Data Protection Act 1998

Hi
For some time now as advised by Faljay on the old site I have been including a section 10 data notice with letter 2. However recently I got a reply from Lowlife stating the data protection act 1998 is no longer in force

I googled this and found out it has been superseded by the data protection act 2018. So what I have done is I have replaced the 1998 on my section 10 template with 2018.

Does anyone know if this is the correct thing to do?

hi discodave !
Tough one, the new legislation is alot more complicated , i doubt section 10 of the new acts is the same as the old one so probably not usable without dissecting the new stuff.
here is the new subject rights bit.
http://www.legislation.gov.uk/ukpga/2018/12/part/3/chapter/3

Section 10 of the 1998 act was "Right to prevent processing likely to cause damage or distress".  I would say the equivalent in 2018 would be Section 47 "Right to erasure or restriction of processing".  It might depend on exactly what you're asking/requiring in your Section 10 notice.  As Lopsum says the current act is more complex, so some of your points may be covered by other sections.

yes i had a skim through , there are a couple of things that might be good to explore.
consent . how far do they need your consent to process our data ?

Dispute its accuracy, they must restrict further sharing if the data is inaccurate.(do you owe them anything??)

so a good place to start is " i do not consent to you processing any personal data." see what they say then.

request to erase data, again this will be appropriate in some circumstances but probably not most.

you can request all data they hold so that you can then dispute any incorrect data.
maybe they could be forced into a position where they have to prove the debt before they can process your data at all??

one or two avenues to try, defiantly do the 3 letters, add you notice of no consent for data to be processed until the debt is proved .

The DPA 2018 is slightly disjointed but it adds some more powerful protection such as the right to only process the amount of data to undertake the task in hand, and yes you can tell them to delete your data.

It also adds more protection such as not allowing them to put a company policy over the law, it prevents them using tactics to stop you from doing something you are allowed to do, and prevents them from forcing you to something you do not have to do; powerful against the DWP and yes I have used it against them and it does work, actually very well.

When I used it for the first time the smell of human excrement in the air was overpowering.

Dont knowif this is useful : I found the following>>


Section 10
Your name]
[Your address]
[Your address]
[Your postcode]
[Date]
Data Protection Officer
[DCA Address 1]
[DCA Address 2]
[DCA Postcode]

NOTICE ISSUED PURSUANT TO DATA PROTECTION LEGISLATION (Data Protection Act 2018 & GDPR)

Firstly, I would like to draw your attention to Article 4 (Definitions) of The General Data Protection Regulations (GDPR). For ease and to save time, I have highlighted a few of the more relevant Articles that must be complied with.

Definitions. A few key definitions have been included below, however, please refer to the full legislation when referring to this document.
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;
‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Recital 1 Data protection as a fundamental right
Recital 2 Respect of the fundamental rights and freedoms
Art. 5 GDPR, Principles relating to processing of personal data must be followed. See Recital 39. GDPR
Art. 6 GDPR sets out seven key principles: Lawfulness, fairness and transparency; Purpose limitation; Data minimisation; Accuracy; Storage limitation; Integrity and confidentiality (security); Accountability. These principles should lie at the heart of your approach to processing personal data and must be proactively demonstrable. See Recital 40. GDPR
Art. 7 GDPR Conditions for consent – (See Recital 43 Freely given consent)
Art. 13 GDPR Information to be provided where personal data are collected from the data subject
Art. 14 GDPR Information to be provided where personal data have not been obtained from the data subject
Art. 16 GDPR Right to rectification – (See Recital 65 Right of rectification and erasure)
Art. 17 GDPR Right to erasure (‘right to be forgotten’) ‘without undue delay’ – (See Recital 66 Right to be forgotten)
Art. 18 GDPR Right to restriction of processing
Art. 21 GDPR Right to object - (See Recital 69 Right to object)
Art. 22 GDPR Automated individual decision-making, including profiling
Art. 24 GDPR Responsibility of the controller – (See Recital 75 Risks to the rights and freedoms of natural persons)
Art. 26 GDPR Joint controllers – (See Recital 79 Allocation of the responsibilities)
Art. 28 GDPR Processor – (See Recital 81 The use of processors)
Art. 33 GDPR Notification of a personal data breach to the supervisory authority
Art. 35 GDPR Data protection impact assessment – (See Suitable Recitals (75) Risks to the rights and freedoms of natural persons (84) Risk evaluation and impact assessment (89) Elimination of the general reporting requirement (90) Data protection impact assessment (91) Necessity of a data protection impact assessment (92) Broader data protection impact assessment (93) Data protection impact assessment at authorities)
Art. 40 GDPR Codes of conduct
Chapter 5 Transfers of personal data to third countries or international organisations
Chapter 8 Remedies, liability and penalties
Article 77 Right to lodge a complaint with a supervisory authority
Article 78 Right to an effective judicial remedy against a supervisory authority
Article 79 Right to an effective judicial remedy against a controller or processor
Article 80 Representation of data subjects
Article 81 Suspension of proceedings
Article 82 Right to compensation and liability
Article 83 General conditions for imposing administrative fines
Article 84 Penalties
Data Protection Act 2018
http://www.legislation.gov.uk/…/2018/12/part/3/ch…/3/enacted
Meaning of “applicable time period”
(1)This section defines “the applicable time period” for the purposes of sections 45(3)(b) and 48(2)(b).
(2)“The applicable time period” means the period of 1 month, or such longer period as may be specified in regulations, beginning with the relevant time.
45 Right of access by the data subject
46 Right to rectification
48 Rights under section 46 or 47: supplementary
Data Protection Act 2018
http://www.legislation.gov.uk/ukp…/2018/…/section/13/enacted
13 Obligations of credit reference agencies
(1) This section applies where a controller is a credit reference agency (within the meaning of section 145 ( of the Consumer Credit Act 1974).
(2) The controller’s obligations under Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject’s financial standing, unless the data subject has indicated a contrary intention.
(3) Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject’s rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
https://ico.org.uk/…/documents/1595/pia-code-of-practice.pdf
https://ico.org.uk/…/accountability-and-g…/codes-of-conduct/

