tldr:
I reasonably believe that twentytwentymedia ltd did not respond appropriately to a subject access request and so this failure to respond to the legal request has been escalated to the ICO.
summary:
- Nominet is a member organisation.
- UKRAC is a steering group for Nominet made up of elected member representatives (herein representatives).
- Representatives are supposed to represent the members.
- The UKRAC secretariat (herein secretariat) is a Nominet contracted company with data sharing agreement who handles the administration of the UKRAC.
- A Subject Access Request made to Nominet failed to search their data processor / the secretariat.
- The secretariat by design shares personal data with the UKRAC representatives.
- All but one of the representatives used their companies to support their election and used their companies email addresses when communicating UKRAC business (evidenced in screenshot and other subject access requests).
- Reginald Trelawney Wickham is a director of TWENTYTWENTYMEDIA LIMITED.
- My personal information was communicated between the secretariat, other members and twentytwentymedia email systems.
- Due to the failing of the Nominet DPO to properly search the secretariat, I made a subject access requests to UKRAC members including twentytwentymedia ltd who then refused to search or release for personal information that residing on their systems.
- One of the representative companies responded correctly and fully.
- One of the representative companies joined later and didn’t hold much of the information.
- One of the representative companies provided deliberately falsified data.
- This presentative and his company failed to properly respond despite being given fair notice and time to correct for mistakes.
timeline:
- 2022/11/09 – Subject Access Request was raised with [email protected] as defined https://www.2020media.com/company/privacy/ in respect to personal data communicated via [email protected].
- 2022/12/07 – Subject Access Request escalated with [email protected] as no response.
- 2022/12/07 – Confirmation of receipt of missed email, further clarification in regards to personal data communicated via [email protected]
- 2022/12/12 – Response from Rex Wickham refusing the subject access request as wrongly believe (as I stated was wrong in the original request) that Nominet was the data controller for his company email address.
- 2022/12/12 – Clarification that Nominet had stated it was not data controller and 5 working days given to respond.
- 2022/12/20 – No response receive, blog post created, escalated with ICO.
request:
Subject Access Request
Subject: Carl Heaton, 43 Ingram Road, S2 2SB
With regret, as result of insufficient response by Nominet DPO and UKRAC complaints process, I must ask you to please supply the personal data you hold about me, which I am entitled to receive under data protection law, held in:
Email, Documents or other corporate systems used by your employees in association with the UKRAC or other Nominet activities.
Please note that while the the individual may be admirably contributing their time to the UKRAC on a personal basis, it is advertised that corporate resources are being used for communication (https://members.nominet.uk/ukrac-contact/) and so fall within scope of this subject access request.
I do not consent to any third party disclosure of this request, should you make reference to my person in preparation of this request please consider that included in the scope of the original request.
If you need any more information, please let me know as soon as possible.
Please provide your response in the same format as the data held, ideally digitally.
It may be helpful for you to know that data protection law requires you to respond to a request for personal data within one calendar month.
If you do not normally deal with these requests, please pass this letter to your data protection officer or relevant staff member.
If you need advice on dealing with this request, the Information Commissioner’s Office can assist you. Its website is ico.org.uk, or it can be contacted on 0303 123 1113.
to: [email protected]
date: Nov 9, 2022, 7:26 PM
subject: Subject Access Request – Carl Heaton / [email protected]
request 2:
The above email was sent to [email protected] as defined https://www.2020media.com/company/privacy/ yet I have not received any acknowledgement or response. It is now approaching 1 month.
to: [email protected]
date: Dec 7, 2022, 11:01 AM
subject: Fwd: Subject Access Request – Carl Heaton / [email protected]
response:
We acknowledge receipt of this email and will now check your query in relation to email sent to [email protected]
Thankyou
—
from: 2020Media [email protected]
TwentyTwentyMedia Ltd – http://www.2020media.com/
tel: 0370 321 2020 fax: 0870 321 2027
e-mail: [email protected] int: +44 370 321 2020
date: Dec 7, 2022, 11:18 AM
subject: Re: Fwd: Subject Access Request – Carl Heaton / [email protected]
clarification based on new information:
Thank you for the confirmation, for further clarification the it seems like [email protected] was the advertised email address but [email protected] was the actual email address in use.
to: 2020Media [email protected]
date: Dec 7, 2022, 9:09 PM
subject: Re: Fwd: Subject Access Request – Carl Heaton / [email protected]
response 2:
Dear Carl
re: Data Protection subject access request
Thank you for your email of Nov 9, 2022 making a data subject access request for Carl Heaton, 43 Ingram Road, S2 2SB.
I regret that we cannot provide the personal data you requested.I refer you to contact Nominet UK as our understanding is that they are the data controller for matters concerning the UKRAC.
Yours sincerely
from: Rex Wickham [email protected]
Rex Wickham
date: Dec 12, 2022, 11:37 AM
subject: Subject Access Request – Carl Heaton
final opportunity:
Thanks for getting back to me.
I only raised requests with companies with whom I reasonably believe my personal data has been sent as a result of Nominet DPO failing to provide that data in an earlier subject access request.
I have been informed by other companies of UKRAC members that there has never been a data sharing agreement between them and Nominet UK, this means Nominet UK is not the data controller for that data.
So either Nominet has been sharing members data with the companies of UKRAC member representatives without proper data sharing agreements (or appropriate advice to use personal email address for non-company business) OR 2020Media is liable to respond to this subject access
request.Please get back to me within 5 working days or it shall be assumed you are refusing my lawful subject access request.
to: Rex Wickham [email protected]
date: Dec 12, 2022, 11:47 AM
subject: Re: Subject Access Request – Carl Heaton
reference:
