FOI request (FOIR-231032646)

Sale of personal data

Requested Thu 23 July 2020
Responded  Thu 13 August 2020

I'd like to exercise my rights under the Freedom of Information Act and make a request to know the following:

Can I please have your records concerning the sales of personal data from 2019 and 2020, including trading partners and money earned from transactions?

Please can I have your records concerning the determining the price of personal data, for sales and sharing for the time period January 2019- Present.

What is your internal procedure for selling personal data? By this, I mean guidance given to internal staff and the buyer in question, for the time period of January 2019 - Present.

What types of personal data do you sell and are there any limits placed on this? For the time period of January 2019 - Present.

How many Subject Access Requests did you receive in the period 2017-2020, broken down by year? What types of personal data did they typically receive? For example email addresses, home addresses and telephone numbers?

Response

1. There have been a total of 7 requests from Credit Reference Agencies (CRA) in 2019-2020 at a total cost of £1,391.50 (this is a combination of full electoral registers and overseas registers).

There has been one request for the open register in 2019-2020 at a cost of £57.50.

We are required by law to make available these documents for sale by relevant persons or organisations.

2. Costs for the full electoral register, overseas register and open register are determined by legislation. Representation of the People Regulations 2001 (Regulations 110 and 111)

3. Internal procedures are driven by the regulations and guidance from Electoral Commission and Cabinet Office. The open register may be purchased by any person or organisation, for any purpose. The full electoral register may be purchased by licensed CRAs whose purpose is providing credit reference services (for money laundering and credit assessment checks).

A request must be made in writing to the electoral services team, stating which register is being requested, in what format and for what purpose. In addition, licence details for CRAs are checked against the Financial Services Authority register. Payment is required to be cleared before the register is sent. Data copies are sent by encrypted file and print copies must be collected in person by an agreed individual.

4. Personal data within the electoral registers include name, address and opt out marker (for CRAs only).

5.

2017 - 7

2018 - 7

2019 - 6

2020 - 6 (Year to date)

These were all requests from individuals, made under the Data Protection Act 1998 or Data Protection Act 2018, requesting access to their personal data that Hastings Borough holds.