The company refused to comply with an information notice from the ICO requiring certain information, saying that providing the answer would be self incriminating in the context of other continuing police investigations.
Held: The notice must be complied with: ‘ the effect of s. 143 (6) DPA 2018 is to permit the recipient of an Information Notice to raise the issue of risk of self-incrimination with the Commissioner on receipt of the Notice. The Commissioner must then take those submissions into account in deciding whether to apply to a court to enforce the Information Notice or to cancel the Information Notice (possibly serving an amended Notice in its stead). In this case, the Appellant has provided very limited information to the Commissioner and to the Tribunal about the scope of the criminal investigation and thus the scope for self-incrimination. The Appellant claims to have little information itself at this stage of those proceedings. However, it is clear from the information provided to the Commissioner by MHRA, and placed before the Tribunal, that whatever else may follow there is an issue as to GDPR compliance which warrants further investigation. We accept that the information requested was reasonably required for the Commissioner’s investigation.’
[2019] UKFTT 2018 – 0265 (GRC)
Bailii
Data Protection Act 2018 142 143
England and Wales
Updated: 23 September 2021; Ref: scu.633814