SNP’s ‘National Survey’ was in breach of data protection rules

I blogged several times last month about the SNP’s ‘National Survey,’ most recently on 8 September where you can also find links to my earlier posts about the subject.

I lodged an enquiry on the subject with the Information Commissioner’s Office and received their reply today. This is the substantive part of that reply, quoted in full:

You have explained you are concerned about the processing of personal data by the SNP in its online National Survey; particularly with regard to the privacy policy and the approach to marketing.

The first principle of the DPA [Data Protection Act] requires that personal data shall be processed ‘fairly and lawfully’ and, in particular shall not be processed unless at least one of the conditions in schedule 2 of the Act is satisfied. Where information is provided voluntarily by an individual, as in the completion of a survey, we deem this to be consent to the processing.

To help to ensure that processing is “fair”, data controllers (the organisation who is responsible for the data) are required to provide fair processing information to individuals detailing who they are, what they intend to do with the data and any other information which may be relevant given the circumstances.

The ICO is already aware of concerns that have been raised about the SNP survey. We wrote to the SNP to outline our key concerns regarding the practices it had adopted in the running of the survey. We gave our view that as currently constructed the survey was in breach of both the DPA and the Privacy and Electronic Communication Regulations (PECR). This was with regard to:

  • The provision of fair processing information.
  • Notification of, and user consent to, the use of cookies.
  • Provision of consents for follow-up contact.

The ICO has met with the SNP to discuss these issues. As a result the SNP has subsequently taken remedial action to improve its compliance with the DPA and the ICO has confirmed it is satisfied the SNP has addressed the issues.

In particular, the fair processing information has been amended to reflect that email addresses may be used for follow-up research (for example, focus groups), but the SNP will not share survey information with third parties. The SNP has confirmed it does not intend to use contact details obtained through the survey for future direct marketing purposes, so it does not seek consent for that purpose.

We will not be taking any further regulatory action over this matter, but we will keep the concerns raised on file. This will help us over time to build up a picture of SNP’s information rights practices.

Thank you for bringing this matter to our attention.

This response needs no further interpretation. It is in my view crystal clear. You will note that as well as writing to the SNP the ICO met (had to meet?) with them to discuss the matter.

The link at the bottom of the survey page that previously took you to this:

National Survey 2016 Privacy

Now links to a full page headed ‘Privacy’ and is now branded as part of the SNP web site. It includes this:

national-survey-new-privacy-statement-header

national-survey-new-privacy-statement

The only remaining issue, for the SNP and their collective conscience, is how they treat the responses they received from people who completed the survey before this notice appeared. The decent thing would be to have no further contact with them based on the survey as they may well have completed it under false pretences.

Apart from myself and two experts who commented on my earlier blog posts, it has taken the efforts of a number of other complainants, the media and the ICO to get to this stage. A simple mistake by the SNP or deliberate obfuscation? (As a previous post cited, they do have what might be called ‘form’ in this area)

If anyone’s still swithering whether to complete the survey, my advice remains as it was originally – don’t touch it with a barge pole.

 

Advertisements
This entry was posted in Uncategorized and tagged , , , . Bookmark the permalink.

2 Responses to SNP’s ‘National Survey’ was in breach of data protection rules

  1. Carol Cunningham says:

    This would appear to be gross incompetence arrogance or a mixture of both on part of SNP. Unaccountable – or so they thought. Is it any wonder education, Nhs, police force on such a state when they can’t even manage to run a simple survey properly 😡

    Like

  2. Island Girl says:

    Best case scenario – another case of gross incompetence by the SNP; worst case scenario – complete and utter contempt for the law of this land and the rights of the electorate!

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s