|
Zack
|
|
Group: Forum Members
Posts: 60,
Visits: 4.6K
|
I’m wondering if sites like the UK database one (I won’t put the actual url, as linking out gives sites more publicity and more power), could actually be stopped with GDPR. Where it may violate GDPR, is the fact that it calls itself a database of criminal reports for a particular subset of crimes. It also encourages people to browse and search by area, and lists results by the name of the offender. It is one thing for a newspaper to have archived articles online generally, but when someone repurposes (most likely plagiarises) the content to make a “database” of a type of criminal convictions, prioritising listing names and locations that is another matter. GDPR states: “Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.” They are quite clearly not working under an official capacity, and although much of the content is or at least was in the public domain, as they just repurpose content. I’m not sure that is a defence. They are certainly trying to put together a comprehensive register, and even encourage people to report cases. I think there could be scope under GDPR to challenge this, but it takes time and money, and most likely will just give them more publicity. So I’d query if it is worth pursuing? Another angle could be copyright infringement. They seem to just copy word for word newspaper articles. But it would have to be the copyright owner that requested action, and I’m not sure newspapers really care. So many people are negatively affected by these sites, not only ex-offenders but their families including children. I do wonder if some coordinated action could take place. Interested in thoughts about this.
|
|
|
|
|
khafka
|
|
Group: Forum Members
Posts: 320,
Visits: 16K
|
I was actually thinking about this the other day. In my last job I had to do quite a bit of GDPR stuff as we held databases of customer's information etc. The angle I was thinking about was when your order comes to an end. I will be off the register in 3 years (my PPU said if all goes well and given how low level risk I am it could be next year but I'm not holding my breath on that). You'd have to manually get in touch with them to get them to remove your details as it is not longer pertinent. The problem that lies here is there is no way for them to fact-check this unless the person(s) that run it are privy to police documents in which case they could look it up however that'd be a huge breach of data protection and open them up to a whole world of issues. So, my point being - If you get in touch and say "hey, I'm off the register. Remove me from your site within xx days" they'd have to abide by that under the "Right to Erasure". They have no way to fact-check it so I'm tempted to just email them and ask them to remove me now saying I'm no longer subject to the notification requirements. The parts of the GDPR that are relevant:Individuals have the right to have their personal data erased if: - the personal data is no longer necessary for the purpose which you originally collected or processed it for;
- you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent;
- you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
- you are processing the personal data for direct marketing purposes and the individual objects to that processing;
- you have processed the personal data unlawfully (ie in breach of the lawfulness requirement of the 1st principle);
- you have to do it to comply with a legal obligation; or
- you have processed the personal data to offer information society services to a child.
The two I've highlighted are the main ones, although the 3rd one could be used to make sure it stays up.
It is an interesting one and given they're essentially a link aggregate site I'm not sure where they'd fall in the GDPR ruling for the requirements of needing a GDPR officer within their "organisation" who deals with these requests.
One of the issues of asking them to be removed though, given the general nature of the "clientele" that frequent these sort of sites is I can't help but feel they'd end up badmouthing you publicly for daring to ask to be removed; posting on Facebook and/or their website/social media etc.
"ATTENTION - CONVICTED OFFENDER JOHN DOE IS TRYING TO HIDE THEIR CONVICTION. PLEASE SPREAD THIS AROUND TO MAKE SURE THIS DOESN'T HAPPEN! THINK OF YOUR CHILDREN!"
I have zero doubt in my mind the UK Database and their affiliates would be all over it like that.
Then all the dust that may have settled gets swirled up again and you're back to where you started.