Human Rights Act 1998 >: SCHEDULE 1 Part I

Article 8
Right to respect for private and family life
1Everyone has the right to respect for his private and family life, his home and his correspondence.
2There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Article 14
Prohibition of discrimination
The enjoyment of the rights and freedoms set forth in this Convention shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status.

Human Rights Act 1998 : SCHEDULE 1 Part II the First Protocol

Article 1
Protection of Property
I hereby give you Notice that I object to my Data being processed and have not knowingly given free and informed consent. From this moment on, any and all consent, implied or otherwise, is withdrawn. You must, within the time periods prescribed below, permanently cease processing all personal data of which I am the data subject, rectify any inaccuracies of my data which may result in a negative financial standing which could lead to potential economic harm to the Natural Person associated with the Data Subject. I hereby give Notice that I invoke the Right to be Forgotten and for my Data to be Erased.

If you do not normally handle Data Protection Notices for your organisation, please pass this Notice to your Data Protection officer or another appropriate official.
THE MEANING OF THIS NOTICE
For the avoidance of doubt this Notice requires you to do all of the following:
(1) With immediate effect to cease or not to begin to carry out any operation or a series of operations involving my personal data including operations that would amount to the:
(a) Organisation, adaption or alteration;
(b) Retrieval, consultation or use;
(c) Disclosure by transmission, dissemination or otherwise making available; or
(d) Alignment or combination, of information or data; and
(2) Within 3 days of receipt of this letter to cease or not to begin to:
(a) Obtain;
(b) Record; or
(c) Hold, any personal data of which I am the data subject (“my personal data”).
(3) Within one month of receipt of this letter to have started the process of erasing my Data under the Right to be Forgotten at the same time as ensuring the rectification of unfounded, adverse opinion.
GROUNDS FOR NOTICE
My grounds for giving you this Notice are:
(a) The processing of my personal data by you is causing or is likely to cause substantial damage to me and any person residing with me, due to a lack of ability to obtain credit caused by wrongful processing of my data
(b) The processing of my personal data by you is illegal as you do not have my consent.
(c) The processing of my personal data is illegal as we do not have a contract.
(d) The processing of my personal data is illegal as you have no proven legal obligation that applies to your organisation.
(e) The processing of my personal data is illegal as it is not necessary for you to protect my vital interests.
(f) In any case the damage and/or distress is unwarranted.
(g) The processing of my personal data is a potential Data Breech and could adversely affect my Fundamental Rights and Freedoms.

NO EXEMPTION FROM THE PROVISIONS SET OUT IN THE DATA PROTECTION ACT 2018 & GDPR
You are not excused compliance with this Notice by virtue of the reasons set out below:
(1) I have not given you my consent to process my personal data.
(2) I am not a party to a contract with you.
(3) You have no proven legal obligation with which you must comply and which would permit you to process my personal data.
(4) No processing undertaken by you could be undertaken to protect my vital interests.
(5) There is no Lawful basis.
(6) It is not in the Public Interest.

