Subject: RE: ICO
From: "LEFROY, Jeremy (2nd Mailbox)" <[email-masked]>
To: TheAbstraction <[email-masked]>
Date: Thu, 18 Apr 2019 08:59:38 +0000

Dear Mark,

Following my conversation with Mr Wadsworth, I have received the following information from him. Apparently German law alongside GDPR has a Section 34 which is stronger than the UK’s own version in terms of providing reasons for not fulfilling a SAR.

I would be happy to meet again when I am back after Easter to discuss this and a possible approach to the Hessen regulator.

With best wishes,

Jeremy

As promised I have provided below the key information taken from the response from Deutsche Bank UK to my enquiries regarding Deutsche Bank PFK.

We have liaised with colleagues in Germany and we understand that the following is the context of DB PFK’s response to the access request that Mr Taylor made to them.

  *   The access request related to an account that Mr. Taylor had indeed held with DB PFK.

  *   The request was considered with reference to the applicable German data protection law.  The new German Federal Data Protection Act (“new BDSG”) came into force alongside the GDPR in May 2018 as part of the law entitled “Datenschutz-Anpassungs- und -Umsetzungsgesetz EU (DSAnpUG-EU)”.

  *   Section 34(1)(2) of the new BDSG effectively provides that a data controller does not have to fulfil a subject access request if the following conditions apply:

     *   the relevant data is being stored solely for the purpose of complying with legal retention periods; and
     *   disclosure would require a disproportionate effort on the part of the controller; and
     *   appropriate technical and organisational measures are in place in order to make it impossible to process the data for purposes other than storage for compliance with legal retention periods.

  *   An English translation of the new BDSG can be found here<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gesetze-im-internet.de%2Fenglisch_bdsg%2Fenglisch_bdsg.html%23p0304&data=01%7C01%7CNeil.Wadsworth%40ico.org.uk%7Ce429892d80e24946329008d6be706b16%7C501293238fab4000adc1c4cfebfa21e6%7C1&sdata=EBv38m9727onb7VruKklVparBcowqnTUTXyKy9As6yw%3D&reserved=0> on a website of Germany’s Ministry of Justice.  Note that the pre-GDPR version of the German Federal Data Protection Act (i.e. the old BDSG) contained provisions with a similar effect, namely section 34(7) read together with section 33(2)(2).

  *   Mr. Taylor´s relationship with DB PFK had terminated in November 2016.  At the time of his request to DB PFK, all data relating to his relationship with the bank had been moved into archive systems and only continued to be held to meet record retention requirements.

  *   The effort required to provide Mr Taylor with data stored in the archive systems was viewed as disproportionately high due to the fact that (i) Bank systems typically process large volumes of data regarding long-standing client relationships, (ii) Mr.Taylor did not specify the period of time to which his request related, and (iii) he did not provide any additional information that might have limited the scope of his request.

  *   Data stored in DB PFK’s archive systems is held securely, with technical and organisational measures in place that prevent unlawful usage.

  *   In light of these circumstances, DB PFK, as controller, concluded that it was under no legal requirement under German law to disclose to Mr Taylor the personal data which he had requested.

Should Mr Taylor wish to take this up with the local data protection supervisory authority, this would be the Data Protection and Freedom of Information Regulator for the region of Hessen, whose contact details are:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Email: [email-masked]<mailto:[email-masked]>
Tel: +49 611 1408 - 0
Fax: +49 611 1408 - 900

I hope that this information is useful to you. Unfortunately, with the data controller based in Germany and them having claimed use of an exemption included in the German Federal Data Protection Act, I may be unable to provide any further assistance.

Jeremy Lefroy
Member of Parliament for Stafford constituency

House of Commons, Westminster, London, SW1A 0AA

t    +44 (0) 20 7219 7154  e   [email-masked]<mailto:[email-masked]>   w  jeremylefroy.org.uk

From: TheAbstraction [mailto:[email-masked]]
Sent: 17 April 2019 17:23
To: LEFROY, Jeremy (2nd Mailbox) <[email-masked]>
Cc: INGALL, Pauline <[email-masked]>; Neil Wadsworth <[email-masked]>; REDFERN PRICE, Sonya <[email-masked]>
Subject: ICO

Dear Jeremy,
   Would be good to know the result of the phone call when it is over.

Cheers
--
Mark Anthony Taylor
UK Parliament Disclaimer: this e-mail is confidential to the intended recipient. If you have received it in error, please notify the sender and delete it from your system. Any unauthorised use, disclosure, or copying is not permitted. This e-mail has been checked for viruses, but no liability is accepted for any damage caused by any virus transmitted by this e-mail. This e-mail address is not secure, is not encrypted and should not be used for sensitive data.