Blog on our approach to requests from third parties asking us to take down their personal information

[RichardTaylor]

Our approach is set-out on our help pages, at

https://www.whatdotheyknow.com/help/privacy#erasure

The blog could draw attention to an aspect of our approach I think goes above and beyond what the Information Commissioner advises is required.

Not only do we have general legitimate interest test / legal basis applying to our processing of individuals' personal data - we review and reassess that balance test in light of case specific information presented to us by the individual, and in light of the specific nature of the request/response.

This approach could be considered to be implied by the ICO's guidance:

Individuals have the right to have their personal data erased if:.... you are relying on legitimate interests as your basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/#ib6

but a blog explicitly drawing attention to what we do would be useful.

Human Rights considerations could also be mentioned, see: "Ensure we are giving due consideration to human rights under the ECHR when dealing with takedown requests" #996

We could also note the journalism derogations:

https://www.whatdotheyknow.com/help/privacy#legal_basis

This blog would help us pursue our aim of transparency in running our service, will enable outside criticism if people think we're getting it wrong, and might help others running, or considering running, similar services.

[RichardTaylor]

Related:

https://github.com/mysociety/whatdotheyknow-theme/issues/1162

[HelenWDTK]

Noted at https://wdtkwiki.mysociety.org/wiki/List_of_blog_ideas