Despite having a vast Legal Department and specialist Data Protection Officers, East Riding of Yorkshire Council (ERYC) is processing residents’ Data without the essential “informed consent” that the law requires.

Mathew Buckley 

Yet again, Mathew Buckley, ERYC Head of Legal and Democratic Services, is unsure what his right and left hands are doing.

When residents phone ERYC, they are informed “Occasionally, calls may be monitored for training purposes”.

Upon receiving an email from ERYC, the standard disclaimer states:

“The Council reserves the right to monitor record and retain incoming and outgoing emails for security reasons and for monitoring compliance with our policy on staff use.”

Before ERYC use residents’ Data to:

1. Monitor “for training purposes”
2. “Retain incoming and outgoing emails for security reasons” or
3. Monitor “for compliance with our policy on staff use”

they must have “informed consent”.

Article 4 (11) of the GDPR confirms this:

While ICO clarifies what is “freely given”

At no point prior to gathering Data via a phone conversation “for training purposes” or via email communication “for security reasons” or “for monitoring compliance with our policy on staff use” has ERYC requested or received “informed consent” to do so. Thus they are processing and using residents’ Data unlawfully.

Privacy Hub

To make matters worse the www.eastriding.gov.uk/privacyhub page quoted on the disclaimer does not exist. Everyone can see that it redirects to https://www.eastriding.gov.uk/council/governance-and-spending/how-we-use-your-information/

Yet another “mistake” by ERYC, no doubt!

ERYC Naughty Table Irony

I can confirm that, as of 2 July 2021, there are currently nine people on the ERYC Naughty Table, aka Feedback Policy. Over the past six years, there has been a total of 17 on the naughty table.

One reason for being placed on the Naughty Table is for:

“Covertly recording meetings and conversations”

There is no legal prohibition on residents covertly recording any meetings or conversations with ERYC, whereas there is a legal prohibition against ERYC processing Data without “informed consent”.

As ERYC will have unlawfully processed Data of all of those currently and previously on the naughty table, is this a case of the pot calling the kettle black?

Oh, the irony of it – ERYC has acted unlawfully to process Data, to enforce a policy unlawfully, to place residents who are conducting themselves lawfully, onto the naughty table, unlawfully. Oh yes – and the justification for this could include covertly recording meetings and conversations perfectly lawfully!

Action Required

ERYC must immediately:

1. Ensure residents have given “informed consent” prior to recording any phone conversations (a simple press key 1 and press key 2 will ensure this).
2. Ensure residents have given “informed consent” for their emails to be processed.
3. Ensure the correct web page is stated on all Disclaimers.
4. Delete all Data currently held that has been processed without “informed consent”.
5. Report themselves to ICO for what is clearly an industrial-scale Data breach.

Formal Complaint

I have registered a formal complaint with ERYC Chief Executive Caroline Lacey for failing to:

1. Ensure residents have given “informed consent” prior to recording any phone conversations.
2. Ensure residents have given “informed consent” for their emails to be processed.
3. Ensure the correct web page is stated on all Disclaimers.

I have requested that all Data currently held that has been processed without “informed consent” is deleted at the earliest opportunity and that ERYC report themselves to ICO for what is clearly an industrial-scale Data breach.