ICO (UK) - The Ministry of Justice

From GDPRhub
Revision as of 15:09, 19 January 2022 by FA (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO (UK) |DPA_With_Country=ICO (UK) |Case_Number_N...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
ICO (UK) - The Ministry of Justice
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 15 GDPR
Section 45 Data Protection Act 2018
Type: Investigation
Outcome: Violation Found
Started:
Decided: 12.01.2022
Published: 18.01.2022
Fine: None
Parties: Ministry of Justice
National Case Number/Name: The Ministry of Justice
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: Frederick Antonovics

The UK DPA served the Ministry of Justice an Enforcement Notice to bring its processing into compliance by responding to data subjects' pending access requests and carrying out organisational changes to ensure that future ones are dealt with in the time frame provided for by Article 15 GDPR.

English Summary

Facts

The controller is the UK Ministry of Justice ('MoJ'), and processes personal data in the course of carrying out its functions.

In December 2017, the MoJ had already been issued with an Enforcement Notice following a finding by the ICO that it had failed to comply with a large number of subject access requests without undue delay. Then, in January 2019 the ICO "was made aware by the controller that a backlog of subject access requests had again accrued." The DPA therefore launched a new investigation into the matter.

After a series of exchanges with the MoJ, the ICO uncovered that there were 7,753 overdue access requests.


Holding

As such, the ICO held that the controller contravened Article 15 GDPR by failing to inform the relevant data subjects, without undue delay, whether their personal data was being processed and, where that was the case, failed to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1) GDPR.

As a result, it served the MoJ an Enforcement Notice to bring its processing into compliance by responding to data subjects' pending access requests. It also advised the MoJ to "develop a recovery plan, containing details of how it intends to remedy the issue of the out-of-time subject access requests."

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.


        

    
        
            
    
        
                
                        Action we've taken/
                
                
                        Enforcement/
                
                
                        
                            The Ministry of Justice
                        
                
        
    
                The Ministry of Justice
            
        
    
        
        
            
                        Date
                            18 January 2022
                        Type
                            Enforcement notices
                        Sector
                            Central government
            
        
    

    
        
            



        
    The Ministry of Justice has contravened Article 15 of the EU and UK and Section 45 DPA18 in that it has failed to provide, without undue delay, 7,753 data subjects with a copy of their data in accordance with its legal obligations.



        Further Reading
            
                
                    
                        The Ministry of Justice enforcement notice
                            
                                    Action we've taken
                                    PDF (136.7K)
                            
                        
                    
                
        

        
    

    
    
        
            
    
        
                
                        Action we've taken/
                
                
                        Enforcement/
                
                
                        
                            The Ministry of Justice
                        
                
        
    
                The Ministry of Justice
            
        
    
        
        
            
                        Date
                            18 January 2022
                        Type
                            Enforcement notices
                        Sector
                            Central government
            
        
    

    
        
            



        
    The Ministry of Justice has contravened Article 15 of the EU and UK and Section 45 DPA18 in that it has failed to provide, without undue delay, 7,753 data subjects with a copy of their data in accordance with its legal obligations.



        Further Reading
            
                
                    
                        The Ministry of Justice enforcement notice
                            
                                    Action we've taken
                                    PDF (136.7K)
                            
                        
                    
                
        

        
    
EnglishCymraegEnglishCymraeg