As they openly claim that they are a data controller this means they now become subject to the General Data Protection Regulations (GDPR). So we would like to know who their Data Protection Officer is and what training if any, they may or may not have undertaken?
This means that any member of the public may make a subject access request or ask for the data the local party hold on you to be deleted, or ask them to stop sending you campaigning material among other things.
During the local elections Cllr Ray Field & Cllr Nicola Keen who were elected to the Folkestone Harbour Ward were collecting residents data as is made clear from their election leaflet.
Nowhere on this leaflet does it set out your rights and what they will do with your data, who will process it how long they will store and more.
It doesn’t stop there though. They also have to do proper transparency for non-members whose data they process, as well as their own members and supporters locally.
We have spoken to the Information Commissioner’s Office who informed us that political parties – who are data controllers in their own right – such as the Folkestone & Hythe Labour Party are not exempt from the £40 fee and need to be on the register of fee payers.
As Cllr Field makes clear in the leaflet above: “Actions speak louder than words. Vote Field & Keen to ensure consultation is meaningful, and to reinstate democracy and transparency for our community.”
One of the features of the GDPR which is superficially similar to the old Data Protection Act but turns out to be quite different is the requirement to provide information about how personal data is being used. The word ‘transparency’ is an inherent part of the GDPR first principle, whereas it was absent from the previous version. The DPA 1998 allowed data controllers to decide what information data subjects needed to know, beyond who the controller was and what purposes their data was being processed for. The GDPR has two similar but distinct lists of information that must be provided, one for where data is obtained from the subject, the other where data is obtained from somewhere else, and they dictate what must be provided in scary detail.