In accordance with DPA Section 10 – Right to prevent processing likely to cause damage or distress, any individual can instruct a data controller, in F’s case, RBKC, to stop or begin processing his personal information; meaning NOT to disclose any of his information. Specifically, any information relating to his HIV+ status, as this would cause him much damage and distress.
This is called a NOTICE, which is in fact a free and a long winded version of an INJUNCTION, to be used by those who have time on their hands to wait for a reply from the party who wish/have disclosed the information causing concern, distress and/or damage..
It was only in 2016 when F discovered that his May 2010 Amendment to his Information Sharing Agreement, was in fact a NOTICE, in accordance with section 10. The NOTICE instructed RBKC that it must not start processing any of his personal information without his explicit written consent.
Furthermore, it instructed RBKC to remove all information relating to his HIV status from his files.
Although he asked for confirmation, this NEVER happened.
In accordance with Section 10-(3), the data controller, RBKC, HAD TO REPLY within 21 DAYS, whether (a) RBKC intends to comply with the instructions, or (b), tell F that they consider his instructions unjustified or are prepared to comply to a certain extent, giving a reason for this.
ICO’s guidance to section 10 is clear that F was NOT obliged to tell RBKC that he was presenting a NOTICE, or refer to Section 10 of the DPA, or present the NOTICE in any particular format.
The onus to recognise the existence of the NOTICE was solely on RBKC, who should have taken prompt action to comply with the 21 day limit to reply.
RBKC FAILED to reply AT ALL. The NOTICE was simply ignored.
The ICO confirmed in his response, dated 1st March 2016, that RBKC’s failure to comply with para 10-(3) of the DPA, would be a breach of SIXTH Principle of the DPA.
It must be appreciated that the DPA does NOT provide a REMEDY for the VICTIM of any non-compliance with the Act. The ICO is in NO WAY interested in providing this. He is empowered to issue notice to the culprit. However, he cannot even compel him to issue a simple apology.
In order to seek a REMEDY, the VICTIM must avail himself of DPA’s paragraph 13 and present his concerns to a Court. The Judge is in NO way compelled to take any notice of the ICO’s ASSESSMENT, should there be one. He will consider the matter anew and issue his own ruling.
This is clearly addressed in the Soho HIV Clinic’s disclosure of Newsletter recipients’ email addresses. The ICO issue a high Monetary Penalty Notice. However, he was powerless to provide any resolution to the many VICTIMS of the disclosure, who may have suffered distress and anxiety.
Should they wish to claim COMPENSATION from the Clinic, they can ONLY do so through the Courts, as provided in paragraph 13 of the DPA, with the assistance from legal professionals, such as Leigh Day..
In respect of the damage and/or distress, the matter has become somewhat easier, with the decision in Vidal v Google.