Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Question

Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store.

Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head office.

He requests any CCTV footage from the day in which he may appear.

The corporate offices designated data protection officer receives his request and carefully reviews all of the day's footage to put together his formal response to Bob's request and soon realises why he is requesting the footage. Not wishing to cause a pr disaster for his employer, he decides to omit or accidentally not accidentally damage some of the most damning footage of the incidents.

What legal consequences in practice might the DPO realistically face, apart from the pleasure of his employer and future job security?

What recourse does Bob have if the DPO claims that all the footage provided is all the he appears in, even if it doesn't include the incidents motivating Bob's request, or to regretfully report to Bob that there was a technological failure and the footage from that day is irreparably destroyed?

E&W specified all welcome.

Answer 1

Spoliation of evidence, once a suit is filed

The reason Bob requests the video from Alice Corp is not that he is concerned about his GDPR rights, it is because he wants to file a lawsuit. In fact, it would be super helpful if Bob had filed the lawsuit and served it together with the GDPR request, so there is a pending case... and added a paragraph that he demands the preservation of all evidence at that point.

In either case, the sudden deletion of the files by their DPO Charly, after Alice Corp was put on legal notice that they have to preserve evidence, is spoliation, indeed, it would be the very definition:

The intentional destruction or alteration of relevant evidence in existing or pending litigation. ¹

The main remedy for spoliation is the imposition of a rebuttable presumption of fact that the lost or destroyed evidence would have been unfavourable to the party that destroyed it. This presumption can be rebutted by evidence showing that the “spoliator” did not intend to affect the litigation by destroying the evidence (McDougall v. Black & Decker Canada Inc., 2008 CarswellAlta 1686 (Alta. C.A.)).

So, we have the DPO performing spoliation, and thus the lawsuit for the beating will assume that the destroyed video showed exactly what Bob alleged that Alice Corp's security team did to him.

in england-and-wales DPO Charly can be further sued for destroying evidence under Section 2 (16) Criminal Justice Act 1987.

Spoliation might even happen before the case begins with filing & summons

According to an article by Chris Dale, discussion spoliation in england-and-wales the case of Earles v Barclays Bank Plc [2009] EWHC 2500 (Mercantile) (08 October 2009) was named as one of the best descriptions of spoliation in English law. That case indeed is illustrative, as it might be explicitly applicable to the case as described (emphasis mine):

28 [I]n this jurisdiction [Bermingham/England] as in Australia, there is no duty to preserve documents prior to the commencement of proceedings: British American Tobacco Australia Services Limited v. Cowell [2002] V.S.C.A. 197, a decision approved in this country by Morritt V.C. in Douglas v. Hello [2003] EWHC 55 at [86]. However, the leading text book in this area – Documentary Evidence by Charles Hollander QC- suggests in paragraph 10-06 of the 10th edition that "there might be cases where it was appropriate to draw adverse inferences from a party's conduct before the commencement of proceedings." In my judgment there would have to be some clear evidence of deliberate spoliation in anticipation of litigation before one could legitimately draw evidential "adverse inferences" in those circumstances. There is no such evidential basis in this case.

29 After the commencement of proceedings the situation is radically different. In Woods v. Martins Bank Ltd [1959] 1 Q.B. 55 at 60, Salmon J. said "It cannot be too clearly understood that solicitors owe a duty to the court, as officers of the court to make sure, as far as possible, that no relevant documents have been omitted from their client's list".

30 In the case of documents not preserved after the commencement of proceedings then the defaulting party risk "adverse inferences" being drawn for such "spoliation": Infabricks Ltd v. Jaytex Ltd [1985] FSR 75.

So, yes, we got it in a judgment from the High Court of Justice, Queens Bench Division, Birmingham District Registry, Mercantile Court: if it is extremely likely, that proceedings will begin shortly, destroying the video might be spoliation in anticipation of litigation, and thus be problematic even before proceedings started. As a remedy, an adverse inference might be drawn to the content of it.

---

1 - RESOURCE ID W-015-7809 © 2022 THOMSON REUTERS. ALL RIGHTS RESERVED.

Answer 2

Is it a criminal offence to destroy and conceal information [that would otherwise have to be produced in response to a SAR]?

It is a criminal offence to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information a person making a SAR would have been entitled to receive."

You can defend this offence if you prove that:

• the alteration, defacing, blocking, erasure, destruction or concealment of the information would have happened regardless of whether the individual made a SAR; or
• you acted in the reasonable belief that the person making the SAR was not entitled to receive the information requested.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/can-the-right-of-access-be-enforced/

Alteration etc of personal data to prevent disclosure to data subject https://www.legislation.gov.uk/ukpga/2018/12/section/173/enacted

Can a court order be used to enforce a SAR?

If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply. It is a matter for the court to decide, in each particular case, whether to make such an order.

Failure to comply with the order could be contempt of court.

Answer 3

In the scenario you describe, the DPO commits an offence contrary to the Data Protection Act 2018 s.173:

(3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.

(4) Those persons are—

(a) the controller, and

(b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.

The penalty for this offence (and by extension incentive not to commit it) is limited in s.196 to a fine as it is for all offences under UK GDPR.

More generally, UK GDPR creates liability for compensation from parties who breach its requirements to anyone who enjoys a benefit from those requirements so at least academically there are other possible forms of recourse available.

Also relevant to the scenario you describe is that the controller (the DPO's employer) has duties under s.70 not to interfere with his duties. Of course the DPO may still find an incentive to contravene GDPR for the benefit of his employer without any direct encouragement to do so, but the employer must take some care not to add further incentive on their part or they may attract further liability for breaching their own duties.