Subject Acces Request - Refusal to disclose

[prophet01]

A few months ago I agreed to be a witness in respect of an investigation into allegations of bullying being undertaken by a specialist independent organisation appointed by a UK sports governing body.

The 2.5 hour long interview was conducted via zoom and recorded by the investigator as a record and to assist him in drafting a statement which he then proposes to send to me to "review, correct or expand in any way you wish, and return signed and dated to indicate you agree with the contents."

Now here's the thing. Today, the organisation rejected my request for a copy of the audio file on the following basis:
"Your data is inextricably linked with third party data. We do not have the consent of those third parties to disclose their personal data to you nor do we have consent to share the recording itself. Accordingly, we do not consider it reasonable under the circumstances to disclose this information.”

Setting aside the absurdity that the information concerning "third parties" came from my own lips, surely their excuse for withholding the information from me in audio format equally precludes them from sending the same information, as a statement for my review and acceptance, in written format. Quite bizarre.

I feel a complaint to the ICO coming on. If only to obtain clarification as to whether the organisation's interpretation and application of the DPA is reasonable.

 

[Clinton]

You need to put your arguments to them in the ICO complaint letter format and wait 30 days before you can take your complaint to the ICO.

Threatening to get a Court Order might also work. Make sure you put them on notice for costs.

Don't argue about the written format absurdity. Just keep it simple. I want the audio file. Send it.

 

[prophet01]

You need to put your arguments to them in the ICO complaint letter format and wait 30 days before you can take your complaint to the ICO.

Correct advice having looked into it: What do I need to do before I can complain to the ICO? ?

Threatening to get a Court Order might also work. Make sure you put them on notice for costs.

Ordinarily I'd definitely consider that, however, don't wish to piss-off the investigator too much as we want him to come to the strongest conclusion.

 

[prophet01]

Don't argue about the written format absurdity. Just keep it simple. I want the audio file. Send it.

I belive it worth highlighting the absurdity as it might just bring them to their senses. This organisation
operates at the highest levels of world sport conflict resolution and they have a reputation to uphold. See the below links in respect of their most recent cases:
DP World Tour vs LIV Golf rebels
Allegations of abuse and bullying against Swim England

 

[prophet01]

Disappointingly, the organisation has now refused to overturn their decision to reject my SAR and refused to explain the inherent inconsistencies.

Me: "I would appreciate your earliest clarification of the several inconsistencies in your explanation and a more detailed explanation of the basis of your rejection. Alternatively please simply send the audio file as requested."

Them: "We have considered your below email and note the points raised, including that you wish your email to be treated as a formal complaint... With respect to disclosure of the audio recording, our position remains as in the letter sent to you on 9 May 2023. You are of course entitled to make a complaint to the Information Commissioners Office in relation to our response."

It'll be interesting to see how the ICO views, and addresses, the organisation's deliberate contrary interpretations of the DPA to suit whatever outcomes they desire.

 

[Clinton]

Sorry to inform you but the ICO will do jack.

You can put in a formal complaint to the organisation itself but I'm sure nothing will come of that (but you do need to put that complaint in if you wish to stand any chance of getting the ICO or a court to rule in your favour later).

Your steps:

1. Put in your formal complaint to the organisation after carefully reading their complaint procedure document (to make sure you've done the complaint meticulously and sent it to the right address).

2. Lodge your complaint with the ICO (because you'll need to show the court you explored every other option).

3. Start working on your application to court (because, eventually, this is what you'll have to do if you want that audio file). So, for example, they should have told you about what you can do if you are not happy with their response. They should have not just told you about the ICO but given you ICO contact details in their refusal email. They should have also told you, in that letter, that you have the option of going to court. They may have made other mistakes in their refusal so it may be worth talking to a good lawyer who's an expert in this area.

 

[Newchodge]

A few months ago I agreed to be a witness in respect of an investigation into allegations of bullying being undertaken by a specialist independent organisation appointed by a UK sports governing body.

The 2.5 hour long interview was conducted via zoom and recorded by the investigator as a record and to assist him in drafting a statement which he then proposes to send to me to "review, correct or expand in any way you wish, and return signed and dated to indicate you agree with the contents."

Now here's the thing. Today, the organisation rejected my request for a copy of the audio file on the following basis:
"Your data is inextricably linked with third party data. We do not have the consent of those third parties to disclose their personal data to you nor do we have consent to share the recording itself. Accordingly, we do not consider it reasonable under the circumstances to disclose this information.”

