Data Protection Complaints Procedure

“Complaint” means an expression of dissatisfaction about POPLA’s handling of personal data, this could include how POPLA responded to a data subjects rights request.

“Data subject” means any natural living individuals whose personal data POPLA processes. This could include consumers, colleagues, visitors etc.

“Data subjects rights” means data subjects have the right to the following at any time:

1. Right to be informed
2. Right of access
3. Right to rectification
4. Right to erasure
5. Right to restrict processing
6. Right to data portability
7. Right to object
8. Rights related to automated decision-making including profiling

More detail on what these rights are can be found at: A guide to individual rights | ICO

“Personal data” means any information relating to an identified or identifiable natural person.

Data subjects, or third parties on their behalf, may make a complaint about POPLA’s use of personal data. Data subject complaints should be sent to the Data Protection Officer and their team, they can be reached at DPO@trustalliancegroup.org or 3300 Daresbury Park, Daresbury, Warrington, WA4 4HS. The DPO team will usually acknowledge the complaint within 5 working days, this time period may be extended over periods where the business is closed.

A third party can make a complaint on behalf of the data subject; however POPLA will require written consent from the data subject authorising the third party to act on their behalf in relation to the complaint.

The DPO team may seek to verify the identity of the Data Subject through sight of a physical identification document (for example a passport or driving licence)

The DPO team will investigate the complaint and provide a response in writing. The response will usually be sent via email within 30 days from receipt.

If the data subject does not agree with the outcome, they can request a review. A request for an outcome review must be made within 1 month of the original outcome being sent. The outcome will be reviewed by the Data Protection Officer and a response will be sent within 30 days from receipt of the request for a review. The response will usually be sent via email.

If the data subject remains in disagreement with the outcome and review outcome, they can escalate their complaint to the Information Commissioner’s Office (the ICO). For clarity, a data subject retains the right to escalate a complaint to the ICO at any point in time and does not need to be engaged in the complaint procedure to do so.

Information about how to make a complaint to the ICO can be found here: Make a complaint | ICO

In some instances, POPLA can refuse to handle a complaint. This would be if POPLA deemed a complaint to be one or more of the following:

• Manifestly unfounded
• Abusive
• Vexatious
• Excessive

POPLA will consider each complaint on a case-by-case basis in relation to the above. The following factors may be considered:

A data subject has

1. causes disruption either through behaviour, communication or excessive contact or complaints
2. persisted in making unsubstantiated accusations
3. targeted individuals or made threats to individuals or POPLA
4. continued to repeat the substance of previous complaints that have already been investigated

Where POPLA refuses to handle a complaint that is deemed to be unfounded, abusive, vexatious or excessive, POPLA will contact the individual to explain the reason for refusal and the data subject’s right to escalate to the ICO.