Declan Heavey
71 Queens Road West
London
E13 0PE
10 March 2021
Case reference IC-56856-H0Z8
Dear Mr Heavey
Thank you for your complaint form and further letter to the Information
Commissioner’s Office (ICO) in which you have complained that St Mungo
Community Housing Association (St Mungo’s):
1. did not delete the information relating to support plans as you requested in
your email to them of 10 July 2020 and
2. processed your information in support plans without your knowledge, consent
or signature.
The ICO’s role
Part of our role is to consider complaints from individuals who believe there has
been an infringement of the data protection law.
We deal with complaints like this under section 165 of the Data Protection Act
2018 which requires us to take steps to respond to complaints including
investigating to the extent that we feel is appropriate. It also requires us to
inform the complainant of the outcome of their complaint.
We use complaints to build up a picture of an organisation’s information rights
practices so that we can identify and target poor performing organisations.
Details of the action we have taken is available on our website.
Page 1 of 3
Our view
1. I have considered the information available in relation to this complaint and I
am of the view that St Mungo’s has complied with their data protection
obligations.
You asked them to delete your personal data held in four named categories
where the legal basis for processing your information was consent and you
had not given your consent. I have not seen a copy of the outcome of your
request for erasure of 10 July 2020 but understand that they have not deleted
the personal information held. St Mungo’s have explained to you that the
lawful basis for processing this information about you was (substantial) public
interest. The right to erasure does not apply to personal information held with
a lawful basis of public interest. St Mungo’s did not have to delete this
information therefore. This does not prevent them from deleting personal
information in response to a request should they choose to do so. This would
explain why they deleted the highlighted statement mentioned in your request
for erasure of 1 October 2020. St Mungo’s also gave you the opportunity to
tell them if processing this information was causing you substantial damage or
distress.
2. I have considered the information available in relation to this complaint and I
am of the view that St Mungo’s have complied with their data protection
obligations.
You asked if the support plans were valid under data protection law without
your signature, knowledge or consent. You told us that there was a support
agreement in place which stated that there would be no support plan. In my
opinion, this question is not a data protection one as it relates to the services
which St Mungo’s offer. I have considered therefore whether they were able to
process the information about you which they recorded in the categories you
listed without your signature, knowledge or consent.
St Mungo’s had sent you a letter on 28 November 2019 which notified you
that they would record the details of any contact with you and that they would
not agree any notes to be entered on your system with you. They also sent
you a privacy notice at the same time which explained how they use personal
data to provide their services. You were aware therefore that St Mungo’s
would record your personal data following any contact you had with them. As
St Mungo’s had identified (substantial) public interest as the lawful basis for
processing the information, they did not need your signature or consent.
Page 2 of 3
I do not have details of any information they provided you with before
November 2019 about the way they would process your information. If they
had provided privacy information and processed information the way they said
they would, then this would be fair processing. If they had not provided
privacy information or they had processed information in ways which you
would not have expected then this may not have been fair. Unfair processing
would not mean the processing was unlawful however and it would not change
the situation regarding the right to erasure.
We keep a record of all the complaints raised with us about the way
organisations process personal information. The information we gather from
complaints may form the basis for action we may take in the future to ensure
organisations meet their information rights obligations.
Thank you for bringing this matter to our attention.
Yours sincerely
Gillian Cartwright
Lead Case Officer
Information Commissioner’s Office
0330 414 6559
Feedback about our service
If you think we should have done something differently in how we have handled
your concerns, or how we have treated you, please tell me.
For information about what we do with personal data see our privacy notice at
www.ico.org.uk/privacy-notice
Page 3 of 3