|
|
|
|
|
Zack
|
|
Group: Forum Members
Posts: 60,
Visits: 4.6K
|
+xI was actually thinking about this the other day. In my last job I had to do quite a bit of GDPR stuff as we held databases of customer's information etc. The angle I was thinking about was when your order comes to an end. I will be off the register in 3 years (my PPU said if all goes well and given how low level risk I am it could be next year but I'm not holding my breath on that). You'd have to manually get in touch with them to get them to remove your details as it is not longer pertinent. The problem that lies here is there is no way for them to fact-check this unless the person(s) that run it are privy to police documents in which case they could look it up however that'd be a huge breach of data protection and open them up to a whole world of issues. So, my point being - If you get in touch and say "hey, I'm off the register. Remove me from your site within xx days" they'd have to abide by that under the "Right to Erasure". They have no way to fact-check it so I'm tempted to just email them and ask them to remove me now saying I'm no longer subject to the notification requirements. The parts of the GDPR that are relevant:Individuals have the right to have their personal data erased if: - the personal data is no longer necessary for the purpose which you originally collected or processed it for;
- you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent;
- you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
- you are processing the personal data for direct marketing purposes and the individual objects to that processing;
- you have processed the personal data unlawfully (ie in breach of the lawfulness requirement of the 1st principle);
- you have to do it to comply with a legal obligation; or
- you have processed the personal data to offer information society services to a child.
The two I've highlighted are the main ones, although the 3rd one could be used to make sure it stays up.
It is an interesting one and given they're essentially a link aggregate site I'm not sure where they'd fall in the GDPR ruling for the requirements of needing a GDPR officer within their "organisation" who deals with these requests.
One of the issues of asking them to be removed though, given the general nature of the "clientele" that frequent these sort of sites is I can't help but feel they'd end up badmouthing you publicly for daring to ask to be removed; posting on Facebook and/or their website/social media etc.
"ATTENTION - CONVICTED OFFENDER JOHN DOE IS TRYING TO HIDE THEIR CONVICTION. PLEASE SPREAD THIS AROUND TO MAKE SURE THIS DOESN'T HAPPEN! THINK OF YOUR CHILDREN!"
I have zero doubt in my mind the UK Database and their affiliates would be all over it like that.
Then all the dust that may have settled gets swirled up again and you're back to where you started.
Yes I agree, contacting them directly would be a bad idea. They would likely do as you say. But I'm wondering if the Information Commissioner's Office could take action, not concerning removing one particular article because the info could be considered outdated under GDPR, but by generally fining / closing down the site for GDPR non-compliance, as they are creating a criminal history register without authority, which is also part of our GDPR protection. It may be they need a particular example / complaint though, and if so - the question would be if anonymization is possible to protect those whose information is being misused, and allowing them a real chance to complain without retribution. It would be more about the general test of if they have created an unauthorsied register of criminal convictions. I don't know enough about the intricacies. But there may be ways to take action without making an individuals predicament worst. Anyway, just thinking out loud...
|
|
|
|
|
Monkos
|
|
Group: Forum Members
Posts: 83,
Visits: 415
|
+x+xI was actually thinking about this the other day. In my last job I had to do quite a bit of GDPR stuff as we held databases of customer's information etc. The angle I was thinking about was when your order comes to an end. I will be off the register in 3 years (my PPU said if all goes well and given how low level risk I am it could be next year but I'm not holding my breath on that). You'd have to manually get in touch with them to get them to remove your details as it is not longer pertinent. The problem that lies here is there is no way for them to fact-check this unless the person(s) that run it are privy to police documents in which case they could look it up however that'd be a huge breach of data protection and open them up to a whole world of issues. So, my point being - If you get in touch and say "hey, I'm off the register. Remove me from your site within xx days" they'd have to abide by that under the "Right to Erasure". They have no way to fact-check it so I'm tempted to just email them and ask them to remove me now saying I'm no longer subject to the notification requirements. The parts of the GDPR that are relevant:Individuals have the right to have their personal data erased if: - the personal data is no longer necessary for the purpose which you originally collected or processed it for;
- you are relying on consent as your lawful basis for holding the data, and the individual withdraws their consent;
- you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
- you are processing the personal data for direct marketing purposes and the individual objects to that processing;
- you have processed the personal data unlawfully (ie in breach of the lawfulness requirement of the 1st principle);
- you have to do it to comply with a legal obligation; or
- you have processed the personal data to offer information society services to a child.
The two I've highlighted are the main ones, although the 3rd one could be used to make sure it stays up.
It is an interesting one and given they're essentially a link aggregate site I'm not sure where they'd fall in the GDPR ruling for the requirements of needing a GDPR officer within their "organisation" who deals with these requests.
One of the issues of asking them to be removed though, given the general nature of the "clientele" that frequent these sort of sites is I can't help but feel they'd end up badmouthing you publicly for daring to ask to be removed; posting on Facebook and/or their website/social media etc.
