Gayle McFarlane

New ICO Consultation Alert: Legitimate Interest & Complaints Guidance 🚨 On 21 August 2025, the ICO opened a consultation on two major pieces of draft guidance under the UK data protection law: 1️⃣ Recognized Legitimate Interest Guidance The Data (Use and Access) Act introduced a brand-new lawful basis: recognized legitimate interest – separate from the traditional legitimate interests test. The ICO’s draft guidance explains how organizations can rely on this basis without needing to carry out a balancing test (rights vs. interests) if one of the following pre-approved conditions applies: • Public task disclosure requests • National/public security & defence • Emergencies • Crime prevention/detection • Safeguarding This is a significant shift in how some organizations may justify processing data. 2️⃣ Complaints Guidance By June 2026, organizations must have a clear process for handling data protection complaints. The ICO outlines: ✔️ Provide a way for people to submit complaints ✔️ Acknowledge within 30 days ✔️ Investigate and keep people informed ✔️ Communicate outcomes without undue delay The ICO also recommends keeping detailed records of complaints, acknowledgements, investigations, and outcomes. Why this matters: • For DPOs & privacy teams: time to assess how the new “recognized legitimate interest” fits into your organization’s processing activities. • For compliance leaders: now is the moment to design or update complaint-handling processes well before June 2026. The ICO is seeking feedback. If your organization could be affected, it’s worth getting involved. *See my comments for links to both feedback forms.* What do you think: will “recognized legitimate interest” simplify compliance, or create new grey areas? #DataProtection #ICOUK #DUAA #LegitimateInterest #DPO

79

5 Comments

Criminal prosecution for data protection violations just happened in the UK. I found a case from Mishcon de Reya LLP that changes everything for privacy professionals. A care home director was *criminally prosecuted* and fined £6,540 for blocking and erasing records after receiving a Data Subject Access Request. This wasn't just a civil enforcement action. Section 173 of the Data Protection Act 2018 makes it a criminal offense to alter, erase, or conceal information once a DSAR is received. The director tried multiple defenses: claiming staff provided the information, the care home manager was responsible, the company was deregistered from Information Commissioner's Office in 2016, and that the building itself wasn't a data controller. None worked. Here's what privacy leaders need to know: a. Criminal liability applies to data controllers AND individual directors and staff members. Your personal exposure goes beyond corporate fines. b. The ICO has historically focused on civil enforcement. This criminal prosecution signals a potential shift toward aggressive enforcement. c. DSAR compliance isn't just about civil penalties anymore. Prison time and personal criminal records are now possibilities for executives. Three immediate actions for your organization: 🔒 Review your DSAR response procedures to ensure no alteration or concealment occurs after requests are received. 🔒 Train directors and senior staff on personal criminal liability under section 173. 🔒 Document your DSAR handling process to demonstrate compliance and good faith efforts. This case represents the first known section 173 prosecution. It won't be the last. What's your organization doing to protect executives from personal criminal liability in data protection matters? ----- Data > Nuance. is your friendly neighborhood privacy office.

167

8 Comments

👉 It has largely become current practice for processors to host a DPA on their websites to standardise service models, with those DPAs being often incorporated by reference into MSAs, SoWs, PoCs or other contractual instruments. Under Article 28(3) and (9) GDPR, this can be lawful where the Member State's contract law treats the referenced terms as binding. In truth, Article 28(3) and (9), beyond prescribing mandatory content and demanding a written form, allows as much freedom of negotiation as EU and Member State law permit. However, I would still highlight two main problems with this approach, and a third that specifically concerns SCCs. When the operative DPA lives at a URL the processor controls, version stability and genuine oversight become aspirational at best. Controllers can still save a PDF for evidential certainty, but that is a workaround, not governance. This approach also weakens the controller’s oversight as the DPA terms float on the processor’s website, leaving less room for review and version control. For controllers, that tension sits uneasily with Article 5(2) accountability and the concrete powers and duties embedded in Article 28. As for SCCs, this is another matter entirely. Commission Implementing Decision EU 2021/914 frames them as a statutory transfer mechanism, not a freely negotiable contract. Precisely because of that character, which includes text that is not open to derogation adopted by the Commission, choices confined to module selection and annex completion, supremacy of the clauses over conflicting terms, and the conferral of third-party beneficiary rights on data subjects, I consider that SCCs require formal execution. And yes, that means the exporter and the importer should sign. Incorporation by reference without the completion of the modules and the annexes, often relying on one brief mention in the DPA, which is itself only referenced in a SoW, feels unreliable from both a transparency and legal certainty perspective. This echoes a point explored by Paul Breitbarth in one episode of Serious Privacy, who notes that SCCs operate as law-imposed clauses, and treating them as ordinary boilerplate misses the point. I can already anticipate the criticism pointing to excessive formalism that seems unnecessary when, from context, it is obvious that the parties manifested their willingness to be bound by the SCCs. You would be right. Moreover, would supervisory authorities and courts still accept incorporation by reference where intent is clear? Possibly. But if we take the SCCs’ legal nature seriously, the case for formal execution is strong, and the growing reliance on URL-hosted DPAs raises real questions for accountability. Ultimately, this is a choice between convenience and accountability.

34

9 Comments