ICO - FS50897723

{{DPAdecisionBOX

|Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO |DPA_With_Country=ICO (UK)

|Case_Number_Name= FS50897723 |ECLI=

|Original_Source_Name_1=ICO |Original_Source_Link_1=https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617657/fs50897723.pdf |Original_Source_Language_1=English |Original_Source_Language__Code_1=EN

|Type=Complaint |Outcome=Rejected |Date_Decided=14.04.2020 |Date_Published= |Year=2020 |Fine=None |Currency=

|GDPR_Article_1=Article 5(1)(a) GDPR |GDPR_Article_Link_1=Article 5 GDPR#1a |GDPR_Article_2=Article 10 GDPR |GDPR_Article_Link_2=Article 10 GDPR

|National_Law_Name_1=216 (4) of the Insolvency Act 1986 |National_Law_Link_1= |National_Law_Name_2= 3(2) of the DPA |National_Law_Link_2=

|Party_Name_1=The Insolvency Service |Party_Link_1= |Party_Name_2=The individual/ Complainant |Party_Link_2= |Party_Name_3= |Party_Link_3= |Party_Name_4= |Party_Link_4= |Party_Name_5= |Party_Link_5=

|Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |

On April 14, 2020 the ICO supported the decision of the Insolvency Service to withold the information it held about insolvant company. Furthermore, it stated that the confirmatin or denial by the Insolvency Serivce that it held more information about the companies within the scope of the request, invovled the disclosure of personal data itself.

English Summary

Facts

The Insolvency Services received a request to provide all information regarding two companies it holds on record. The complainant believed that the Director of an insolvent company, had set up a second company with a prohibited name and had requested information about both companies.

Article 216 of insolvency acts prohibits the director of the insolvent company to use the name of that company in the 12 months leading up to the liquidation.

The Insolvency Service noted that the information it held was already on public and it could not disclose the remainder as it falls under the personal data of an individual. (the Director) However, in its communication with the complainant, the Insolvency Services indirectly confirmed that it held more information, by mentioning that the legislation only prevented the directors of the insolvent company from being involved with another company using the same or similar name.

The complainant challenged the way his request was handled by the Insolvency Service before the Information Commission Office.

Dispute

The Commissioner had to determine whether the Insolvency Service dealt appropriately with the request to the extent that it covered information not already in the public domain.

But first, the Commissioner considers whether the Insolvency Service should have confirmed or denied holding further information within the scope of the request as providing the confirmation or denial, involves the disclosure of personal data itself.

Moreover, Commissioner considers as well whether the Insolvency Service would be disclosing information relating to the criminal convictions and offences of a third party by confirming or denying that it holds further information within the scope of the request.

Holding

After a deep review of the case, the Commissioner stated that the information, specifically the confirmation or denial about having more information, in the scope of the request,would fall within the definition of ‘personal data’ defined in the section 3(2) of the DPA. “Any information relating to an identified or identifiable living individual”. The Commissioner explains that an identifiable living individual is one who can be identified, directly or indirectly, by reference to an identifier such as a name, location data, etc. The confirmation or denial that information was held by the Insolvency Service, not arleady in the public, either way, would involve the disclosure of something about the Director – who is indirectly identifiable from the request.

Providing a confirmation or a denial whether it holds information falling within the scope of the request, the Insolvency Service disclosed the personal data, and therefore, by doing so, it breached data protection principles. Here, commissioner referred to the Article 5(1)(a) GDPR.

Moreover, the Commissioner also stated that confirmation or denial, would involve the processing of the criminal offence data in the scope of the request. Referring to the article 10 of GDPR, as well as domestic legislation, the Commissioner underlines that by indirectly confirming or denying the information, it confirmed that it had taken steps to establish whether a breach of Section 216 had occurred, by doing so, the Insolvency Service processed and disclosed criminal offeces data.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.