"ATTENTION - CONVICTED OFFENDER JOHN DOE IS TRYING TO HIDE THEIR CONVICTION. PLEASE SPREAD THIS AROUND TO MAKE SURE THIS DOESN'T HAPPEN! THINK OF YOUR CHILDREN!"
I have zero doubt in my mind the UK Database and their affiliates would be all over it like that.
Then all the dust that may have settled gets swirled up again and you're back to where you started.
Yes I agree, contacting them directly would be a bad idea. They would likely do as you say. But I'm wondering if the Information Commissioner's Office could take action, not concerning removing one particular article because the info could be considered outdated under GDPR, but by generally fining / closing down the site for GDPR non-compliance, as they are creating a criminal history register without authority, which is also part of our GDPR protection. It may be they need a particular example / complaint though, and if so - the question would be if anonymization is possible to protect those whose information is being misused, and allowing them a real chance to complain without retribution. It would be more about the general test of if they have created an unauthorsied register of criminal convictions. I don't know enough about the intricacies. But there may be ways to take action without making an individuals predicament worst. Anyway, just thinking out loud... It's absolutely illegal. Sue them out of existence.
|
|
|
|
|
Rufus
|
|
Group: Forum Members
Posts: 14,
Visits: 43
|
ICO are a waste of space - I did an SAR to my former employer, they ignored my request and didnt supply the info required after 1 month as they are legally required -I complained to the ICO and they have done nothing apart from to tell me to write to again telling them they have missed the legal deadline and give them another month to reply to that.
I mean what is the point in them existing if they wont do anything when companies blatantly ignore the law - they havent complied with the law the first time, why give them another chance and more time. Needless to say the company then ignored the second request and I complained again to the ICO and yet again they have done nothing.
|
|
|
|
|
david123
|
|
Group: Forum Members
Posts: 21,
Visits: 1.8K
|
Hi, I have just sent the following to the American company that hosts one of the U.K. vigilante websites listing people with sexual convictions. I don't hold out much hope of a positive reply but I will update this post when i receive one. Dear Sir, Madam, RE: https://tedteamsite.wordpress.com/I wish to bring to your attention that one of your customers who you are hosting a website for is in fact a vigilante site that encourages violence, physical assault and harassment of the individuals identified on this site. All these individuals have been dealt with by the U.K. courts and are managed and monitored by the U.K. police, so the only reason for creating this searchable database which includes photographs is to encourage vigilante action against these individuals. This is against your own terms of use below: - Calls to violence.
- Do not publish realistic calls to violence. By that we mean that you cannot post content which threatens, incites,or promotes violence, physical harm, or death. This includes threats targeting individuals or groups, as well as other indiscriminate acts of violence.
Many of these offences because of the length of time from when they were committed are now classed as spent under the U.K.Rehabilitation of Offenders Act 1974 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/216089/rehabilitation-offenders.pdfmeaning they do not have to be declared when applying for employment, but any employer can simply google an applicants name as many do these days and be taken straight to this vigilant site displaying past spent convictions so defeating the whole purpose of the Rehabilitation of Offenders Act1974 Also,in the U.K. the names of people who are on the sex offender register is not available to the general public only to law enforcement but by compiling this searchable database of people convicted of sexual offences on this vigilant site it is facilitating vigilantly actions against these individuals who have been punished by the U.K. courts for their offending and simply wish to get on with the rest of their lives as law abiding citizens. This site also contravenes Article 10 of the European general data protection regulation 2016/679 (GDPR) https://gdpr.eu/what-is-gdpr/“ Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.” As such this site should be taken down I look forward to your reply Regards Well I have now received a reply from the company hosting this website saying that it is nothing to do with them and I need to contact the site owner and any GDPR issues need to be addresses to them.Needles to say it is a wast of time trying to reason with the knuckle draggers who created this site so trying to think of what the next move will be.
|
|
|
|
|
JASB
|
|
Group: Awaiting Activation
Posts: 1K,
Visits: 1.6K
|
+xHi, I have just sent the following to the American company that hosts one of the U.K. vigilante websites listing people with sexual convictions. I don't hold out much hope of a positive reply but I will update this post when i receive one. Dear Sir, Madam, RE: https://tedteamsite.wordpress.com/I wish to bring to your attention that one of your customers who you are hosting a website for is in fact a vigilante site that encourages violence, physical assault and harassment of the individuals identified on this site. All these individuals have been dealt with by the U.K. courts and are managed and monitored by the U.K. police, so the only reason for creating this searchable database which includes photographs is to encourage vigilante action against these individuals. This is against your own terms of use below: - Calls to violence.
