Hacker News new | ask | show | jobs
by hkt 1925 days ago
Freedom of information is about the activities of public authorities, and that includes private sector bodies performing public functions. A person could access aggregate data and other non-personally identifying information this way but it would likely require a court to rule on the public activities of the company. This happened with privately run care homes which were deemed to have public functions.

However, you don't want that: you want a subject access request. This covers data from private sector companies too. Not responding is illegal and you can take them to the Information Commissioner and eventually the Information Tribunal.

This is the information commissioner's office's guide to making a request:

https://ico.org.uk/your-data-matters/your-right-to-get-copie...

Source: trained as a journalist and am quite good at media law stuff. Not a lawyer, but have had substantial training and think this is worth a punt.
1 comments
scott_w 1925 days ago
Unfortunately this won’t tell you if the ISP is storing extra data in compliance with the Snooper’s Charter because legal compliance can override the GDPR. Basically, the law saying “you’re not allowed to tell anyone you hold this data” overrides an SAR and a legal case to force compliance would likely fail on these grounds.
link
hkt 1925 days ago
Does the charter specifically forbid companies from reporting what they store? I'm not familiar with it in detail. I'd be surprised..
link
bennyp101 1925 days ago
Basically, If you are required to store the data under an order, then you are not legally allowed to disclose the fact you have received an order, or what you are storing.

Same as getting a request from the NCA asking for details on an individual, can't disclose that you received one.

link
hkt 1925 days ago
Ah. They're the same as the old RIPA requests then. In another life I worked for a company which processed them from time to time. It is a dreadful shame that stuff has survived.
link
bennyp101 1925 days ago
Yea, only from what I can see, worse. Rather than just "tell me who had this IP on this date" it will be "tell me everything they visited and looked at during this period"
link