Setting aside the absurdity that the information concerning "third parties" came from my own lips, surely their excuse for withholding the information from me in audio format equally precludes them from sending the same information, as a statement for my review and acceptance, in written format. Quite bizarre.

I feel a complaint to the ICO coming on. If only to obtain clarification as to whether the organisation's interpretation and application of the DPA is reasonable.

I realise this is off topic but I would be very unhappy with

The 2.5 hour long interview was conducted via zoom and recorded by the investigator as a record and to assist him in drafting a statement which he then proposes to send to me to "review, correct or expand in any way you wish, and return signed and dated to indicate you agree with the contents."

after

A few months ago I agreed to be a witness

Are they seriously not supplying the written statement months after you gave the interview? There is no way you can realistically confirm its veracity after that period of time, especially if they are refusing to provide the audio tape. I would be worried that something else is going on here.

 

[prophet01]

Sorry to inform you but the ICO will do jack.

I assume you mean that they "will do jack" unless I've sbmitted a formal complaint to the organsation.
Apologies if I failed to explain but the quotes in my last post were from the organisation's response to my submitted formal complaint to them.

So I'm at stage 2. in the steps you've set out. i.e. submit my complaint to the ICO which I shall draft today.

 

[prophet01]

@Newchodge

I realise this is off topic but I would be very unhappy with

Not at all off topic. It's wholly pertinent and is something I didn't really pick up on as an issue, so thank you.

It's actually far worse. The bullied victim was interviewed 6 months ago and still awaits the investigator's draft statement for her to "review, correct or expand in any way you wish, and return signed and dated to indicate you agree with the contents."

We too concluded some time ago that the above, in conjunction with the apparent glacial rate of progress of the investigation, strongly suggested something else was going on.

 

[Clinton]

I assume you mean that they "will do jack" unless I've sbmitted a formal complaint to the organsation.

They will do jack after you've submitted your formal complaint etc.

But you've got to wait till the organisation does jack, and till the ICO does jack, before you can go to court.

 

[prophet01]

I know the ICO will do next to nothing hence in my initiating post I state:

I feel a complaint to the ICO coming on. If only to obtain clarification as to whether the organisation's interpretation and application of the DPA is reasonable.

However, they will apply some pressure on the organisation to satisfactorily close out my complaint, in respect of the organisation's wholesale rejection of my SAR, by issuance of their standard letter.

That might actually persuade the organisation to accept that their nonsensical rationale is just that, nonsensical. Resulting, hopefully, in them providing the recording without recourse to litigation.

 

[Clinton]

However, they will apply some pressure on the organisation to satisfactorily close out my complaint...

I highly doubt it.

What most people fail to appreciate is that regulators don't exist to do anything. They exist to give the impression that they're doing something.

So, for example, have a serious complaint about a hospital and send it to the CQC and do you know what they'll do? The CQC will forward the letter to the hospital and tell them to deal with it! And that's the last you'll hear from the CQC.

Ofsted have been notified numerous times about illegal madrasas being operated as schools in the UK and not registered with Ofsted as schools, contrary to the law, and you know what Ofsted do? Nothing! They'll tell you that they take the matter very seriously and that they've written to the party and are awaiting a reply. And the matter will die a natural death.

Similarly with the ICO. They'll have a standard letter they send to the offending party and the offending party will have some standard letter they send in response to the ICO, and both ICO and the offending party will be laughing behind your back because you think that something is actually happening when, in fact, it's just one party's computer talking to the other party's computer to put in place a trail of paperwork to cover their asses in case the matter ever later gets to court.

 

[Newchodge]

May I suggest you engage your energy in what matters here - an apparent failure to investigate a serious allegation. The data access request seems more like a red herring.

 

[prophet01]

They'll have a standard letter they send to the offending party

That's all I was referring to in my my last post.

However, they will apply some pressure on the organisation to satisfactorily close out my complaint, in respect of the organisation's wholesale rejection of my SAR, by issuance of their standard letter.

I'm under no illusions about the low level of pressure they're willing to apply but it's better than nothing and it might just yield the desired outcome.

 

[prophet01]

@Newchodge
I understand what you're saying but the SAR issue is pertinent to the investigation.

Concerning the apparent, extraordinary lack of progress of the investigation the victim will soon take up the matter with the appointing governing body.

 

[prophet01]

I've now received a response from the organisation to my formal complaint.

The CEO simply stated "The conclusion I have reached is that I support the decision to withhold the recording for the reasons provided."

Considering that those "reasons" failed to properly explain the grounds for their rejection of my SAR coupled with a refusal to adress my requested explanatinon for the gross inconsistency — in refusing to provide the audio recording yet, in the same rejection letter confirming that they would send me a copy of the draft statement containing the same information — that's quite a bold statement coming from a former solicitor.