- Do not publish realistic calls to violence. By that we mean that you cannot post content which threatens, incites,or promotes violence, physical harm, or death. This includes threats targeting individuals or groups, as well as other indiscriminate acts of violence.
Many of these offences because of the length of time from when they were committed are now classed as spent under the U.K.Rehabilitation of Offenders Act 1974 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/216089/rehabilitation-offenders.pdfmeaning they do not have to be declared when applying for employment, but any employer can simply google an applicants name as many do these days and be taken straight to this vigilant site displaying past spent convictions so defeating the whole purpose of the Rehabilitation of Offenders Act1974 Also,in the U.K. the names of people who are on the sex offender register is not available to the general public only to law enforcement but by compiling this searchable database of people convicted of sexual offences on this vigilant site it is facilitating vigilantly actions against these individuals who have been punished by the U.K. courts for their offending and simply wish to get on with the rest of their lives as law abiding citizens. This site also contravenes Article 10 of the European general data protection regulation 2016/679 (GDPR) https://gdpr.eu/what-is-gdpr/“ Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.” As such this site should be taken down I look forward to your reply Regards Hi Well done and I look forward to reading their response. There is no truth only the individual's perception of the truth
Learn from yesterday, live for today, hope is for tomorrow else what is left if you remove a mans hope.
|
|
|
|
|
khafka
|
|
Group: Forum Members
Posts: 320,
Visits: 16K
|
+x+xHi, I have just sent the following to the American company that hosts one of the U.K. vigilante websites listing people with sexual convictions. I don't hold out much hope of a positive reply but I will update this post when i receive one. Dear Sir, Madam, RE: https://tedteamsite.wordpress.com/I wish to bring to your attention that one of your customers who you are hosting a website for is in fact a vigilante site that encourages violence, physical assault and harassment of the individuals identified on this site. All these individuals have been dealt with by the U.K. courts and are managed and monitored by the U.K. police, so the only reason for creating this searchable database which includes photographs is to encourage vigilante action against these individuals. This is against your own terms of use below: - Calls to violence.
- Do not publish realistic calls to violence. By that we mean that you cannot post content which threatens, incites,or promotes violence, physical harm, or death. This includes threats targeting individuals or groups, as well as other indiscriminate acts of violence.
Many of these offences because of the length of time from when they were committed are now classed as spent under the U.K.Rehabilitation of Offenders Act 1974 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/216089/rehabilitation-offenders.pdfmeaning they do not have to be declared when applying for employment, but any employer can simply google an applicants name as many do these days and be taken straight to this vigilant site displaying past spent convictions so defeating the whole purpose of the Rehabilitation of Offenders Act1974 Also,in the U.K. the names of people who are on the sex offender register is not available to the general public only to law enforcement but by compiling this searchable database of people convicted of sexual offences on this vigilant site it is facilitating vigilantly actions against these individuals who have been punished by the U.K. courts for their offending and simply wish to get on with the rest of their lives as law abiding citizens. This site also contravenes Article 10 of the European general data protection regulation 2016/679 (GDPR) https://gdpr.eu/what-is-gdpr/“ Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.” As such this site should be taken down I look forward to your reply Regards Hi Well done and I look forward to reading their response. There is no truth only the individual's perception of the truth Hi JASB, I'll save you the wait time. I reckon it'll be either one of the following: "Dear david123, We have reviewed the account in question and have found no trace of them breaking our rules and terms of service. Have a nice day Customer Service Person #23284629" Or the alternative, which is possibly more likely. "..." Silence. They won't reply.
|
|
|
|
|
lotsofquer
|
|
Group: Forum Members
Posts: 119,
Visits: 3.4K
|
I took some time a couple of weeks ago and went through the ICO complaints process (as a general complaint given I’m not personally on that site and if I was I couldn’t contact the site anyway as they don’t provide contact details). I don’t remember all of the details of what I put in the complaint as they didn’t send me a copy but it was specifically about GDPR and the sections relating to both criminal information and right of removal/erasure.