WHAT YOU MUST DO NEXT
In any event you must within one month of receiving this Notice give me Notice in writing stating:
(1) You have complied with the provisions of this Notice in full; or
(2) You have complied with the provisions of this Notice in part, stating which parts; and
(3) As to the parts not so complied with, your reasons for not doing so, including evidence that you can substantiate.

WARNING: CONSEQUENCES OF FAILURE TO COMPLY WITH THIS NOTICE

Should you fail to comply with this Notice and/or fail to comply with the Law, I reserve the right to make a Subject Access Data Request for all information relating to me, the Data Subject as to how my personal information is stored, handled, processed, controlled, shared intercompany and with 3rd Party’s. I will also make a Subject Access Data Request for information regarding Your; Data Processor, Data Controller, Valid certification of the named Officers who deal with Data Protection, the steps you are taking to meet the Security Principle (‘appropriate technical and organisational measures’) to ensure the safety of the Data Subject’s information, including Impact Assessments and Risk Assessments. I reserve the right to lodge a formal complaint and/or report a Data Breach with the Information Commissioner’s Office (ICO). I reserve absolutely the right to obtain, without further reference to you, a county court or High Court order to compel you to comply with this Notice together with an order that you pay my associated legal costs in full and for me to make an application for damages associated with your unlawful processing of my personal data.
see GDPR, recitals; 39, Principles of data processing, 63 Right of access, 83 Security of processing, 84 - Risk evaluation and impact assessment, 90 Data protection impact assessment, 91 Necessity of a data protection impact assessment, 92 Broader data protection impact assessment, 93 Data protection impact assessment at authorities.
See also Consumer Credit Act, section 159.

Yours sincerely
[Your Name]

In my opinion that's too long, and your actual request is well hidden down the bottom.  I think there's a good chance it would just be set aside by whatever low level office worker opens it.  Someone who wouldn't even know how to spell GDPR.   If you really want to put all that content, put your request at the very top so it's the first thing they read.

Another idea, would it not be better to do the SAR first in any case?  You never know what that will turn up.  It would also allow you to be very precise when you send your demand for them to delete your data.

-

123 wrote:Can anyone please clarify what is the compliance time frame for the new equivalent of what used to be a "section 10" notice?

As far as Im aware it used to be 21 days under the old section 10 - is this still the same or has it now become 30 days or a month?

thanks

I think if you read on tinterweb (there are plenty of resources) under GDPR 2018 it is 30 days, certainly is for an SAR! I could be wrong though!

its 30 days, and they scrapped the £10 fee. Send the request as under "The Current GDPR",
so title it, "Please note this is a Subject Access Request under the current GDPR".
They can extend the time limit if small resources for the search but you can limit the search to speed things up by saying "please do not include emails sent to/from me as I already have those", but they can only do so for 2-3 months (incl the 30 days)

-

You are getting mixed up here, the Protection From Harassment Act gives the right to protection from harassment which is defined as likely to cause alarm or distress.

.

They both work together, you can use GDPR 2018 with the data specifically, and use the PHA as a different type of claim which supplements GDPR and adds anything other than data processing, e.g. if correspondence you receive, visits from debt collectors, and even the claim if unfounded can be used.

assassin wrote:They both work together, you can use GDPR 2018 with the data specifically, and use the PHA as a different type of claim which supplements GDPR and adds anything other than data processing, e.g. if correspondence you receive, visits from debt collectors, and even the claim if unfounded can be used.

The main objective here is however to get specific data expunged/cleared from a Data Controllers records and e.g. how to draft POC if the Data Controller doesn't comply. Further how much compensation to claim and how to justify the level of compensation claimed if the Data Controller does not comply.

-

123 wrote:

@handle; @LionsShare - Please note the above posts - this thread is not concerning your SAR rights rather than the equivalent of what used to be Section 10 of the 1998 act "Right to prevent processing likely to cause damage or distress" as  pieintheskywhenIdie stated - in 2018 that would be Section 47 "Right to erasure or restriction of processing".

by all means re-read what was written, & really look again,

LS wrote "I think if you read on tinterweb (there are plenty of resources) under GDPR 2018 it is 30 days, certainly is for an SAR! I could be wrong though!"

Was simply pointing out it could be 30 days for sect10 equivilant, as it is for SAR, was NOT in anyway saying it is 30 days for sect10 equivilant.

Found it in the DPA 18:

Section 47 is one month.

Actually it can be up to 90 days.

GDPR is the European regulation and DPA 18 matches it for UK.