In the intervening period I found the ICO' detailed guidance for organisations specifically in respect of this type of situation, What should we do if the request involves information about other individuals?, of which the final section confirms the obvious:
"It is more likely to be reasonable for you to disclose the information if:

• the individual making the request has previously received the third-party information;
• the requester already knows the information; or
• the information is generally available to the public."

So, yesterday, I decided to give them another opportunity to reconsider their decision by referring to the guidance and stating that "in this instance the requested document is a voice recording of me being interviewed by your colleague specifically about several third parties. That the information about the third parties came from my lips demonstrates that I already knew the information. Further, the interview was wholly based on information contained within a publicly available website authored by me."

I also reminded them of the ICO's expectations of of any organisation:

• Although individuals do have the right to raise complaints with the ICO, we should not be viewed as a routine second stage in a resolution process.
• We do not expect to receive complaints when there is still further work that the organisation can do to better explain the processing in question to its customers, or to put things right when they have gone wrong.
• The organisation should be able to demonstrate their compliance to its customers and work hard to promote trust and resolve their concerns without the need for the individual to come to us.
• We expect organisations to deal with the data protection complaints they receive and to proactively work with their customers to provide an appropriate resolution.

Hopefully they'll come to their senses and send the recording.

 

[ekm]

Good luck with this, it must be frustrating!

 

[prophet01]

@ekm
Extremely.
However, we've become used to this type of institutionalised, deliberate obstrcution, perpetrated by so many organisations since instigation of this saga 2.5 years ago.

 

[Clinton]

Hopefully they'll come to their senses and send the recording.

They won't.

You're being somewhat naive here.

The appealing to the CEO and complaining to the ICO are not the ends you seem to think (or hope) they are; they are simply stepping stones to court action and boxes you need to tick to show the court you tried everything.

 

[prophet01]

@Clinton

Hopefully they'll come to their senses and send the recording.

They won't.

That remains to be seen. Let's see how the CEO responds.

You're being somewhat naive here.

The appealing to the CEO and complaining to the ICO are not the ends you seem to think (or hope) they are; they are simply stepping stones to court action and boxes you need to tick to show the court you tried everything.

Not at all being naive.
Giving the CEO an opportunity to re-consider his position in conjunction with setting out, in precise detail, the clear failure to properly respond to the SAR serves two purposes:

1. It might just elicit my desired respone to the SAR.
2. It will bolster my position should I need to apply to court i.e demonstrating that I "tried everything" and more.

 

[prophet01]

The day after sending my email to the CEO I received confirmation that the long awaited draft statement would be forthcoming within days. Which it was.

Further, the bullied party's draft statment was also issued within days, after a 6 month wait.

Though I've still yet to receive a response from the CEO, or a copy of the requested recording, my email to him has elicited a flurry of activity resulting in the issuance of the draft statements.

Watch this space.

 

[Newchodge]

The day after sending my email to the CEO I received confirmation that the long awaited draft statement would be forthcoming within days. Which it was.

Further, the bullied party's draft statment was also issued within days, after a 6 month wait.

Though I've still yet to receive a response from the CEO, or a copy of the requested recording, my email to him has elicited a flurry of activity resulting in the issuance of the draft statements.

Watch this space.

Are you going to respond by saying that you cannot possibly confirm or deny that the statement is a true record, given the lapse of time, without refreshing your memory by listening to the recording on which it is based?

 

[prophet01]

@Newchodge
I'm rather hoping that the content of my email to the CEO will have been sufficiently persuasive therby leaving him with no option but to accede.

Should that not happen I will, then, respond with that indisputable argument.

 

[prophet01]

Oh dear, how disappointing from the CEO:

"Thank you for your further email of 1 June.​

Unfortunately, our position remains as explained to you. Your data is inextricably linked to third part data and our view is that the audio recording should not be provided to you. In any event, I understand that you now have a copy of your statement from Mr XXXXXXX.​

​

If you remain dissatisfied with this position then you are entitled, as you know, to refer the matter to the ICO."​

No explanation, as requested, for:

• Refusing to follow the ICO's guidance wrt the decision to refuse to disclose.
• The inconsistency in providing the statement but not the voice recording (same info).
• The eleventh hour decision to overturn their earlier confirmation to disclose.
• Failing to respond to the SAR within required timescales.

That it's taken 25 days to provide the above response suggests a strategy of delay in the hope of wearing me down. Not a chance.

Onto the next stepping stones (as Clinton put it) - Complaint to the ICO in parallel with a court application.

