I blogged several times last month about the SNP’s ‘National Survey,’ most recently on 8 September where you can also find links to my earlier posts about the subject.
I lodged an enquiry on the subject with the Information Commissioner’s Office and received their reply today. This is the substantive part of that reply, quoted in full:
The first principle of the DPA [Data Protection Act] requires that personal data shall be processed ‘fairly and lawfully’ and, in particular shall not be processed unless at least one of the conditions in schedule 2 of the Act is satisfied. Where information is provided voluntarily by an individual, as in the completion of a survey, we deem this to be consent to the processing.
To help to ensure that processing is “fair”, data controllers (the organisation who is responsible for the data) are required to provide fair processing information to individuals detailing who they are, what they intend to do with the data and any other information which may be relevant given the circumstances.
The ICO is already aware of concerns that have been raised about the SNP survey. We wrote to the SNP to outline our key concerns regarding the practices it had adopted in the running of the survey. We gave our view that as currently constructed the survey was in breach of both the DPA and the Privacy and Electronic Communication Regulations (PECR). This was with regard to:
- The provision of fair processing information.
- Provision of consents for follow-up contact.
The ICO has met with the SNP to discuss these issues. As a result the SNP has subsequently taken remedial action to improve its compliance with the DPA and the ICO has confirmed it is satisfied the SNP has addressed the issues.
In particular, the fair processing information has been amended to reflect that email addresses may be used for follow-up research (for example, focus groups), but the SNP will not share survey information with third parties. The SNP has confirmed it does not intend to use contact details obtained through the survey for future direct marketing purposes, so it does not seek consent for that purpose.
We will not be taking any further regulatory action over this matter, but we will keep the concerns raised on file. This will help us over time to build up a picture of SNP’s information rights practices.
Thank you for bringing this matter to our attention.
This response needs no further interpretation. It is in my view crystal clear. You will note that as well as writing to the SNP the ICO met (had to meet?) with them to discuss the matter.
The link at the bottom of the survey page that previously took you to this:
Now links to a full page headed ‘Privacy’ and is now branded as part of the SNP web site. It includes this:
The only remaining issue, for the SNP and their collective conscience, is how they treat the responses they received from people who completed the survey before this notice appeared. The decent thing would be to have no further contact with them based on the survey as they may well have completed it under false pretences.
Apart from myself and two experts who commented on my earlier blog posts, it has taken the efforts of a number of other complainants, the media and the ICO to get to this stage. A simple mistake by the SNP or deliberate obfuscation? (As a previous post cited, they do have what might be called ‘form’ in this area)
If anyone’s still swithering whether to complete the survey, my advice remains as it was originally – don’t touch it with a barge pole.