As the General Election approaches, and with trust in politics and politicians at an
all-time low, political parties need to ensure that they are open, transparent and accountable about how they use members and voters’ personal data. In the past few years, all parties have been accused of riding roughshod over data protection laws in their attempts to convince voters that they ‘have a plan’ or that ‘the country needs change’.
Last month we wrote about The Good Law Project’s challenge to the Tory’s “data harvesting” from users of its online tax calculator. And last week, Rachel Cunliffe, Associate Political Editor of the New Statesman, wrote about how she had received an email from the Conservative Campaign Headquarters (CCHQ) about their forthcoming conference; she could also see the other 344 recipients as they were all listed in the “To” box, along with their email addresses. CCHQ had made the classic mistake of failing to use blind carbon copy (BCC) and thus, by exposing the personal data of recipients, breached the UK GDPR.
In the interests of political balance, today we want to tell you about a recent case where the Labour party has been accused of failing to comply with the GDPR when dealing with a Subject Access Request. According to openDemocracy, Police dragged a Palestinian man, Dalloul Neder, out of a Labour fundraising event in January, after he held up a photograph of his late mother and told the audience: “I lost my family in Gaza… I want to show you my mum.” Neder later submitted a SAR to the party, asking it to disclose any personal data they had collected about him, only for it to be rejected. An email from the party, seen by openDemocracy, says Neder’s SAR is “manifestly unfounded”.
ICO Investigation
Labour’s rejection of Neder’s SAR comes as the party is under close scrutiny after repeatedly falling foul of data protection legislation. openDemocracy says that the ICO has an open investigation into the party’s handling of SARs. It has dealt with nearly 400 complaints against Labour in the two years to November 2023 that relate to data protection legislation, including SARs.
Correspondence seen by openDemocracy from that time period shows that the ICO said: “We will be monitoring their progress and ensure that [the Labour Party] improves its data protection practices.” The letter confirms that Labour has “not complied with its obligations under the data protection legislation”. Several individuals who have submitted SARs to the Labour Party told openDemocracy that their requests had been ignored for weeks and then rejected for spurious reasons, or provided with key documents missing.
Earlier this month, an openDemocracy report revealed concerns about the handling of SARs by public authorities and other organisations in the UK. People requesting copies of their private information, such as police or immigration records, have faced long delays or had their requests ignored entirely. Others have been given folders with key documents missing.
This is having a knock-on effect in the justice system, with lawyers telling openDemocracy that asylum applications and claims for false imprisonment have been put on hold due to the delays. Victims of the Windrush Scandal have also struggled to obtain copies of their immigration papers in order to claim compensation.
Our upcoming Handling SARs course can help you deal with complex subject access requests. Places are limited so book early to avoid disappointment.
