Question

To ask the Secretary of State for Digital, Culture, Media and Sport, what (i) advice and (ii) guidance has been produced by the Information Commissioner on the use of private investigators, including (a) requirements for data protection registration and (b) their processing of personal data; and whether they are encouraged by the ICO to adopt the ABI code of conduct issued under Article 40 of UK GDPR.

Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that process personal data are required to pay a data protection fee to the Information Commission unless an exemption applies. The Information Commission (ICO) provides guidance and an online assessment tool to help individuals and organisations determine whether they are required to pay the fee.

The ICO is required to assess (“provide an opinion”), approve, and publish UK GDPR codes of conduct which meet article 40 requirements. The Association of British Investigators' UK GDPR Code of Conduct for Investigative and Litigation Support Services’ is approved and published by the ICO and is intended to help members apply the law and demonstrate compliance with relevant data protection requirements. The code is a voluntary one and includes advice, guidance, and practical examples in relation to:

• the roles and responsibilities of code members when acting as controllers, joint controllers or processors;

• Data Protection Impact Assessments;

• identification of the lawful basis for processing personal data; legitimate interests assessments; and

• consent to share when tracing and locating individuals in certain cases.

SSAIB has been accredited as a monitoring body by the ICO and will be responsible for the monitoring of the ABI code of conduct.

The ICO does take the opportunity to support relevant communications on this, eg on social media, trade press, speaking at ABI UK Investigator conferences etc. They encourage all organisations to voluntarily sign up to a UK GDPR Code of Conduct in their sector, but responsibility for the primary promotion of UK GDPR codes following publication is usually undertaken by the Code owner.