'Right to be Forgotten' Kayode v IC & GMC

5 August 2021

Our reference: IC-122060-X9M5 

Dear J Roberts,

Thank you for your recent request for information. We received your
request on 2 August 2021. Your request will be allocated to an Information
Access Officer who will contact you under the reference number above in
due course.
Under statutory timeframes our response to your request is due by 31
August 2021. Like many other organisations our work has been disrupted by
the pandemic. We continue to experience high demand for our services while
operating at reduced capacity. We are working as hard as we can to respond
to all of the requests we receive within the statutory time period, but
unfortunately it is not always possible for us to do so.
If you have any queries about this information request you may email us,
quoting our reference number in the subject line. Please note that
Information Access Officers are only able to address information requests
to ICO; they are unable to assist with complaints to ICO, or to provide
general advice about the legislation we oversee, as this work is done by
other ICO departments.  
Our privacy notice explains what we do with the personal data you provide
to us when you make an information request: 
https://ico.org.uk/global/privacy-notice...
Thank you for your interest in the work of the Information Commissioner's
Office.
Yours sincerely,
Eluned Cook  
Information Access Support Officer
Information Commissioner’s Office   
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0303 123 1113 [1]ico.org.uk [2]twitter.com/iconews
Please consider the environment before printing this email

Please be aware we are often asked for copies of the correspondence we
exchange with third parties. We are subject to all of the laws we deal
with, including the data protection laws and the Freedom of Information
Act 2000. You can read about these on our website ([3]www.ico.org.uk).
Please say whether you consider any of the information you send us is
confidential. You should also say why. We will withhold information where
there is a good reason to do so.
For information about what we do with personal data see our privacy notice
at [4]www.ico.org.uk/privacy-notice
 

References

Visible links
1. https://ico.org.uk/
2. https://twitter.com/iconews
3. https://www.ico.org.uk/
4. https://www.ico.org.uk/privacy-notice

31 August 2021 

Case Reference: IC-122060-X9M5 

Dear J Roberts,

I write further to your 2 August 2021 email in which you submitted an
information request to the ICO via the What Do They Know website. We have
dealt with your request under the Freedom of Information Act 2000 (FOIA)
and our response is below.
 
Your request
 
In your email you requested;

“1.  Please provide all guidance to assist caseworkers determine the
period after which a determination by a professional regulatory body need
not be provided to someone who requests a copy of it.  I am particularly
interested in how the publication policies of the regulatory bodies
themselves influence your decisions.

I also note this from your DN, which suggests there may be circumstances
in which the 'Right to be Forgotten' may be trumped:

'60. The complainant has put forward no justification as to why the
withheld information is particularly relevant at the present time and the
Commissioner is not aware of any other reason why this would be the case.'

2. Please provide all information you hold relating to 'justification' in
relation to your decision-making process surrounding the 'Right to be
Forgotten'.

3.  Please provide all information you hold -  e.g. guidance and/or
communications with the GMC – concerning the period of time it ought to
make MPT determinations available from the date of publication (I have its
revised policy of 2018 limiting availability to  10 years in mind)..”

Our response

I can confirm we will hold information within the scope of some parts of
your request however we are unfortunately unable to provide you with the
information you have requested as to do so will exceed the cost limit at
section 12 of the FOIA.

You may be aware section 12 of the FOIA makes clear that a public
authority (such as the ICO) is not obliged to comply with a FOIA request
if the authority estimates that the cost of complying with the request
would exceed the ‘appropriate limit'. The ‘appropriate limit’ for the ICO,
as determined in the Freedom of Information and Data Protection
(Appropriate Limit and Fees) Regulations 2004 is £450. We have determined
that £450 would equate to 18 hours work.

We consider that part 2 of your request is very broad. To search for all
information we hold relating to 'justification' in relation to our
decision-making process surrounding the 'Right to be Forgotten' would take
a considerable amount of time. It is likely that the information would to
sit within our electronic case management system, which we largely use to
track and progress individual cases. However, this system is not set up to
easily provide us with the type of information you have requested. 
Generally speaking this is not the sort of information we would need for
our own day to day business purposes.

Unfortunately we cannot electronically extract the information needed to
answer this part of your request from our records. Much of the relevant
information will be contained within the documents and correspondence of
each individual case.

Although your request relates to a Decision Notice issued by our FOIA
complaints team, as you will be aware the ‘Right to be forgotten’ is part
of data protection law. We therefore consider that to locate the
information you are seeking we would need to search both our FOIA and data
protection complaints casework.

The ‘Right to be forgotten’ relates to Article 17 of the General Data
Protection Regulation which came into force in May 20218. I have therefore
limited our searches to FOIA cases where the Decision Notice was issued in
June 2018 until the date of your request and the personal data exemption
was applied, and for data protection cases which are contained on our
current case management system, ICE360, which we started using in the
2018/19 financial year where article 17 was listed as the nature of the
complaint. There are 533 relevant FOIA cases and 2933 relevant data
protection cases. It would be likely to take at least 2 minutes per case
to ascertain whether the complaint relates to the Right to be forgotten or
some other aspect of section 40 FOIA or Article 17 GDPR and we would then
be required to check the documents and correspondence on the cases which
were likely to contain any information which falls within the scope of
your request. We consider that this would be well in excess of the section
12 FOIA cost limit.

I have given some consideration as to how you may be able to narrow the
scope of your request to bring this within the cost limit.

You may wish to consider narrowing your request to guidance used by
caseworkers and other areas of the ICO relating to the ‘Right to be
forgotten’ and particularly relating to justification as guidance is
centrally located and would not require us to search individual cases.

If you are interested in the specific decision making on complaint cases
you may also wish to consider limiting your request to Freedom of
Information complaint cases and further narrowing the scope of the request
to particular bodies, such as the General Medical Council as this is
likely to significantly reduce the number of cases we would be required to
search.

Further advice and assistance

Our FOI Casework and Appeals department have confirmed that they do not
hold any guidance which falls within the first part of your request.

This concludes our response to your request. I appreciate that this may be
disappointing but I hope that the explanation provided is useful.

Next steps
 
If you are dissatisfied with the response you have received and wish to
request a review of our decision or make a complaint about how your
request has been handled you should write to the Information Access team
at the address below or e-mail [1][ICO request email]

Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request received
after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please visit
the ‘Concerns’ section of our website to make a Freedom of Information Act
or Environmental Information Regulations complaint online.
 
A copy of our review procedure is available here
[2]https://ico.org.uk/media/1883/ico-review....
 

Yours sincerely,

Joanne Wright 
Senior Information Access Officer 
Information Commissioner's Office

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
 [3]ico.org.uk [4]twitter.com/iconews
Please consider the environment before printing this email.
For information about what we do with personal data see our privacy notice
at [5]www.ico.org.uk/privacy-notice.

References

Visible links
1. mailto:[ICO request email]
2. https://ico.org.uk/media/1883/ico-review...
3. https://ico.org.uk/
4. https://twitter.com/iconews
5. https://www.ico.org.uk/privacy-notice