Ok, you (and Pete) are persuading me on 'legitimate interests' on the grounds that the library needs to know where its stuff is (still the public authority issue, mind...)
Paying to hire books removes my main issue with contract, but not all libraries charge for hire.
"I think this is spot on" - At least I got something! :-)
Good discussion. Thanks folks.
Ben Heathcote
Information Security Officer (Compliance)
Information Security & Governance Team
IT Service
Newcastle University
NE1 7RU
Telephone: 0191 208 6950
Email: [log in to unmask]
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Bryant, Murray
Sent: 04 April 2018 16:12
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
" Not necessarily. Not all libraries generate income." - Fair point, but they can still argue a legitimate interest to know where their
" But there's no consideration, so it's not an enforceable contract. Maybe." - Surely paying to hire books would be consideration, if you are giving them away free you could then argue legitimate or public interest.
" So, that would presumably mean there isn't a single lawful basis for such processing by a library as it depends on what the library is. If you see what I mean." - I think this is spot on, I think we've covered a number of possible lawful basis that could be used but it will depend on the situation of the library. Documenting your train of thought here I think would be very helpful.
Kind Regards,
Murray Bryant
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Ben Heathcote
Sent: Wednesday, April 04, 2018 4:01 PM
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
*********************************************************
This email has reached the Bank via the Internet or an external network
*********************************************************
But a public authority can't rely on legitimate interests for its public tasks. If a public library is set up in order to fulfil a task in the public interest, it can't rely on that lawful basis; presumably it relies upon public task(!). So, that would presumably mean there isn't a single lawful basis for such processing by a library as it depends on what the library is. If you see what I mean.
Ben Heathcote
Information Security Officer (Compliance) Information Security & Governance Team IT Service Newcastle University
NE1 7RU
Telephone: 0191 208 6950
Email: [log in to unmask]
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Brynn Younger Banks
Sent: 04 April 2018 15:00
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
I'd say yes. This squares with legal opinion from data protection colleagues.
Brynn Younger Banks
Barrister and Contracts Manager
Intellectual Property & Legal Services
+44 191 2084764
[log in to unmask]
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Peter Dinsdale
Sent: 04 April 2018 14:43
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
Is there a legitimate interest in the data controller being able to maintain membership records / records of book lending and to issue charges in the event of late returns?
Regards,
Peter Dinsdale
Data Protection Consultant
Perfect Image /
T: 0191 238 0111
www.perfect-image.co.uk
Follow us on Twitter http://twitter.com/perfectimage
-----Original Message-----
From: This list is for those interested in Data Protection issues <[log in to unmask]> On Behalf Of Ben Heathcote
Sent: 04 April 2018 14:36
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
True. I don't see a legitimate interest to the data controller in this case though. I may be missing something glaringly obvious, in which case please do point it out! It's been one of those weeks already...
Ben Heathcote
Information Security Officer (Compliance) Information Security & Governance Team IT Service Newcastle University
NE1 7RU
Telephone: 0191 208 6950
Email: [log in to unmask]
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Jon Baines
Sent: 31 March 2018 10:54
To: [log in to unmask]
Subject: Re: [data-protection] Revalidating consent
Legitimate interests of the data subject and the data controller (or third party) don’t always have to be in clear opposition. Where there is mutual and understood benefit then it’s a banker.
(This reply is more to Ben).
Jon Baines,
Chair,
nadpo.co.uk
> On 31 Mar 2018, at 10:08, Brynn Younger Banks <[log in to unmask]> wrote:
>
> Key surely is definition of a public authority? Gdpr doesn’t provide one - under The Hunan Rights Act, for example, a body is considered to “be” a public authority depending on the nature of the function it is discharging (eg a private security firm is treated as a public authority in respect of running a prison, but not when it is engaged by a supermarket). On that basis I would argue all libraries would come under public task.
>
> Brynn Younger Banks
> Newcastle University
>
>
>
>> On 30 Mar 2018, at 17:13, Ben Heathcote <[log in to unmask]> wrote:
>>
>> Which lawful basis did you decide on, out of interest? Can’t be provision of contract, I don’t think, as there’s no consideration. Clearly not vital interests(!) Public task? Maybe for a public library, but not all libraries are public. Not legal obligation. That would only leave legitimate interests, but it’s the data subject with the interest in obtaining the library card, not the data controller or a third party, so I think that’s ruled out.