 

[fisicx]

I thought the board had all been voted out?

 

[prophet01]

They have.

This is about the organisation appointed by the sport's governing body to investigate allegations of bullying.

A few months ago I agreed to be a witness in respect of an investigation into allegations of bullying being undertaken by a specialist independent organisation appointed by a UK sports governing body.

 

[Newchodge]

They have.

This is about the organisation appointed by the sport's governing body to investigate allegations of bullying.

Are those 2 separate entities? the governing body and the organisation carrying out the investigation? If they are separate a complaint to the governing body that the investigation is being destroyed by the ivestigating organisation?

 

[prophet01]

To clarify, there are three separate organisations.

1. The sports club who's previous board of directors perpetrated the bullying and illegal acts.
2. The sport's governing body who we eventually 'persuaded' to undertake an investigation.
3. The independant sport conflict resolution organisation appointed to undertake the investigation.

Backstory here:
Sports club committee/directors acting contrary to Articles

 

[Newchodge]

To clarify, there are three separate organisations.

1. The sports club who's previous board of directors perpetrated the bullying and illegal acts.
2. The sport's governing body who we eventually 'persuaded' to undertake an investigation.
3. The independant sport conflict resolution organisation appointed to undertake the investigation.

Backstory here:
Sports club committee/directors acting contrary to Articles

I like the idea that the sport conflict resolution organisation is creating conflict!

 

[prophet01]

@Newchodge
That thought occurred to me and amused me too.

Unfortunately their behaviour has created more work for us to do and another body for us to confront.
Oh well. Needs must when the devil drives.

 

[fisicx]

Is there any chance the sacked board are in collusion with the resolution body?

 

[prophet01]

Is there any chance the sacked board are in collusion with the resolution body?

Interesting thought, however, I would say highly unlikely.
Then again, who knows what might be going on behind the scenes.

The outcome of the investigation will inform.

 

[Clinton]

I said on June 3rd:

You're being somewhat naive here.

The appealing to the CEO and complaining to the ICO are not the ends you seem to think...

You've now done your appeal to the CEO and it's gone nowhere. Now you're going to the ICO.

I said on May21st that the ICO will do jack.

You should have put your complaint to the ICO in back then and ticked that box.

Anyway, good luck in court.

 

[prophet01]

And in reply I said

Not at all being naive.
Giving the CEO an opportunity to re-consider his position in conjunction with setting out, in precise detail, the clear failure to properly respond to the SAR serves two purposes:

1. It might just elicit my desired respone to the SAR.
2. It will bolster my position should I need to apply to court i.e demonstrating that I "tried everything" and more.

Ok, it didn't elicit the required response but it did precipitate the hasty issuance of the painfully long-awaited draft interview statements.

I couldn't submit a complaint to the ICO at that time as I needed to first submit the complaint to the organisation to allow them an opporrtunity to rectify matters.

Whether the ICO takes action remains to be seen hence proposing to submit a court application in parallel.

Hopefully the application will be enough for them to see sense.

 

[dylanmarlais]

Disappointingly, the organisation has now refused to overturn their decision to reject my SAR and refused to explain the inherent inconsistencies.

Me: "I would appreciate your earliest clarification of the several inconsistencies in your explanation and a more detailed explanation of the basis of your rejection. Alternatively please simply send the audio file as requested."

Them: "We have considered your below email and note the points raised, including that you wish your email to be treated as a formal complaint... With respect to disclosure of the audio recording, our position remains as in the letter sent to you on 9 May 2023. You are of course entitled to make a complaint to the Information Commissioners Office in relation to our response."

It'll be interesting to see how the ICO views, and addresses, the organisation's deliberate contrary interpretations of the DPA to suit whatever outcomes they desire.

Good luck with the complaint to the ICO! And don’t expect to hear from them anytime soon. I once had one of the country’s biggest employers argue in writing that text messages on business phones were not disclosable and that we should contact the network provider. Seriously! And this was from the head of data protection herself.

The ICO took an age to contact them and point out the correct position and even then they did not produce the data. The individual I was advising got fed up and the underlying matter was resolved. And I have found this happening time and time again, especially with employment claims when the ex-employee puts in a subject access request. The data produced are very limited and correspondence asking for specific data ignored.

 

[prophet01]

@dylanmarlais
My experiences with the ICO in respect of response time has usually been quite positive.
It's their apparent desire to avoid getting involved in any meaningful way that's the annoyance.

For example in 2021, in connection with this matter, they were notified by the sports club of a personal data breach whereby an ordinary club member had somehow obtained a staff member's salary and disclosed it in an email to all members in an attempt to discredit the then chairman.

