We recently wrote about the The Good Law Project (GLP) challenging one aspect of the Conservative Party’s data collection practices. The party’s website contains an online tool which allows an individual to calculate the effect on them of recent changes to National Insurance contributions. However GLP claims this tool is “a simple data-harvesting exercise” which breaches UK data protection laws in a number of ways. It says that a visit to the website automatically leads to the placement of
non-essential cookies (related to marketing, analysis and browser tracking), on the visitor’s machine without consent. This is a breach of Regulation 6 of PECR. GLP also challenges the gathering and use of website visitors’ personal data on the site claiming that (amongst other things) it is neither fair, lawful nor transparent and thus a breach of the UK GDPR.
Director of GLP, Jo Maugham, has taken the first formal step in legal proceedings against the Conservative Party. The full proposed claim is set out in the GLP’s Letter Before Action. The Conservative Party has issued a response arguing that they have acted lawfully and that:
- They did obtain consent for the placement of cookies. (GLP disagrees and has now made a 15-page complaint to the ICO.)
- They have agreed to change their privacy notice. (GLP is considering whether to ask the court to make a declaration of illegality, claiming that the Tories “have stated publicly that it was lawful while tacitly admitting in private that it is not.”)
- They have agreed to the request by GLP to stop processing Jo Maugham’s personal data where that processing reveals his political opinions.
Following a subject access request, Mr Maugham received 1,384 pages of personal data held about him. GLP claim he is being profiled and believe that such profiling is unlawful. However the Conservative’s would not say who Mr Maugham’s personal data was being shared with. Following a threat of legal action, the party has now disclosed that it shared the data with PR companies and media companies all with links to the Tory Party. According to GLP the disclosure throws “some light on the type of grubby tactics we can likely expect to see in the upcoming general election.”
As an election draws nearer, expect the spotlight will be on all political parties’ data processing activities.
Our upcoming Handling SARs course can help you deal with complex subject access requests. Places are limited so book early to avoid disappointment.
