feature Legal On the right track The BPA and BPA Lawline met the Information Commissioners Office to discuss some of the issues arising from GDPR and DPA 2018, as Derek Millard-Smith and Grace ODriscoll explain t BPA Lawline, we have been assisting members to prepare for and adapt post-implementation to the new EUs General Data Protection Regulation (GDPR) and its counterpart national legislation, the Data Protection Act 2018. As part of this process, we have been liaising directly with the Information Commissioners Office (ICO). Last month, together with the BPA, we met to discuss the practical solutions to the most prevalent issues. It was also an opportunity to ensure we understand what compliance with the current data protection legislation will look like in the future. We are pleased to report that the meeting was positive, with the ICO taking a pragmatic view on many issues, albeit confirming that it will not hesitate to take action in respect of the most serious breaches. The intention is for such meetings to become a regular occurrence, the feedback from which will assist the BPA membership as a whole. A assist with assessing how to recognise and deal with requests from data subjects. In the meantime, we discussed with the ICO some of the issues we have seen and some of the questions we have been receiving from members, including the requirement to ascertain the identity of the individual making the request prior to providing them with any personal information, as well as what documents members should be requesting in respect of ID (see box). Please note that the guidance detailed is from BPA Lawline because the ICO is unable to give definitive guidance prior to publication of its updated online guidance. Personal data retention and erasure We discussed in detail issues surrounding retention and, specifically, concerns about how data that is being erased in line with a retention policy may cause problems for the parking data controller. For example, where a persistent offenders information is deleted, meaning that next time they trigger a penalty charge notice the parking data controller is not aware of their history. ICO parking personnel The ICO confirmed that there will be designated individuals, both at casework and policy levels, to whom parking-related complaints and issues will be directed. The aim is to ensure that there is coherency and understanding in respect of sectorspecific issues. How to deal with data subject rights requests (DSRRs) The ICO confirmed that it is in the process of drafting further online guidance in respect of data subjects rights. We will update you once this has been published because this should There will be designated individuals, both at case work and policy levels, to whom parkingrelated issues will be directed to ensure that there is coherency within guidance issued by the ICO 34 Britishparking.co.uk PNDec18 pp34-35 Legal.indd 34 26/11/2018 16:24