The Analysis Comment
A sharp edge
What is meant by ‘explicit consent’ to process sensitive data sent to the creditor or collector without their asking for it?
Anthony Sharp Proprietor, Anthony Sharp Associates
asa.associates@
virgin.net
Many of you will be conversant with the exercise of obtaining ‘explicit consent’ for the holding on file of what, at the moment, is called sensitive personal data under the Data Protection (Act) 1998 –mainly health matters, within our industry – and which is to be called Special Categories of Personal Data under
the General Data Protection
Regulation (GDPR) and the Data Protection Act 2018, when it becomes effective. Apart from adding genetics and biometric
data to the list of items covered under Special Categories of Personal Data, everything else will basically stay the same as under the Data Protection Act 1998.
Unsolicited personal data What I wish to discuss is the practical issue of what should be done when you receive written evidence of health problems about one of your customers without having asked for it. Two days ago, a client of mine received a
two-page letter written by a psychiatrist, completely ‘out of the blue’ acting on behalf of one of their customers providing some highly sensitive data on the customer and passed onto my client by a debt adviser who was authorised to help the customer. So what do we then have to do about
been given through the correspondence, on the basis that the person sending it is expecting you to hold this data
consent? As it could be argued that it has already been given through the correspondence, on the basis that the person sending it is expecting you to hold this data. Let us just remind ourselves that the exercise of obtaining ‘explicit
consent’ should involve informing the individual why you want to hold their Sensitive Personal Data, what you intend doing with it, with whom you will be sharing it, and how long you will be retaining it – the TEXAS model, known to many of you. You should then allow the individual to ask questions and, following that, seek
12
So what do we then have to do about consent? As it could be argued that
their explicit consent to hold such data on your files. If, therefore, the sensitive data about the
health of a customer is supplied to you without asking by someone authorised to act on their behalf, you should return to customer, copying in the debt adviser in this case, thanking them for providing it and stating why you need to hold it, what you intend doing with it, with whom you wish to share it, and how long you will be retaining it. The only part of the exercise that you do
not need to go through is asking them for permission to hold it on file, because that permission can be assumed by the fact that they provided it for you. If, on the other hand, the individual
it has already
supplying the written evidence is not authorised to act on your customer’s behalf, you can accept it, but you will need to inform your customer of the fact that you have received it and follow the process in the two paragraphs above. Simple but important.
Important amendment Finally, we see that Parliament has now approved an important amendment to the Data Protection Bill, allowing the holding of sensitive data to be held on file without consent under certain particular circumstances.
Interestingly, under 3.5 of MALG’s Briefing Note 4 issued in April
2013, with the full support of the Information Commissioner’s Office, what has now become an amendment to primary legislation was allowed for then. I still maintain now and then that it should be a management
decision alone to allow such a concession and full notes should be made on the file of the individual as to the circumstances as to why it has been done. CCR
www.CCRMagazine.com May 2018
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52