>>
>> I keep coming back to consent. Article 7(4) and Recital 43 would seem to allow for that.
>>
>> Sent from my iPhone
>>
>>> On 20 Mar 2018, at 17:31, GERTZ Renate <[log in to unmask]> wrote:
>>>
>>> I agree with Peter, we looked at that recently and consent is not the correct basis when you’re looking at terms and conditions for library use, fines and charges. Consent can never be valid as there is no free choice. You can’t get s library card without agreeing to the t&cs and to the charges.
>>>
>>> ________________________________________
>>> From: This list is for those interested in Data Protection issues
>>> <[log in to unmask]> on behalf of Peter Dinsdale
>>> <[log in to unmask]>
>>> Sent: 20 March 2018 15:55:45
>>> To: [log in to unmask]
>>> Subject: Re: [data-protection] Revalidating consent
>>>
>>> Hmmm, should they even need to rely on consent for service provision and charging? Would another legal basis not fit better?
>>>
>>> I think they'll have to get opt-in consent for any marketing emails (presuming that's the method of contact), as they wouldn't be able to rely on the soft opt-in under PECR.
>>>
>>> Regards,
>>> Peter
>>>
>>>
>>> Peter Dinsdale
>>> Data Protection Consultant
>>>
>>> Perfect Image /
>>> T: 0191 238 0111
>>> www.perfect-image.co.uk
>>>
>>> Follow us on Twitter http://twitter.com/perfectimage
>>>
>>>
>>> --
>>> The University of Edinburgh is a charitable body, registered in
>>> Scotland, with registration number SC005336.
>>>
>>>
>>> -----Original Message-----
>>> From: This list is for those interested in Data Protection issues
>>> <[log in to unmask]> On Behalf Of Phil Bradshaw
>>> Sent: 20 March 2018 14:42
>>> To: [log in to unmask]
>>> Subject: [data-protection] Revalidating consent
>>>
>>> X joins a library in 2012 and signs "I consent to the use of my personal data for the purposes of providing and promoting library services and to enable the collection of any charges that I incur as a member of the library". The first and third purposes are probably coextensive - collecting charge is part of the service.
>>>
>>> From 25 May it is proposed to make the choice more granular - separate opt-in for 'promoting'.
>>>
>>> Does the earlier consent need re-validating despite being a clear opt-in?
>>>
>>> My reading is yes based on A29WP "Ff existing procedures for obtaining and managing consent do not meet the GDPR’s standards, controllers will need to obtain fresh GDPR compliant consent". Does "GDPR standards here include standards on granularity? I think so as in the same paragraph of A29WP they talk about revision of systems to "allow for more granular indications of the data subject’s wishes".
>>>
>>> On a slightly different tack the library manager suggests simply dropping "and promoting" as "it’s of benefit to all users to know if resources have been added or cancelled" so that is simply part of 'providing' library services. I would probably (just about if enough pressure was applied!) be happy with that if he could guarantee that was the extent of "promotion" but I am an old sceptic ....
>>>
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>> All archives of messages are stored permanently and are
>>> available to the world wide web community at large at
>>> http://www.jiscmail.ac.uk/lists/data-protection.html
>>> If you wish to leave this list please send the command
>>> leave data-protection to [log in to unmask] All user
>>> commands can be found at
>>> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
>>> Any queries about sending or receiving messages please send to the list owner
>>> [log in to unmask]
>>> Full help Desk - please email [log in to unmask] describing your needs
>>> To receive these emails in HTML format send the command:
>>> SET data-protection HTML to [log in to unmask] (all
>>> commands go to [log in to unmask] not the list please)
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>>
>>> ____________________________________________________________________
>>> __ This email has been scanned by the Symantec Email Security.cloud
>>> service.
>>> For more information please visit http://www.symanteccloud.com
>>> ____________________________________________________________________
>>> __
>>>
>>> ________________________________
>>>
>>> Save paper, please think twice before printing this email.
