Ibrahim Hasan

New ICO Consultation Alert: Legitimate Interest & Complaints Guidance 🚨 On 21 August 2025, the ICO opened a consultation on two major pieces of draft guidance under the UK data protection law: 1️⃣ Recognized Legitimate Interest Guidance The Data (Use and Access) Act introduced a brand-new lawful basis: recognized legitimate interest – separate from the traditional legitimate interests test. The ICO’s draft guidance explains how organizations can rely on this basis without needing to carry out a balancing test (rights vs. interests) if one of the following pre-approved conditions applies: • Public task disclosure requests • National/public security & defence • Emergencies • Crime prevention/detection • Safeguarding This is a significant shift in how some organizations may justify processing data. 2️⃣ Complaints Guidance By June 2026, organizations must have a clear process for handling data protection complaints. The ICO outlines: ✔️ Provide a way for people to submit complaints ✔️ Acknowledge within 30 days ✔️ Investigate and keep people informed ✔️ Communicate outcomes without undue delay The ICO also recommends keeping detailed records of complaints, acknowledgements, investigations, and outcomes. Why this matters: • For DPOs & privacy teams: time to assess how the new “recognized legitimate interest” fits into your organization’s processing activities. • For compliance leaders: now is the moment to design or update complaint-handling processes well before June 2026. The ICO is seeking feedback. If your organization could be affected, it’s worth getting involved. *See my comments for links to both feedback forms.* What do you think: will “recognized legitimate interest” simplify compliance, or create new grey areas? #DataProtection #ICOUK #DUAA #LegitimateInterest #DPO

79

5 Comments

Criminal prosecution for data protection violations just happened in the UK. I found a case from Mishcon de Reya LLP that changes everything for privacy professionals. A care home director was *criminally prosecuted* and fined £6,540 for blocking and erasing records after receiving a Data Subject Access Request. This wasn't just a civil enforcement action. Section 173 of the Data Protection Act 2018 makes it a criminal offense to alter, erase, or conceal information once a DSAR is received. The director tried multiple defenses: claiming staff provided the information, the care home manager was responsible, the company was deregistered from Information Commissioner's Office in 2016, and that the building itself wasn't a data controller. None worked. Here's what privacy leaders need to know: a. Criminal liability applies to data controllers AND individual directors and staff members. Your personal exposure goes beyond corporate fines. b. The ICO has historically focused on civil enforcement. This criminal prosecution signals a potential shift toward aggressive enforcement. c. DSAR compliance isn't just about civil penalties anymore. Prison time and personal criminal records are now possibilities for executives. Three immediate actions for your organization: 🔒 Review your DSAR response procedures to ensure no alteration or concealment occurs after requests are received. 🔒 Train directors and senior staff on personal criminal liability under section 173. 🔒 Document your DSAR handling process to demonstrate compliance and good faith efforts. This case represents the first known section 173 prosecution. It won't be the last. What's your organization doing to protect executives from personal criminal liability in data protection matters? ----- Data > Nuance. is your friendly neighborhood privacy office.

167

8 Comments