Use of Legitimate Interests by schools, universities and other organisations with alumni and members

The request was refused by Information Commissioner's Office.

Dear Information Commissioner’s Office,

In your letter to universities of October 2018 you advised caution over the use of the "Legitimate Interests" ground for processing in respect of some activities relating to fundraising and alumni relations work, especially wealth screening and data matching.

Since that letter was issued I have become aware that an ICO case officer has advised in writing that activities involving alumni relations and fundraising are not legitimate interests and that processing personal data for wealth screening is not necessary and thus fails the first part of the test for the use of the legitimate interest ground for processing. This approach seems a more restrictive one than that described in the letter to universities.

The Freedom of Information request simply asks how many organisations have been advised directly by your case officers of this more restrictive view that the legitimate interest ground for processing is not available for fundraising and alumni relations activities, and that wealth screening is not necessary.

I am aware you can not comment on individual cases; this is a request only for summary information.

Yours faithfully,

Madeline Bowles

AccessICOinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

29 March 2019

 

Case Reference Number IRQ0831992

 

Dear Ms Bowles,

Request for Information
 
Thank you for your correspondence which we received on 22 March 2019, in
which you have made a request for information held by the Information
Commissioner's Office (ICO). 
 
Your request has been passed to the ICO’s Information Access Team, and is
being dealt with in accordance with the Freedom of Information Act 2000
under the reference number shown above. 
 
As you are probably aware the FOIA provides individuals with the right of
access recorded information held by public authorities. It is important to
note that a release under FOIA is applicant blind and therefore
effectively a release to the wider world.
 
We will respond to your FOIA request promptly, and no later than 23 April
2019, which is 20 working days from the day after we received your
request.
 
Should you wish to reply to this email please be careful not to amend the
information in the ‘subject’ field. This will ensure that your reply is
added directly to your case.
 
Yours sincerely
 
 

Shannon Keith
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Directorate
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 313 1636  F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice.
Please consider the environment before printing this email

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

10 April 2019

 

Case Reference Number IRQ0831992

 

Dear Ms Bowles,

Thank you for your email, which we received on 22 March 2019. Further to
my acknowledgement on 29 March 2019, we are now in a position to provide a
response.
 
You have made a request for information held by the Information
Commissioner's Office (ICO). Your request has been dealt with in
accordance with the Freedom of Information Act 2000 (FOIA) under the
reference number shown above. 
 
Request
 
In your email you asked:

“In your letter to universities of October 2018 you advised caution over
the use of the "Legitimate Interests" ground for processing in respect of
some activities relating to fundraising and alumni relations work,
especially wealth screening and data matching. Since that letter was
issued I have become aware that an ICO case officer has advised in writing
that activities involving alumni relations and fundraising are not
legitimate interests and that processing personal data for wealth
screening is not necessary and thus fails the first part of the test for
the use of the legitimate interest ground for processing. This approach
seems a more restrictive one than that described in the letter to
universities. The Freedom of Information request simply asks how many
organisations have been advised directly by your case officers of this
more restrictive view that the legitimate interest ground for processing
is not available for fundraising and alumni relations activities, and that
wealth screening is not necessary. I am aware you cannot comment on
individual cases; this is a request only for summary information.”
 
Response – Information withheld (section 12)

Unfortunately, we are not able to provide you with the information you
have requested.  I will explain in more detail below why this is the case,
but in brief, section 12 of the Freedom of Information Act 2000 (FOIA)
makes clear that a public authority (such as the Information
Commissioner’s Office – the ICO) is not obliged to comply with an FOIA
request if the authority estimates that the cost of complying with the
request would exceed the ‘appropriate limit'. 
 
The ‘appropriate limit’ for the ICO, as determined in the ‘Freedom of
Information and Data Protection (Appropriate Limit and Fees) Regulations
2004’ is £450.  We have determined that £450 would equate to 18 hours
work. 

If held, the information you are interested in is likely to sit within our
electronic case management system which, amongst other things, records all
complaints and concerns submitted to the ICO. 

However, this system is not set up to easily provide us with the type of
information you have asked about.  Generally speaking this is not the sort
of information we would need for our own day to day business purposes. 
 
This system allows us to search for reported personal data breaches and
data protection complaints in a number of different ways, such as by the
unique reference number the case was given, the name of the data
controller who is the subject of a complaint, and the sector in which they
operate.  We can also search for cases on the basis of the broad nature of
the complaint or concern, but we can only search on a limited number of
fixed criteria which are structured around the main sections of the data
protection legislation.  
 
Because of this we are unable to conduct an electronic search specifically
for particular advice given, unless we know who the advice was provided
to. Our case management system also allows us to sort by sector
(education) but cannot easily separate primary or secondary educational
institutions from higher education institutions.
 
In order to find this information we would need to individually check
every relevant data protection complaint case between October 2018 and the
date of your information request. 
 
Having checked our system for broad figures I can confirm that within the
timeframe of your request, the ICO raised a concern or provided general or
compliance advice to educational institutions on more than 320 occasions.
You can read more about the terms used in our case outcomes [1]here.

Therefore, assuming that each search of each case would take approximately
5 minutes to complete, this would equate to over 26 hours of searching,
which is in excess of the 18 hours which would accrue a charge of £450.
 
It is for this reason, and in accordance with section 12 of the FOIA, that
we are not obliged to comply with your information request.

Narrowing your scope

If you are able to narrow the scope of your request we may be in a
position to provide information to you free of charge, if it will cost us
less than the appropriate limit to do so. For example, you may want to
consider a shorter timeframe or name specific data controllers.

Review Procedure
 
I appreciate this is not the response you were seeking, but I hope I have
adequately explained the ICO’s position. However, if you wish to request a
review of our decision or make a complaint about how your request has been
handled you should write to the Information Access Team at the address
below or e-mail [2][ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response. Any such request received
after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under the Freedom of Information Act.
 
A copy of our review procedure can be accessed from our website.
[3]here.
 
Yours sincerely
 
Shannon Keith
Senior Information Access Officer
Information Commissioner’s Office
 
T. 0330 313 1636
 

References

Visible links
1. https://ico.org.uk/media/about-the-ico/d...
2. mailto:[ICO request email]
3. https://ico.org.uk/media/about-the-ico/p...