>>>
>>> Equinox House | Cobalt 3.2 | Cobalt Business Park | Silver Fox Way |
>>> North Tyneside | Newcastle upon Tyne | NE27 0QJ T. 0191 238 0111 |
>>> F. 0191 238 0127 | Service Desk Direct Line. 0191 238 0121 Perfect
>>> Image Ltd. Registered in England & Wales. Company Registration
>>> Number: 2650067 Registered Office: Equinox House, Cobalt 3.2, Cobalt
>>> Business Park, Silver Fox Way, North Tyneside, Newcastle upon Tyne,
>>> NE27 0QJ
>>>
>>> This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not represent those of Perfect Image Ltd. If you are not the intended recipient, please notify us at [log in to unmask] and be advised that you have received this mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.
>>>
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>> All archives of messages are stored permanently and are
>>> available to the world wide web community at large at
>>> http://www.jiscmail.ac.uk/lists/data-protection.html
>>> If you wish to leave this list please send the command
>>> leave data-protection to [log in to unmask] All user
>>> commands can be found at
>>> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
>>> Any queries about sending or receiving messages please send to the list owner
>>> [log in to unmask]
>>> Full help Desk - please email [log in to unmask] describing your needs
>>> To receive these emails in HTML format send the command:
>>> SET data-protection HTML to [log in to unmask] (all
>>> commands go to [log in to unmask] not the list please)
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>>
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>> All archives of messages are stored permanently and are
>>> available to the world wide web community at large at
>>> http://www.jiscmail.ac.uk/lists/data-protection.html
>>> If you wish to leave this list please send the command
>>> leave data-protection to [log in to unmask] All user
>>> commands can be found at
>>> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
>>> Any queries about sending or receiving messages please send to the list owner
>>> [log in to unmask]
>>> Full help Desk - please email [log in to unmask] describing your needs
>>> To receive these emails in HTML format send the command:
>>> SET data-protection HTML to [log in to unmask] (all
>>> commands go to [log in to unmask] not the list please)
>>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>
>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>> All archives of messages are stored permanently and are
>> available to the world wide web community at large at
>> http://www.jiscmail.ac.uk/lists/data-protection.html
>> If you wish to leave this list please send the command
>> leave data-protection to [log in to unmask] All user
>> commands can be found at
>> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
>> Any queries about sending or receiving messages please send to the list owner
>> [log in to unmask]
>> Full help Desk - please email [log in to unmask] describing your needs
>> To receive these emails in HTML format send the command:
>> SET data-protection HTML to [log in to unmask] (all
>> commands go to [log in to unmask] not the list please)
>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> All archives of messages are stored permanently and are
> available to the world wide web community at large at
> http://www.jiscmail.ac.uk/lists/data-protection.html
> If you wish to leave this list please send the command
> leave data-protection to [log in to unmask] All user
> commands can be found at
> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
> Any queries about sending or receiving messages please send to the list owner
> [log in to unmask]
> Full help Desk - please email [log in to unmask] describing your needs
> To receive these emails in HTML format send the command:
> SET data-protection HTML to [log in to unmask]
> (all commands go to [log in to unmask] not the list please)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com ______________________________________________________________________
________________________________
Save paper, please think twice before printing this email.
Equinox House | Cobalt 3.2 | Cobalt Business Park | Silver Fox Way | North Tyneside | Newcastle upon Tyne | NE27 0QJ T. 0191 238 0111 | F. 0191 238 0127 | Service Desk Direct Line. 0191 238 0121 Perfect Image Ltd. Registered in England & Wales. Company Registration Number: 2650067 Registered Office: Equinox House, Cobalt 3.2, Cobalt Business Park, Silver Fox Way, North Tyneside, Newcastle upon Tyne, NE27 0QJ
This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not represent those of Perfect Image Ltd. If you are not the intended recipient, please notify us at [log in to unmask] and be advised that you have received this mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
***********************************************************************************
This e-mail (including any attachments) is intended only for the addressee(s) named above. Its contents may be confidential. If you receive this e-mail in error, please immediately contact the sender and delete this e-mail. Unauthorised use, disclosure, storage or copying of this email and any attachments is not permitted and may be unlawful.
The Bank of England is located at Threadneedle Street, London EC2R 8AH. The Prudential Regulation Authority is located at 20 Moorgate, London EC2R 6DA. Please visit www.bankofengland.co.uk.
***********************************************************************************
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|