home office

Home Office Data Subject Access Request: Part One

Clicky Steve, , , , , , , , , 1 Comment

Data Subject Access Requests (under Article 10 of the Data Protection Act 1998) are powerful tools that allowed people to request a copy of any information held on them by organisations (with some exceptions). In order to provide a response, a fee of up to £10 could be charged.

With the new GDPR era, these fees are no longer going to apply, and the access requests will now be covered by Section 94 of the Data Protection Act 2018 (which is set for Royal Assent today). As a result, I suspect we will be seeing far more of these requests… and given how underprepared most organisations have proven to be with the DPA 98’s mechanisms, it will be interesting to see how they cope.

I decided to investigate the process myself with none other than the UKVI. Formerly known as the UKBA. The visas and immigration people. I’m pretty sure they must have some interesting information on me, especially given that my spouse is a foreign national.

Handily, they have a page where you can submit your request for information on gov.uk. The process is, as you would expect, fairly convoluted. There are three categories of information you can request: Basic, Specific, or Detailed. For the ‘Detailed’ request, they are still asking for the £10 fee. However, in order to verify your identity, they require a host of information, including:

  • Your passport number.
  • A copy of your passport.
  • Written confirmation that your passport is a ‘true likeness’ of you.

Interestingly, they ask for a lot more information, including your parents’ date of birth, etc. This is noted as being ‘optional’, but still presents itself in such a way that it seems like it might be required. Let’s repeat after me: Data Subject Access Requests should not be an excuse to mine more data. I chose not to provide any more details than was necessary.

Back to what was required: Data controllers have an obligation to take ‘reasonable measures’ to verify the identity of a person making a request, and so some of this is fair enough. However, the passport number alone should be sufficient, since the UKVI hold all of the information anyway. A copy of the passport seems unnecessary, and the written confirmation of the likeness just seems bonkers – especially since the list of people who can give this certification is prohibitively small:

 

  • a legal representative, registered with the Office for the Immigration Services Commissioner (OISC)
  • a solicitor, barrister or chartered legal executive
  • a commissioner for oaths
  • a registered charity

Now, I am not one to suggest that the UKVI may well be trying to make it as difficult as possible for somebody to make a subject access request, but it certainly seems like this is not in the spirit of the GDPR, or the DPA 2018. The list above is even more restrictive than the categories of people who can countersign photos to get a passport in the first place. To illustrate the point, here are the professions of folks who can counter-sign your initial passport application:

Examples of recognised professions include:

  • accountant
  • airline pilot
  • articled clerk of a limited company
  • assurance agent of recognised company
  • bank/building society official
  • barrister
  • chairman/director of limited company
  • chiropodist
  • commissioner for oaths
  • councillor, eg local or county
  • civil servant (permanent)
  • dentist
  • director/manager/personnel officer of a VAT-registered company
  • engineer – with professional qualifications
  • financial services intermediary, eg a stockbroker or insurance broker
  • fire service official
  • funeral director
  • insurance agent (full time) of a recognised company
  • journalist
  • Justice of the Peace
  • legal secretary – fellow or associate member of the Institute of Legal Secretaries and PAs
  • licensee of public house
  • local government officer
  • manager/personnel officer of a limited company
  • member, associate or fellow of a professional body
  • Member of Parliament
  • Merchant Navy officer
  • minister of a recognised religion – including Christian Science
  • nurse – RGN or RMN
  • officer of the armed services
  • optician
  • paralegal – certified paralegal, qualified paralegal or associate member of the Institute of Paralegals
  • person with honours, eg an OBE or MBE
  • pharmacist
  • photographer – professional
  • police officer
  • Post Office official
  • president/secretary of a recognised organisation
  • Salvation Army officer
  • social worker
  • solicitor
  • surveyor
  • teacher, lecturer
  • trade union officer
  • travel agent – qualified
  • valuer or auctioneer – fellows and associate members of the incorporated society
  • Warrant Officers and Chief Petty Officers

This means that the requirements for verifying ‘likeness’ are higher to get information held on you by the UKVI, than they are to get a passport in the first place.

