Article 13 GDPR (Data Protection Act 2018)

abedegno

Noree wrote: »

NGP Ltd seem to have their privacy policy in place. Might have to SAR by email. Other than the template on this thread, does anyone know of any other email template examples?

https://www.ngpltd.com/privacy

Any issues/suggestions with the template I can incorporate those into my earlier draft.

abedegno

So ParkingEye's deadline to respond to my subject access request has passed - time to raise another complaint with the ICO...

Coupon-mad

Keep going, abedegno! :T

abedegno

The plot thickens, further pushing on Article 22 (Automated decision making) I quickly got this response:

The DVLA does not make decisions based solely on automated processing including profiling. Therefore, this right is not applicable to the personal data processed by the DVLA.

I don't think this is true, is there any evidence I can point at to suggest the issuing of drivers details via KADOE is entirely automated?

Best Regards

Jon Williams

beamerguy

abedegno wrote: »

The plot thickens, further pushing on Article 22 (Automated decision making) I quickly got this response:

The DVLA does not make decisions based solely on automated processing including profiling. Therefore, this right is not applicable to the personal data processed by the DVLA.

I don't think this is true, is there any evidence I can point at to suggest the issuing of drivers details via KADOE is entirely automated?

Best Regards

Jon Williams

Considering that 5.65 million tickets were issued last year,
how many staff would the DVLA need.

Probably more like whilst the automated system
churns out names and addresses, the staff at the DVLA
are looking out the window watching pink pigs
fly over Swansea

abedegno

Draft response below, comments welcome:

I believe your assertion that the DVLA does not make decisions solely on automated processes is incorrect and will set out the reasons why below:

• The latest copy of the KADOE fee-paying contract I have seen[1] suggests that after a probation period of 26 weeks organisations are able to make electronic submissions to request registered keeper details.
• This electronic service appears to make a decision to release registered keeper data automatically and without human involvement. It also seems infeasible for it to operate in any other way as the DVLA appears to have only 5,698 employees[2] and the number of fee and non-fee paying requests for FY2017/2018 totalled 20,450,951[3]

As such, rights granted under article 22 of GDPR are applicable in this case which I am exercising as per my original communication dated 9 June 2018.

Best Regards

Abedegno

Sources:
[1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/455973/Annex_A_-_KADOE_Fee_Paying_Contract_V4.pdf
[2] https://www.gov.uk/government/publications/dft-gender-pay-gap-report-and-data-2017/dfts-gender-pay-gap-report-2017
[3] https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/699770/kadoe-enquiries-q4-2017-18-v2.xlsx

Castle

Have you asked what, (and at which point), manual intervention is made in the processing of the data subject's data following a KADOE submission.

abedegno

Castle wrote: »

Have you asked what, (and at which point), manual intervention is made in the processing of the data subject's data following a KADOE submission.

Thanks - I'll ask that in my response.

abedegno

I've also sent an FOI request to the DVLA asking them to detail what processes they have which fall into the category of 'automated individual decision-making and profiling'

Umkomaas

In terms of the number of KADOE requests and the (total) number of staff employed by the DVLA, why not, at this stage, just ask the rather anodyne question 'How many personnel are involved in the manual decision making process?' Then hit them in response with the 20 million figure and ask just how can x number of staff possibly deal with the logistics of any manual intervention.

Paint them into a corner.