (to the date of your request) - 409
 
c) Our system is not set up to allow us to search specifically on the
Private Investigations Industry (excluding manned guarding / uniformed
security). The sector in which they would fall is General Business but
this clearly encompasses many other types of business for which we do not
have a specific sector. Therefore any figure provided to you here is
likely to be inflated. To go through each individual case to check if it
related to the Private Investigations industry is likely to engage s12
FOIA (the cost of compliance exemption)
 
d) Credit Reference Agencies with at least one branch in the UK
 
Remainder of 2017 – 120
 
2018 Pre-GDPR (25 May) – 160
 
Post GDPR (to the date of your request) – 84
 
Please be aware that due to how our system records the figures, some
complaints that will have been completed post 25 May, will have been dealt
with under the previous legislation.
 
Breakdown of number of complaints received where any kind of enforcement
action has been taken
 
The information relating to the period since September 2016 can be
obtained by accessing the Enforcement page and datasets on the ICO website
and therefore is technically exempt under s21 FOIA as it is reasonably
available by other means.
 
[2]https://ico.org.uk/action-weve-taken/enf...
 
[3]https://ico.org.uk/about-the-ico/our-inf...
 
The information relating to the period of May 2013 – September 2016 (in
line with your request) is available on the National Archive website (as a
matter of advice and assistance, previous versions of our website are
routinely captured by the National Archive so any legacy information that
you require in the future can be found here.)
 
Sum total of fines imposed
 
a) Law Firms (to include Solicitors as sole traders and Barristers)
 
2013-24 May 2018 – £10,000
Post GDPR - 0
 
b) Government Departments (Central Government)
 
2013-24 May 2018 - £1,210,000
Post GDPR -  0
 
(c) Private Investigations Industry (excluding manned guarding / uniformed
security)
 
2013-24 May 2018 – 0
Post GDPR – 0
 
d) Credit Reference Agencies with at least one branch in the UK
 
2013-24 May 2018 – 0
Post GDPR - 0
 
As a matter of advice and assistance you should note that subsequent to
your request we have issued a fine to Equifax under the DPA98 – further
details [4]here.
 
Sum total of fines recovered
 
The information relating to fines recovered as recorded by the Enforcement
department at the ICO, does not distinguish between sector. As such, the
figures below have been produced by including what might reasonably be
expected to be encompassed by the sectors you have specified.
 
The figure has been produced using the date the fine was actually paid,
not necessarily when it was due or imposed.
 
a) Law Firms (to include Solicitors as sole traders and Barristers)
 
2013-24 May 2018 - £4,800
(Post GDPR) - 0
 
b) Government Departments (Central Government)
 
2013-24 May 2018 - £708,000
Post GDPR - £260,000
 
 
(c) Private Investigations Industry (excluding manned guarding / uniformed
security)
 
2013-24 May 2018 – 0
Post GDPR - 0
 
d) Credit Reference Agencies with at least one branch in the UK
 
2013-24 May 2018 – 0
Post GDPR - £400,000
 
 
Total number of complaints pre and post GDPR across all sectors
 
Whilst I can provide you with the following figures, please be aware that
due to how our system records the figures, some complaints that will have
been completed post 25 May, will have been dealt with under the previous
legislation, therefore not giving a completely accurate picture of how
many cases have been dealt with in the two months either side of the
advent of GDPR.
 
25 March 2018 – 24 May 2018 - 3653
 
25 May 2018 – 25 July 2018 - 4541
 
                                
Next steps
 
I hope this response is clear. If you would like me to clarify anything
about the way your request has been handled please contact me. I apologise
again for the delay in responding to this request.
 
You can ask us to review the way we have handled your request. Please see
our review procedure [5]here.
 
Following our internal review, if you remain dissatisfied with the way we
have handled your request, there is a statutory complaints process and you
can report your concern to the regulator. 

Yours sincerely,

 
  
 

Jessica Duckworth
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4146497  F. 01625 524510  [6]ico.org.uk  [7]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [8]privacy
notice

 

 
 

 
 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/action-weve-taken/enf...
3. https://ico.org.uk/about-the-ico/our-inf...
4. https://ico.org.uk/action-weve-taken/enf...
5. https://ico.org.uk/media/about-the-ico/p...
6. http://ico.org.uk/
7. https://twitter.com/iconews
8. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

4 January 2019

 

Case Reference Number IRQ0773540

 

Dear Mr Rippingale-Peters

On reviewing your case, I note your request for a decision by the
Commissioner.

In light of you now being provided with a response to your request, if you
would like to proceed with this please visit the ICO website and go to the
'Make a complaint' section. This will ensure that your concern is received
by the correct team who will contact you accordingly. 

Yours sincerely

 
 
 

Jessica Duckworth
Senior Information Access Officer
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 4146497  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
Please consider the environment before printing this email
For information about what we do with personal data see our [3]privacy
notice

 
 
 

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/