For my subject access request, I have been told I have 15 days to submit the relevant documentation, including the above:

UKVI Requirements

Despite making the application online, I also apparently can’t submit the evidence online – so I’m not sure what the point of offering such a service is in the first place.

In my opinion, the requirements are not ‘reasonable’, and providing my passport number alone should be enough. As a result, I will not be submitting statements from a solicitor or charity at this point to support my request. I am going to operate on the assumption that the online system is not properly equipped to deal with subject access requests properly, and that the evidential standard is being confused with actual visa applications. I have contacted the UKVI directly with these concerns. Here’s what I said:

Reference: [redacted]

Hi,

I have just submitted a Data Subject Access Request under s.10 of the DPA 98 and s.94 of the DPA 2018 (which just received Royal Assent). This should further be considered in light of Article 15 of the GDPR.

As part of the evidential requirements listed on your site, I must provide:

1. A copy of my passport.
2. A ‘written confirmation of true likeness’ from a third party.
3. A letter of permission.

Firstly, I want to point out that there is no way to provide these documents online, despite the initial application being made online. I therefore request that you agree to receive items 1 and 3 electronically, rather than by post.

Secondly, I object to the requirement to provide a written confirmation of true likeness. As you will be aware, data controllers are required to undertake ‘reasonable measures’ to verify the identity of the person making the Data Subject Access Request. I submit that by providing a copy of my passport, and the passport number, that this more than satisfies the legal requirement.

Further, I submit that since the list of those who are considered appropriate to provide this written confirmation is less extensive than those who can act as a counter-signatory for a passport application in the first place, that this requirement is demonstrably disproportionate, and as such not required to respond to my request.

To summarise, please advise that:

1. You will accept items 1 and 2 from the above electronically.
2. That the written confirmation of true likeness is not required to give effect to the request under the relevant law.

Yours sincerely,

We will see what happens. Should my subject access request be denied, then it would appear that the UKVI really are requiring a disproportionately high standard to verify people for their Data Subject Access Requests, and I’ll need to revisit it at that point. Stay tuned.

Thoughts on (Flexible) Working From Home

Clicky Steve, , , , , , , 2 Comments

It’s been a few weeks since I started working from home for Automattic, engineering happiness for users of WordPress.com.

Having moved from an (almost) standard 8.30-5pm, office-based working day, the switch has proven to be an interesting experience.

Even with my youth squandered in online tech communities that operate in very similar ways to Automattic, it’s definitely a mindset shift to go from that sort of world being just something that you do, to something that actually pays the bills. Work is meant to force you into set patterns begrudgingly… right? I didn’t expect there to be too much of an overhaul, but a job with complete flexibility has definitely brought with it some interesting quirks.

happy monday - working from home

Here are some of my observations:

You don’t get distracted

One of the usual reasons that people give for ‘not being able’ to work from home is that they get distracted and can’t concentrate on what they’re meant to be doing. As far as I’m concerned, that’s nonsense. Sure, it may well depend on the person, but if you are independent and self-motivated, you shouldn’t find it a problem to set out an area and dedicate the time you need. If a Gen Y-er can do it – with our alleged ridiculously short attention spans – then so can you.

Going to the bank isn’t the headache it used to be

Ahh… the dreaded trip to the bank/post office/travel agent/loanshark. It was always such a torture to have to undertake any sort of task that fell during the working day. This equally applies to the receiving of parcels. Sure, you can get small things delivered to work, but what happens when you order something big? Carting it back from the office is never a fun task… even if you are lucky enough to have access to a car. Working from home sweeps all of these troubles away in one fell swoop.

Your Neighbours Will Love You!

If you play your cards right, that is. So long as they’ve met you (and you’ve not been weird about it), you can easily become a local everyday hero. Just make it clear that you’re usually around during the day if they have parcels getting delivered, or need an eye kept out for something. Even if they never actually ask you to do anything, you’ve won major brownie points – especially handy when you throw that 7am-finish party with all of your dubious mates.

lunch

Lunch is better

The first week I worked from home, I ate nothing but bacon sandwiches – purely because I can. That can’t continue for long though, or I’ll balloon to some ridiculous size. In general though, it means you have access to your own kitchen, rather than an awful, over-priced canteen (or a microwave, if you’re lucky). I was never any good at avoiding squashing my sandwiches anyway, so this is a winner. The only real dilemma is… what to have? So much choice!

