Removing data

[Lan123]

Hello, my child was recently involved in an incident with rlp and I was wondering on what grounds can I ask for their information to be removed. As they signed the paper given to them, does that mean the company has the rights to their information? We have payed the sum because the issue was negatively affecting their mental health but now the remaining question is future implications. Even if there aren’t any, I still would not like my child’s data in the hand of this anonymous company and it’s partners. Therefore is there any way at all I would be able to force the company to get rid of it; my child is just below the age of an adult but got into the situation because of friends.

[R0b]

I have always been a little wary of RLP's right to use one's data in their own right. The are instructed by retailers for the purpose of recovering losses suffered by their clients. They should not (in my view) be entitled to use that data for any other purpose than the reason it was given. To hold and store information as they see fit on a "what if" basis suggests they might be in breach of the GDPR. The rules around processing a child's data are even more strict.

I suspect they might argue legitimate interest but for the purposes of their services, I don't think that is sufficient. Your data should only be processing for the specific purpose it was initially intended and if that purpose has been satisfied, then they need to consider deleting the data.

Do you have any letters from RLP that explains how they use the data.

[Lan123]

The bit about 'Personal data and what it can be used for' in the letter quotes

"Your data has been passed to us by our client so that we can make a claim against you for the losses they suffered as a result of the incident it is said that you were involved in.
Whilst you are a juvenile you have the same rights as an adult in relation to the data that we hold about you.
If you want us to deal with someone else, such as a parent or a social worker, on your behalf then you need to tell us that.
Should you fail to contact us then we will need to consider whether it is in your best interest for us to contact your parent or guardian to assist you in dealing with the claim.
We shall retain your data for a period of 6 years from the date of the incident, unless our client tells us to delete it.
The data will be shared, if necessary and with the instructions of our client, with third parties to enable us to pursue the claim.
If you have any questions then please see our Data Protection Notice on our website or contact our Data Protection Officer.


As well as this, the data protection notice in the letter states:

"Your details and the information concerning the incident(s) that you were involved in, ("the data") has been passed to us by ou Client to enable us to exercise, on their behalf, a legitimate interest that they have; namely their legal right to pursue a civil claim against for damages for the loss that you caused as a result of the incident(s) we have written to you about.

Any information given by you, or a third party on your behalf, ("additional data"), will be shared with our Client, as necessary. We shall not share "the data" or "additional data" with any third party said to be contacting us on your behalf unless we have your specific instructions to do so. "The data" and "additional data" will be passed by us to third parties as necessary for the pursuance of the claim against you.

We shall retain data and additional data for a period not exceeding the time limit as prescribed by the relevant legislation in the jurisdiction in which the claim would be brought, unless we are instructed to delete the data before the date by our Client.

All the data and additional data will be kept in strict compliance with applicable Data Protection Laws. In England, Wales, Scotland and Northern Ireland this includes the General Data Protection Regulation EU 2016/679, (GDPR); the Data Protection Act 1998 and upon enactment the Data Protection Act 2018. In the Republic of Ireland, (ROI), this includes the GDPR and the Data Protection Acts 1988 to 2018.

The website states:

[jaguarsuk]

If your child is 13 or younger they cannot give consent for the processing of their personal data under Article 8(1) of GDPR as amended by the Data Protection Act 2018 s.9.

If they cannot give consent RLP have illegally processed your child's data and you should inform them that if they do not repay you the money you have paid, remove all your child's data from their systems and cinfirm they have done such you will report them to the Information Commissioner for the breach of GDPR.

Article 8(1):
Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

DPA 2018 s.9 Child’s consent in relation to information society services


In Article 8(1) of the GDPR (conditions applicable to child’s consent in relation to information society services)—

(a)references to “16 years” are to be read as references to “13 years”, and

(b)the reference to “information society services” does not include preventive or counselling services.

Article 6(1)(a)
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
=> Article: 9
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[Lan123]

Even if the client still holds the information, which makes more sense, I do not understand on what basis they are allowed to keep the information once their jobs is done. I have seen somewhere that they say they keep the data so if an incident occurs again then further action can be taken, but that doesn't match what they state their purpose is.

s my child is also nearly an adult, with absolutely no intentions of getting caught in any of this ever again, wouldn't it make sense for them to delete the data because once they are an adult, if this happened, the police would get involved anyway (which I assume is the further action they are talking about).

I do not mind if the initial Client who made the claim has the information, but this company is not trustworthy and I don't want any data shared, so although they say removal has to be brought to the Client, can I not state that they have to explicitly delete the data.

[Lan123]

Sorry I didn't see your newest message

[Lan123]

I use the word child as I don't want to post any identifiers that the company can use to reference against us, but they are recently turned 17. I know this is an age where common sense should be known but for one, they honestly did not know their friend had stolen from the shop as they were leaving it. If cctv was checked the company would not see my child take anything from the store, but as they had an item in their bag without a receipt and were claimed to be an assailant in their friends' actions, a claim was brought upon them too.

[Lan123]

To be clear the item was from another store, and I know it was not even bought on that day, but apparently the guards ignored this.

[jaguarsuk]

Even if the client still holds the information, which makes more sense, I do not understand on what basis they are allowed to keep the information once their jobs is done. I have seen somewhere that they say they keep the data so if an incident occurs again then further action can be taken, but that doesn't match what they state their purpose is.

Your child gave them authority to process their data and once they have authority the law allow them to keep their data as far as I am aware there is no time limit for them to delete it. Their argument would be their job is not done because your child could do it again.

s my child is also nearly an adult, with absolutely no intentions of getting caught in any of this ever again, wouldn't it make sense for them to delete the data because once they are an adult, if this happened, the police would get involved anyway (which I assume is the further action they are talking about).

The Police would be very unlikely to be involved as they don't have the resources, so these charlatans pursue adults for the same purpose.

I do not mind if the initial Client who made the claim has the information, but this company is not trustworthy and I don't want any data shared, so although they say removal has to be brought to the Client, can I not state that they have to explicitly delete the data.

Article 17(1), specifically (a) and (b) should be tried to exercise right of erasure

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

[Lan123]

Can consent be withdrawn after signing and paying?
So is there any point in asking for the right to erasure, or are we legally bound?
Also thank you for the quick responses.

[jaguarsuk]

Can consent be withdrawn after signing and paying?
So is there any point in asking for the right to erasure, or are we legally bound?
Also thank you for the quick responses.

You can ask for erasure at any point, but they can refuse with a good reason why they shouldn't hence why I said their argument will likely be they need it in case your child does it again.

[Lan123]

Okay, I don't believe there is any point then, ceasing contact may just be better. But do you know anything about my question of future implications; if all the data is used for is possible reoffence, there should be no impact on jobs or schools or credit and records?

[jaguarsuk]

There’s no impact at all, you shouldn’t have even paid, all their threats were empty. Only a court can fine and they couldn’t take your child to court because they tried it once then got hammered in court by the judge, so they never will again.

[Lan123]

I pray that is the case; my child used their money to pay for it anyway out of guilt.*

[Lan123]

Thank you for the help.