Terms & Conditions

[Julian Stanbury]

Peter, John, thank you.

You’re right to mention GDPP, I am coming from this from a data protection angle.

Oddly, GDPR is nothing more than DPA1998 with a fresh coat of paint (in my view). Yes, the old DPA1998 has been split into UK GDPR (nothing more than a tippexed version of EU GDPR in reality) for the high level principles an and DPA2018 which contains the derogations for how we want data protection to operate in the UK as well as the extra two data protection regimes (law enforcement and intelligence processing) and the ICO stuff.

So even before GDPR, data protection was largely the same.

So this para, 7.220, potentially flew in the face of data protection even back then.

I was hoping there was a reference to the power (vires) to do this, possibly in the DM&AR2001 if not in the legislation for the Tribunal. I get that for certain persons affected, we are under a duty to notify them, and part of me was wondering if that might be where this was coming from.

I’m happy that DPA2018 s8(a) or (c) would be an appropriate lawful basis, a form of Public Task per UK GDRP A6(1)(e), but this again is a consideration after identifying vires. If the Tribunal directed us, that directin gives us vires. But without that direction, what then.

I know the DWPs guidance is only that, and we need to be wary of their interpretation as well as not fettering our discretion if we follow guidance instead of law, but this reference just feels so odd.