GDPR Application to the Court

[Threeleaf]

I am not a solicitor or legally trained, but would like to bring an application to court under GDPR for the rectification if inaccurate data which I think is article 16.

The organisation which has refused to rectify inaccurate information is the Solicitors Regulation Authority (SRA).

Can an anyone give me any advice about making the application!

I am am assuming I can apply to the county court under what appears to be called a Part 7 procedure and complete for N1, but can anyone give me any advice about whether this is right and if if so the best way of doing this?

Also, can I refer directly to GDPR in the application or do I need to reference the DPA 2018?

Many many thanks for any assistance

[R0b]

Hello,

you are going to have to explain how or why the data is inaccurate. Did you make an official request for rectification and what was the SRA’s response?

[Threeleaf]

Thanks very much for replying.

Yes I’ve notified the SRA under the terms of the old DPA. The data is definitely inaccurate. The SRA have accepted it’s inaccurate but argued that (a) the correspondence serves to correct the inaccuracy and (b) that some parts of it are not personal data.

However I don’t accept that (a) is sufficient and the ICO have advised me that (b) is wrong based on the definition of personal data under GDPR.

The matter is time-sensitive and so in the absence of a willingness to resolve the matter from the SRA I would like to make the application to the court.

Im not seeking damages. I just want to supplement the inaccurate information with an agreed statement of truth and recover my costs.

[R0b]

Well I’m not sure a letter would serve as compliance with your request for rectification of the inaccuracy if that data is being held elsewhere - depends on the nature and what exactly needs rectifying.

The same would apply for (b) and f the ICO have suggested that the data would fall within the meaning of the definition in GDPR that might assist you in court.

If you haven’t already then you might want to notify the SRA of your intention of now issuing a claim having failed to rectify the inaccurate data.

In terms of the court fees as it’s a non money claim. I think the fees are around £310 and it would be a part 7 application as it’s likely to involve a substantial dispute of fact. you should issue the claim at your local county court and serve it on the SRA registered office.

I dont one have a specific GDPR application for rectification but I do have a relatively simple one under the DPA - I’m out at the moment so I won’t be able to supply this until tomorrow evening.

You can refer to GDPR directly because it’s a Regulation meaning that (unlike a Directice) EU member states are not required to implement national law (except if they want to apply any derogations). Since were are still in the EU the GDPR continues to have effect until we leave. The DPA 2018 is largely the same as the GDPR but with a couple of exceptions so it will need to be read side by side to see if there’s any differences - for data subject rights I don’t think anything has changed between GDPR and DPA 2018

[Threeleaf]

Thank you. This is incredibly helpful.

I share your view that the exchange of letters should fall short of compliance.

Thats really useful on the process and the form. If you do have some kind of example that would also be extremely helpful as filling out an application for the first time is a somewhat daunting prospect.

I assume I can reference the relevant GDPR articles instead of part 14 of the old DPA?

thanks very much!!

[R0b]

Hello

I've had a look through my templates but I don't seem to have a specific one for erasure (I thought I did). However, I can't see it being much different from any breach of DPA/GDPR just requires some re-wording to suit the relevant points. I've set out some basic Particulars of Claim for a breach of data protection which might assist you. Do note that they are very basic Particulars and do remember to keep to facts only and concise too. You don't need to go into every inch of detail but enough information for the SRA to know what it has to defend.

-------------------------------------------------------------------------------------------------

1. The Claimant is a <insert profession (if any) or job type> whereas the Defendant is the regulatory body for solicitors in England and Wales.

2. The Defendant holds certain information pertaining to the Claimant <how do they hold your information?> including, amongst other things, <list of some information they may hold>.

3. For the purposes of Article 4 of the General Data Protection Regulations (the "GDPR"), the Defendant is the data controller in respect of personal data, of which the Claimant is the data subject.

4. Further to Paragraph 3, the Information held by the Defendant amounts to personal data and the obtaining and storing of the Information amounts to processing of data for the purposes of Article 4 of the GDPR.

5. On or about <date>, the Claimant became aware that <inaccurate information> held by the Defendant was inaccurate and subsequently wrote to the Defendant on <date> requesting that the Information be rectified.

6. In a letter to the Claimant dated <date>, the Defendant admitted that <information> was inaccurate but denied that <other information> amounted to personal data within the meaning of the GDPR.

7. The Claimant complained to the Information Commissioner's Office who confirmed that in their view, the <other information> did in fact amount to personal data.

8. By reason of the Defendant's refusal to rectify the <other information>, it is in breach of its statutory duty under Article 5(d) of the GDPR in that:

a. <list reasons why it is inaccurate>

9. Unless restrained by the Court the Defendant will continue to process the <inaccurate information> in breach of its duty under Article 5(d) of the GDPR.

AND the Claimant claims:

(1) An injunction to restrain the Defendant from continuing to process the inaccurate information.

(2) An Order for the rectification of the inaccurate information held by the Defendant.

(3) Further or other relief.

(4) Costs.

-------------------------------------------------------------------------------------------------

I share your view that the exchange of letters should fall short of compliance.

This will all depend on what was contained in the letter, if the SRA said something like "we are writing to confirm that we have now corrected the inaccurate data" then I would that is sufficient to confirm they have complied, assuming the data has been updated.

The application form itself is relatively straightforward. In the brief particulars of claim you simple say a few sentences like, "The Claimant seeks and Order for the rectification of data held by the Defendant in breach of its statutory duties under Article 5(d) of the General Data Protection Regulations."

Then your detailed Particulars go into the larger box further down below.

Hope that helps

[Threeleaf]

That’s fantastic thanks. I’ll let you know what happens