Court action for failure to respond to GDPR data request?

[Demeter]

Hello,

pretty much as the thread title states. This is not a case of data not being protected which may be handled differently. If anyone could advise on if i have to complete the new media and communications pre action protocol or if i can just serve? I assume it doesnt apply to this type of GDPR breach. Also would this be a claim through CCMCC and with a part 7 form? The ICO have said they have a big backlong and have not been especially helpful so court seems the best option for an order to comply.

Thank you

[R0b]

All claims relating to data protection law should follow the Media and Communications Protocol, as Part 53 of the CPR confirms that.

You can still issue DP claims in the County Court but the Money Claims Online system is just that, money claims. If you are asking the court to make an order that the data controller comply with your request, then that would need to be a paper claim using the N1 Claim Form and processed at the CCMCC. If it's a money claim plus an order other than money, you should still use CCMCC.

Also note the cost difference for asking the court to make a non-money related order, check the court fees I'm sure it's around £300.

[Demeter]

Hello,

thanks for clarifying the process. But there is no issue of defamation or loss/misuse of data, it is simply a refusal to process a subject access request, surely that does not require the full pre action process which seems to apply only to the above? After all if an organisation is refusing pre action will get us nowhere.

[R0b]

Have you read Part 53 of the CPR?

[Demeter]

https://www.justice.gov.uk/courts/pr...l/rules/part53 this? yes and was confused as it was saying it had to go to the High Court for any Data protection claim. Is there other information i have missed?

[Demeter]

Forgot to ask do i have to explain the exact breaches, which articles? the GDPR is huge. Thank you

[R0b]

Claims can be made in the County Court as it has jurisdiction.

https://www.legislation.gov.uk/ukpga...on/180/enacted

Also see 2.4A(1) of Practice direction 7A

As the claim is a data protection issue, I would follow the protocol. If you don't follow the protocol then you will still need to follow the Practice Direction for Pre-action conduct and protocols. Either one you choose to comply with will need to identify the breach and give sufficient information for the defendant to understand the case against them.

So yes, you do need to explain the exact breaches of the GDPR in the same way you would explain how they would have breached a contract. If they have not complied with a subject access request then you mention that and refer to the relevant Article of the GDPR which in this instance is Article 15. Not sure what relevance that the GDPR is a large piece of legislation has to do with reference the relevant article/breach.

Really, it's up to you to decide whether you want to ignore the protocols and issue a claim or send a letter before action and give sufficient detail about what you will be claiming. If you do issue a claim, there is a risk that the defendant might argue that you failed to comply with pre-action protocols and the claim should be stayed whilst you comply or some other sanction which could be costs against you or costs/compensation reduction.

[Demeter]

Sorry for the delay in response Rob, I am reliant on a loan laptop at the moment. I will be following the protocol as that seems best.

You said : Not sure what relevance that the GDPR is a large piece of legislation has to do with reference the relevant article/breach. I did not go into the full details of everything that has happened, they did not just fail to provide a response, they also passed confidential data to another organisation and possibly deleted data related to this. I had assumed that these would not be covered under Article 15. Thanks again.

[R0b]

Why don't you have a stab at drafting the letter before action, post it up on here for review and we can help you decide which protocol is best.

[Demeter]

Hello, sorry but i am not comfortable posting my correspondence on a public forum because of the organisation i am dealing with.

I have sent them a pre action letter, it contains the issues but not the specific protocols other than article 15. All i need at this point is some guidance, if possible on if the following issues are under a different article: passing confidential data and communications to a third party and possible deleting of internal personal data related to a complaint.

Thank you.

[MIKE770]

You got proof of this happening???

[R0b]

Don't think I have anything more to add, either you send the pre-action letter under the PD for pre-action conduct or the media and communications protocol. At the end of the day, as long as you give sufficient information and reasons why you are claiming, it's not likely that the defendant will take issue with your lack of pre-action conduct.

[Demeter]

Hello,

regarding proof, yes on most issues but I need the GDPR responses themselves to confirm how serious that is.

Rob, I have sent the pre action letter as you advised, what it did not contain was any specific article beyond 15 which is what i wanted advice on, as i was worried that without mentioning any specific article the court would send it back. If nobody here knows of any other legalese i need to mention then i will just proceed.

They have failed to respond to the pre action in time anyway and ask for further time after the deadline which i do not think is ok. Surely I do not need to keep giving them extetensions?

[R0b]

I don't know if there's anything else you need to mention. Article 6 of the GDPR are the lawful conditions for processing personal data, but you've not mentioned if the confidential information is sensitive data or not. That's really up to you to decide since we don't know exactly what it is they are in breach of.

Issuing legal proceedings should be last resort, so if they have asked for more time, then you can offer them a short extension if they've already had plenty of time e.g. if they've already had 14 days you could give them another 14, but if they've had 28 days already then offer something shorter. You should explain your reasoning in your response in case your actions are challenged in court at a later date.

[Demeter]

Thank you Rob. Yes it is sensitive information in that it involved discussion of a private matter that the third party knowing would give them an advantage in another matter but not sensitive in terms of being able to identify me out in the world like a leak would..