Lawful Basis

Response to this request is long overdue. By law, under all circumstances, Insolvency Service should have responded by now (details). You can complain by requesting an internal review.

Dear Insolvency Service,

What lawful basis under GDPR 2018 is used for processing data from individuals by the Official Reciever's Office where no explicit consent has been obtained from the data subject.

Yours faithfully,

paul grant

FOI, Insolvency Service

Good afternoon,

You may wish to note that an Official Receiver is not covered by the Freedom of Information Act where they are acting in their role as:

provisional liquidator
liquidator
interim receiver
receiver and manager
trustee
administrator of a Debt Relief Order

However, in the interests of transparency, and noting the obligations of Chapter III of the UK GDPR, I would direct you to the Personal Information Charter available here - https://www.gov.uk/government/organisati... (in particular the full length document available on that page). As you will see, the particular condition relied on by an Official Receiver may vary according to the task being carried out.

As context to this, I can also advise you that consent is just one of many conditions of Article 6 of the GDPR that can be relied upon for the processing of personal data to be lawful. None of these conditions is preferable to another, so long as the various aspects of the condition apply.

Regards,

Information Rights Officer | Digital Technology Services | The Insolvency Service - Delivering economic confidence | 3rd Floor, Cannon House, 18 Priory Queensway, Birmingham B4 6FD | @InsolvencyGovUK |

show quoted sections

Dear FOI,

Thank you for your reply and useful link and for pointing out that an Official Receiver who is a Data Controller is not covered by the FOIA in certain roles but they are subject to the DPA 2018 and GDPR in exactly the same way as the Insolvency Service according to the document you have provided.

That the Insolvency Services and OR's tend to rely on public task, as their lawful basis and obviously they would both have to prove that this lawful basis would not override the interests and fundamental rights and freedoms of the data subject, who did not give their explicit consent, unless of course you are claiming they have committed a crime and bankruptcy is a civil not criminal matter, so therefore would require consent.

If you believe that this is not the case or correct view of the document you have provided please feel free to comment.

Yours sincerely,

paul grant

FOI, Insolvency Service

Mr Grant,

As I said before, consent is one of only a number of processing conditions, and is no more valid than any other. The purpose of processing personal data does not need to relate to law enforcement for conditions other than consent to apply. For example, where a statutory power is being exercised, consent would in many cases be unavailable as a processing condition due to the strict requirements of its applicability (see Article 7 of the UK GDPR).

More information is available on the Information Commissioner's Offices' website (www.ico.org.uk). The Commissioner also regulates data protection law in the UK, and if you believe your rights may have been infringed you can make a complaint on their website.

Regards,

Information Rights Officer | Digital Technology Services | The Insolvency Service - Delivering economic confidence | 3rd Floor, Cannon House, 18 Priory Queensway, Birmingham B4 6FD | @InsolvencyGovUK |

show quoted sections

Dear FOI,

Thank you for providing Article 7 GDPR Conditions for consent that makes it clear that if consent is given it can also be withdrawn.

Article 6(1)(e) Public Task that the Insolvency Services appears to rely on also allows the data subject the right to object to their data being processed, unless of course it can be proven that your interests overrides the data subjects interest, fundamental rights and freedoms, this appears unlikely.

It also seems that only The Insolvency Rules Committee are a public authority under FOIA 2000 Schedule 1.

The Insolvency Service is not a government body and are an executive agency of BEIS.

ICO 'Your focus.should be on demonstrating either that you are carrying out a task in the public interest, or that you are excerising official authority' which one of these applies to The Insolvency Service and to your Official Receivers?

Yours sincerely,

paul grant

FOI, Insolvency Service

Mr Grant,

Official Receivers and the Insolvency Service have various statutory powers and duties that support processing under UK GDPR Article 6(1)(e). If you wish to exercise your right to object (or any other right) under data protection law you can do so by emailing [email address].

Regards,

Information Rights Officer | Digital Technology Services | The Insolvency Service - Delivering economic confidence | 3rd Floor, Cannon House, 18 Priory Queensway, Birmingham B4 6FD | @InsolvencyGovUK |

show quoted sections