Investigation without consent and GDPR

Investigating without the data subjects ‘Consent’

Recently the processing of data has become a really hot topic, particularly where you do not have the subjects consent to process their data. Obtaining the subjects consent to investigate or trace them is not always appropriate nor practical.

GDPR provides ‘legitimate interests’ as an alternative lawful basis for processing the subject’s data without their contest. ‘Legitimate interests’ is essentially the same as the equivalent Schedule 2 condition in the 1998 Act, with some changes in detail but certainly isn’t an automatic right, and will only fit certain circumstances. As described in Article 6(1)(f) of the new act:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

This can be easily broken down into a three-part test:

Purpose test – is there a legitimate interest behind the processing?

Necessity test – is the processing necessary for that purpose?

Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?

A helpful document written by the Information Commissioners Office on the subject can be downloaded here.

Data Processing Impact Assessment

To be able to demonstrate and ensure full compliance with the new act Tremark undertake a Data Processing Impact Assessment (DPIA) on our clients’ behalf on every instruction we receive. This documented DPIA which is held on each case file contains the three-part test detailed above, to ensure that we can both articulate what the client (or their clients) legitimate interests are as well as demonstrating that those legitimate interests outweigh the data subjects fundamental right to privacy.

Tremark have seen an increase in subject access requests since the implementation of the new data protection legislation and fully expect our industry in particular to be closely scrutinised by the various interested parties, in an effort to highlight any bad practice or non-conformities.

Tremark’s clients can be assured that all data processing undertaken by Tremark on their behalf is carefully considered and undertaken compliantly.

Get in touch, we’d love to talk

Please do get in touch with me if you would like to discuss this in more detail. I can be contacted via email at mark.hodgson@tremark.co.uk or alternately please don’t hesitate to call me or one of our team on 0845 862 1853. We are always happy talk, swap ideas or offer advice.

Experience and consistency

For over twenty-three years, Tremark have been offering a variety of investigative services including process serving, the tracing of people, their employers and assets, background checks, and surveillance. We are one of the largest and most trusted enquiry agents within the UK. You do not have to take our word for it, please click to read what nice things our 100 clients have had to say about us.