They’ve logged a case and I had the below response back. Whether anything will come of it I don’t know but I would be hopeful that it does given when you google the site their tag line is about being the only public searchable sex offender registry in the uk and Ireland - which is clearly against GDPR (and something I mentioned when I submitted the complaint).
Response below.
7 May 2020
Case Reference:
Dear Sir/Madam,
Thank you for your complaint email of the 02 May 2020 regarding UK Database.
Thank you for your concerns regarding UK Database. The issues that you have raised have been logged. As this is does not relate to your personal data, please be aware that it is unlikely you will hear anything further from us regarding this. However, if you have any additional information or evidence regarding this matter, please do provide it to us using this case reference.
Any action we've take against organisations is published on our website.
Under the data protections laws, in order for an organisation to process criminal conviction or offence data, they must have a lawful basis and official authority to do so or the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. For further guidance on criminal conviction data please visit our website.
If you have any concerns regarding how an organisation is processing personal data, you should raise this as concern with them directly in writing.
I hope this information is helpful to you. If you would like to discuss this further, please contact me on my direct number 0330 414 6255. If you need advice on a new issue you can contact us via our Helpline on 0303 123 1113 or through our live chat service. In addition, more information about the Information Commissioner’s Office and the legislation we oversee is available on our website at ico.org.uk.
In order for us to improve our service we are conducting a survey to identify what works well and what we could improve. It would be greatly appreciated if you could complete an anonymous survey to help us improve the service we offer. For more information and to complete the survey please click on the link below:
Take the survey
Yours sincerely,
Case Officer
Information Commissioner Office
|
|
|
|
|
JASB
|
|
Group: Awaiting Activation
Posts: 1K,
Visits: 1.6K
|
+x+x+xHi, I have just sent the following to the American company that hosts one of the U.K. vigilante websites listing people with sexual convictions. I don't hold out much hope of a positive reply but I will update this post when i receive one. Dear Sir, Madam, RE: https://tedteamsite.wordpress.com/I wish to bring to your attention that one of your customers who you are hosting a website for is in fact a vigilante site that encourages violence, physical assault and harassment of the individuals identified on this site. All these individuals have been dealt with by the U.K. courts and are managed and monitored by the U.K. police, so the only reason for creating this searchable database which includes photographs is to encourage vigilante action against these individuals. This is against your own terms of use below: - Calls to violence.
- Do not publish realistic calls to violence. By that we mean that you cannot post content which threatens, incites,or promotes violence, physical harm, or death. This includes threats targeting individuals or groups, as well as other indiscriminate acts of violence.
Many of these offences because of the length of time from when they were committed are now classed as spent under the U.K.Rehabilitation of Offenders Act 1974 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/216089/rehabilitation-offenders.pdfmeaning they do not have to be declared when applying for employment, but any employer can simply google an applicants name as many do these days and be taken straight to this vigilant site displaying past spent convictions so defeating the whole purpose of the Rehabilitation of Offenders Act1974 Also,in the U.K. the names of people who are on the sex offender register is not available to the general public only to law enforcement but by compiling this searchable database of people convicted of sexual offences on this vigilant site it is facilitating vigilantly actions against these individuals who have been punished by the U.K. courts for their offending and simply wish to get on with the rest of their lives as law abiding citizens. This site also contravenes Article 10 of the European general data protection regulation 2016/679 (GDPR) https://gdpr.eu/what-is-gdpr/“ Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.” As such this site should be taken down I look forward to your reply Regards Hi Well done and I look forward to reading their response. There is no truth only the individual's perception of the truth Hi JASB, I'll save you the wait time. I reckon it'll be either one of the following: "Dear david123, We have reviewed the account in question and have found no trace of them breaking our rules and terms of service. Have a nice day Customer Service Person #23284629" Or the alternative, which is possibly more likely. "..." Silence. They won't reply. Hi I smile at recognition of the humour but do hope after what we are all going through compassion for others will remain but expand to include those on the outer regions of society. Get and agree with your underlying point though.
Learn from yesterday, live for today, hope is for tomorrow else what is left if you remove a mans hope.
|
|
|
|