Re: Caught shoplifting
The answer to that question, very simply, Labman, is "No". Although Tesco passed OP's personal data to RLP and RLP is acting under Tesco's instructions, Tesco is responsible for any data it handles, in the same way RLP is responsible for any data it handles. The ICO would regard RLP and Tesco as two separate defendants.
If any action is taken under the DPA, the most likely infringements will be:-
Improper Disclosure of Personal Data
Using Personal Data for an Illegal Purpose
Allowing Personal Data to be Used for an Illegal Purpose
Failure to Comply with a Subject Access Request can be Without Lawful Reason or Without Reasonable Excuse
The above list applies to both RLP and Tesco.
Originally posted by labman
View Post
If any action is taken under the DPA, the most likely infringements will be:-
Improper Disclosure of Personal Data
Using Personal Data for an Illegal Purpose
Allowing Personal Data to be Used for an Illegal Purpose
Failure to Comply with a Subject Access Request can be Without Lawful Reason or Without Reasonable Excuse
The above list applies to both RLP and Tesco.
Comment