You get to mock those who have to commute

I’ve luckily managed to avoid travelling every day during the onset of the Scottish winter this year, which is undoubtedly one of the greatest perks about being based from wherever you choose.

It’s pretty soul-destroying to wake up early, in the dark, to make your way into work, only to return home at night, in the dark. What has never made any sense to me though, is the preposterous notion that people should fight their way for hours through gridlocked motorways in the rain, sleet, and snow, to get to an office to do a job that they could arguably do just as well from home. I’d even go so far as to argue that it’s negligent for employers to expect people to physically come in to work on days where the police are ‘advising motorists not to travel’.

That said, I think there are those who genuinely love this sort of daily battle, as if there is some sort of valour to be had in succeeding in such a pointless trip. Those, my friends, are those whom we should mock relentlessly.

Electricity bills

Uhhhm, Leave this one with me.

You can go hours without saying a single word to anybody

Insert your own joke about how it’s better if I keep my mouth shut here. There’s a lot of commentary about how it can be unproductive to be constantly interrupted in an open plan type office, and it’s definitely true. The flip-side is the total opposite though. Unless you live with other people, you can go entire days without uttering a single word. I’m not entirely sure whether it’s a completely zen-like experience just yet.

Watch this space.

The banter

This is related to the above. Sure, there are a lot of downsides about working in close proximity with over folk – like having people hang over your shoulder, or force you to look at links on the Daily Mail website (shudders – Linda, you know who you are!), but you can’t really beat the days in work when you’re surrounded by people who are working on the same thing, having a laugh together.

You need to make more of an effort to stay in the loop

This could well be partly because I am refusing to pay for a TV licence, and so am missing out on the news at night, (disclaimer: I don’t own a TV, or watch it as it’s broadcast online) but more often than we think (yes, even in the age of so-called ‘new media’), news is spread by word of mouth, through the people we come in contact with every day.

If your community is online rather than round about you, very quickly you might find that you aren’t as up to speed on local happenings as you might have been previously. It takes a real effort to keep up to date; a battle that I am currently losing, it has to be said.

You can find your natural schedule

I’ve never been a fan of mornings. Not that I don’t like the crisp, fresh air; the tweeting of the birds; and all that. I simply don’t function well at that time.

Part of the problem is that due to whatever screwy Circadian rhythm I have, I don’t naturally get tired until around 2-3am. Irrespective of how early I was up at in the morning, the time I went to bed remained the same. Working from home, I’ve shifted to a 10am-6pm day (roughly), which already means if I go to sleep at 3, I’m getting 7 hours sleep, compared to 4. That’s almost double the amount, and has meant I feel 100% better during the day, with no irresistible urge to disco-nap early evening.

Working from bed is the best thing ever

…for a few hours anyway.

Days seem shorter

Even though I am working the same number of hours, and finishing up the same time I would be getting in from work if I was commuting, the days still seem to fly by. Those extra 3 hours spent getting up, getting ready, and travelling to work in the morning have been converted into sleeping hours, which is probably what they should always have been in the first place.

life work balance

Concepts of time become more fluid

Weekend? What’s that? With total flexibility, there comes a blurring of the lines between the ‘working week’. When you are able to choose a schedule that fits around your life, that may not be in traditional daily blocks. Many people will shudder at the thought of the lines between work and personal life ‘blurring’, but that isn’t really what’s happening. Just because work becomes spread more diffusely, doesn’t mean that it takes over; it just allows you to integrate it more closely to what fits best for you. Working two hours in the evening or at the weekend instead of on a Monday morning doesn’t mean you are a slave to the job, it means that you are more in control of how and when you choose to give it your full attention.

When you spend all of your time in the one place, with work spread out more than beforehand, It does mean that weekends never feel quite like they used to.

I don’t actually think that that’s a bad thing, for what it’s worth.

People don’t get it

‘But… How do they know you’re actually working?!’