Insights

The third in a short series on the ICO’s new Complaints Framework — this one for Business Improvement Districts and the town-centre security teams keeping our streets safe.

The recap, for anyone joining late: since February the ICO has triaged out roughly one complaint in two, reserving investigation for cases involving serious harm, vulnerable people, or its stated priorities. The difficulty for a BID is that its everyday work ticks more than one of those boxes at once.

Cricket has long drawn a line between the Spirit of the game and its Laws. You can play in the finest spirit — and still be given out by the Laws. That is the line a BID has to walk.

The spirit is beyond question. Keeping high streets safe, sharing intelligence on prolific offenders, watching over the vulnerable — this is public-spirited work of real value. But the ICO does not mark you on spirit. It marks you on the Laws, and the Laws around this data are exacting.

Criminal-offence data — offender watchlists, incident logs, “banned from one, banned from all” — is Article 10 data. To process it lawfully you need not just a lawful basis but a specific condition in Schedule 1 of the Data Protection Act, sitting on an Appropriate Policy Document. Miss that, and however good your intentions, you are plumb in front and the finger is going up.

Rough-sleeper data raises the stakes again. It so often reveals health and vulnerability that it tips into special-category territory — and rough sleepers are exactly the vulnerable group the Framework instructs the ICO to protect. A complaint here does not need to be strong to be heard.

And there is the question of who is batting at all. As a BID decides whether to become a Business Crime Reduction Partnership in its own right or to outsource to a body such as the Safer Business Network, it is really deciding who holds the bat — who is controller, and who therefore answers when a complaint is bowled. That is a selection decision to be made deliberately, not by default.

None of this is an argument to leave the field. It is an argument to know the Laws as well as you keep the spirit: a DPIA, the right Article 10 condition and Appropriate Policy Document, clear data-sharing agreements, a governed watchlist with a route to challenge, and an internal complaints procedure that settles matters early.

We have set this out in a fuller ELIAS opinion for BIDs, which I am happy to share. Play in the right spirit by all means — but make sure you are also playing within the Laws.

Richard Dutton

Managing Director, ELIAS Partnership