Although the DPDI Bill is dead, you have probably missed the addition to the right to erasure (Article 17 of the UK_GDPR) which was made during “wash-up” period (last month) via another piece of legislation (the Victims and Prisoners Act ["VPA"] 2024).
In summary, the change in the law concerns what controllers do when there is a malicious complaint (e.g. to social services) and the procedure for removing that complaint, following the conviction of the complainant of a stalking or harassment offence and a finding that the complaint was malicious. Phew, a number of conditions to explain!
The change to the A.17 can be found in Section 31 of the VPA Act; it deals with malicious reporting cases such as those as Stella Creasy (MP for Walthamstow, in London), which was publicised by the BBC. (See references for all relevant details). The new right does not apply immediately; it has to be "commenced" by the incoming Government at sometime in the future.
The new right to erasure
The VPA Act adds a new paragraph (g) to A.17(1).
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if…….
“…(g) the personal data have been processed as a result of an allegation about the data subject—
- which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
- which has been investigated by the controller, and
- in relation to which the controller has decided that no further action is to be taken.”
So who is a “malicious person”? Quite simply a malicious person is a person who has made an allegation about a data subject AND that person has been convicted of a “relevant offence". All the “relevant offences” are identified and relate to stalking or harassment; they are tabulated in new Article 17(5) and there are ten such relevant offences.
Relevant offences include, for example, an offence under sections 2, 2A, 4 or 4A of the Protection from Harassment Act 1997 or section 8 of the Stalking Protection Act 2019. Other legislation tabulated are the Scottish and Northern Ireland equivalent of these Acts, and specific legislation which deals with harassment and stalking offences committed by members of the UK’s armed forces.
Article 17(5) is accompanied with a new section 13A to the DPA2018 which provides an order making power to amend or add to the list of relevant offences via an affirmative resolution process.
When does the new right apply
Suppose male employee X stalks a female member of staff. The female member of staff reports it to HR and because of the seriousness of its preliminary investigation, the police get involved. Supposes further there is an eventual prosecution of X for a stalking or harassment offence (i.e. a relevant offence) but the employee X’s defence, as explained to HR, involves scurrilous accusations against the victim.
Now clearly, the female victim might want HR to delete these allegations from her personal data. As there has been an investigation by the employer, a successful prosecution for a relevant offence and the employer has taken no further action against the female victim, then the new right applies to her. However, this right does not apply to employee X, as the harasser/stalker is most likely sacked (where sacking is an “action”).
In summary, as there was an initial investigation before personal data were handed to the police, they can be deleted in relation to the female victim (no action against her) but retained in relation to the stalker (i.e. records can be kept of the reason for the sacking but not relating also to the victim).
Note that the new right does NOT apply to personal data processed by the police as their processing is likely to be subject to Part 3 of the DPA2018 (i.e. law enforcement processing) and not the UK_GDPR.
Enter Stella Creasy MP
Stella Creasy MP has faced such serious but false accusation concerning her children, and this has influenced this amendment behind the scenes. In the House of Lords’ debate the MP was thanked “for the amendments they have tabled on this issue, and their engagement with myself and officials in this area”.
In her case, according to the BBC, in 2023 a man told Leicestershire Police that her children should be taken into care due to her "extreme views". This was followed by the MP reportedly facing a safeguarding review by the London Borough of Waltham Forest.
She was quickly cleared; the BBC reports that the man had objected to the MP breast feeding her newly born baby in the House of Commons chamber.
As there was a formal complaint to Police and it investigated a "number of emails" sent to the MP (presumably in the context of harassment). However, it was this police referral that triggered a statutory investigation by the Borough, and this explains why the Borough could not delete the personal data (even though it the Deputy Speaker of the House of Commons publicly criticised the "appalling abuse and harassment" Ms Creasy had received).
Because individuals can hold views that are wrong, the BBC reported that Leicestershire Police resolved the issue by “a community resolution rather than a formal sanction because the messages did not meet the threshold for a criminal offence”.
Concluding comment
You will note that the new right does not help Ms. Creasy get her personal data deleted, as the BBC report states that no relevant offence has been committed (see added note below).
This could have an unforeseen consequence; data subjects who are falsely accused by a stalker or harasser might put pressure on the authorities to prosecute in order to engage the new right. This is preferable, from the victim’s perspective, than to allow the offender to be let off by treating the issue as some kind of misogynistic misdemeanour which results in the victim’s personal data remaining on file.
And that might not be a bad outcome.
Note added on 23/6/2024: there is a Times report dated 3rd December 2023 stating that Leicester Police changed their mind about harrassment and "a man from Wigston in Leicestershire, admitted harassment without violence and was given a 14-week prison sentence suspended for one year, in part because of overcrowding in prisons. He was also given a three-year restraining order and will be required to carry out 120 hours of unpaid work". (see updated references below).
References
The Parliamentary debate about the new right to erasure in A.17(1)(g) of the UK_GDPR: https://hansard.parliament.uk/Lords/2024-05-23/debates/CC504D8F-CC76-4EBB-9FF3-09FD1D2C2E74/VictimsAndPrisonersBill
Section 31 of the Victims and Prisoners Act 2024: https://www.legislation.gov.uk/ukpga/2024/21/section/31/enacted
BBC story “Stella Creasy: Call for action after online troll sparked MP probe” https://www.bbc.co.uk/news/uk-england-london-65463367
Times report (3/12/2023) on the re-opened case: "Troll’s harassment of Stella Creasy one of worst cases judge has seen" on https://www.thetimes.com/article/stella-creasy-labour-mp-online-troll-philip-stacey-guilty-0k9mzzmls
Forthcoming Data Protection Courses
The next Data Protection PRACTITIONER Course is in London on Monday, 16 September to Friday, 20 September (5 days: 9.30am to 5.30pm). Remember also our specialist DP qualification for those in Education.
Details from www.amberhawk.com