The ICO initially responded thus:
"Having considered this case carefully, in line with our regulatory action policy we have decided that the ICO will take no further action in respect of this incident. Our Criminal Investigation Team have reviewed the case and decided there is no evidence to show any unlawful access of or obtaining personal data."

I challenged their position inter alia thus:
"The alleged perpetrator made the following statement."
“We understand that he [ND] received over £l,200 last month (July 2020) in casual pay, which is more than KE, an employee of the club, received."

"As far as I can see the only way an ordinary member could obtain such information, save for the individual offering it personally, is by either accessing the company’s database themselves or via someone who had authority to and did access the company’s database."

The ICO's subsequent response was to amend their assessment thus:
"It would appear that a breach has occurred due to the fact that certain data has been disclosed in the email sent out."

Unfortunately they then weaselled out of taking further action by stating:
"...However it does not meet the threshold of a criminal offence as there is no evidence provided that the information has been unlawfully obtained. The threshold for a criminal offence would be ‘beyond reasonable doubt’ which is why our Criminal Investigation Team have come to their conclusion.
Please note that we may make additional enquiries if we become aware of new information which affects the circumstances of this case."

As has been documented elsewhere in another thread, it transpired that the salary information of the employee had been obtained by an ordinary club member, who subsequently became the club chairman, who simply requested the employees HR file from the club manager in order to discredit the then chairman, who was the employees father.

All of this was admitted by the perpetrator, in his role as the new chairman, in a subsequent employment tribunal hearing a year later. So he admitted committing the criminal offence of obtaining or disclosing personal data without the consent of the data controller - S170 DPA 2018

That reminds me, I need to make the ICO aware of this "new information which affects the circumstances of this case"

 

[Clinton]

@dylanmarlais
My experiences with the ICO in respect of response time has usually been quite positive.
It's their apparent desire to avoid getting involved in any meaningful way that's the annoyance.

That is standard with regulators. I've had it with the ICO, the GMC, the CQC, Ofwat, with others.

I've had clear open and shut cases for the GMC and the CQC and spent many days putting the documentation together to cover every angle (based on my research of the organisations' procedure and on past cases). And they still found a way to wriggle out acting, in some cases, outside of their own operating procedure/guidelines in order to find reason to do nothing.

As I've stated on these boards numerous times, these organisations exist largely to give the impression that they are doing something but if they have the slightest excuse to wriggle out of doing anything, they'll wriggle out!

Unfortunately they then weaselled out of taking further action...

That's standard. All of them are past masters at this!

 

[Elliot Green]

A few months ago I agreed to be a witness in respect of an investigation into allegations of bullying being undertaken by a specialist independent organisation appointed by a UK sports governing body.

The 2.5 hour long interview was conducted via zoom and recorded by the investigator as a record and to assist him in drafting a statement which he then proposes to send to me to "review, correct or expand in any way you wish, and return signed and dated to indicate you agree with the contents."

Now here's the thing. Today, the organisation rejected my request for a copy of the audio file on the following basis:
"Your data is inextricably linked with third party data. We do not have the consent of those third parties to disclose their personal data to you nor do we have consent to share the recording itself. Accordingly, we do not consider it reasonable under the circumstances to disclose this information.”

Setting aside the absurdity that the information concerning "third parties" came from my own lips, surely their excuse for withholding the information from me in audio format equally precludes them from sending the same information, as a statement for my review and acceptance, in written format. Quite bizarre.

I feel a complaint to the ICO coming on. If only to obtain clarification as to whether the organisation's interpretation and application of the DPA is reasonable.

There's two separate things here 1) access to personal data 2) access to a recording. A recording is not necessarily personal data. People often think an SAR gives them the right to eg. all correspondence involving them. It doesn't. The data can be produced in alternative format.

 

[Newchodge]

There's two separate things here 1) access to personal data 2) access to a recording. A recording is not necessarily personal data. People often think an SAR gives them the right to eg. all correspondence involving them. It doesn't. The data can be produced in alternative format.

BUT how does the OP confirm that the written statement, that was produced 6 months after the interview, and was based entrely on the interview, is a fair representation of what was said, without listening to the interview?

 

[Elliot Green]

BUT how does the OP confirm that the written statement, that was produced 6 months after the interview, and was based entrely on the interview, is a fair representation of what was said, without listening to the interview?

I am not suggesting the OP ought not be provided with the recording but in any event the *facts* are presumably known and a statement now will rehash the facts. Why would the recording be required to restate the facts?