2020-100 – Sale of personal data by the SFO

Date Answered: 22 Gorffennaf 2021

Can I please have your records concerning the sales of personal data from 2019 and 2020, including trading partners and money earned from transactions?

Please can I have your records concerning the determining the price of personal data, for sales and sharing for the time period January 2019- Present.

What is your internal procedure for selling personal data? By this, I mean guidance given to internal staff and the buyer in question, for the time period of January 2019- Present.

What types of personal data do you sell and are there any limits placed on this? For the time period of January 2019- Present.

The SFO’s work is solely focused on the investigation and prosecution of criminal matters connected to serious fraud, bribery and corruption and it does not sell personal data. As such we do not hold the information you have requested for questions 1 to 4.

How many Subject Access Requests did you receive in the period 2017-2020, broken down by year? What types of personal data did they typically receive? For example email addresses, home addresses and telephone numbers?

The SFO received the following Subject Access Requests (SARs) for 2017 to 2020 (as of June 2020):

As to your question about the types of personal data received; I can advise that the majority of SARs that the SFO typically receives relate to our casework. In addition, we also receive SARs related to personal data that is being processed for general purposes not related to our casework. More information about the types of personal data we may hold and how we process personal data can be found in the SFO’s Privacy Notice