u/MoveIntelligent5247

Morning all,

I have almost 800,000 Avios that I am just not going to use. If I hadn’t previously used them for flights and upgrades then I’d be closer to double that now too! We continue to earn through Amex and Avios but not on flights anymore.

We have a young child and not planning on anything long haul in the coming years and even then and when we do, it’ll be Club World with companion voucher so wouldn’t make a huge dent.

I’m also in the lucky position that there isn’t really anything I need in the shop so now wondering what the best route to converting to cash is?!

Currently thinking an iPhone 17 Pro Max in the shop is c.164k Avios + c.£400 for a £1,099 device. Get that and put on eBay could convert to £500-£600? Doesn’t seem a great conversion compared to a return Club World flight!

Any other ideas?

TIA

Any UK loss adjusters on here? In particular working in buildings/contents and major/complex loss.

Would appreciate the opportunity to ask a couple of questions if so!

TIA

Hi all,

Question as per the title really! Have seen / heard of a couple of examples where data rights request responses appear to have been deliberately vague and obtuse including responses to Article 16 requests or requests for processing clarification under Article 15 where the data subject is trying to hold the controller / processor to account.

Responses essentially don't answer the question (I would speculate to avoid proper transparency and / or because they know they haven't quite followed the law properly), prompting follow up questions from the data subject and then controller / processor invoke "excessive" and refuse any further requests, I assume knowing that the data subject won't request ICO intervention (accepting they would only likely advise anyway) because of the extensive lead times.

For example, one that I am aware of:

Data subject knows that published controller retention period is 3 years for correspondence but a processor is still holding that data 6 years later

Data subject makes Article 15 request to the controller asking for clarification of what their retention policy is and why a processor is still holding the data

Controller responds to say "correspondence is held for as long as necessary" (even though this is contrary to published 3 year retention policy)

Data subject responds to ask what that means in practice - "what is "necessary" and how does that relate to 3 and 6 years?"

Controller responds to say "We make sure we follow the law"

Data subject responds to say "I still don't know what that means, please explain in simple terms"

Controller responds to say "We've already told you, your requests are now excessive and therefore refused, we will no longer engage with you, you have the right to go to the ICO if you are not happy"

Data subject is left none the wiser.

Common?!

Slightly random question for any conveyancers in the group if I may?

Are you able to provide any insight into the percentage of purchasers that you act for that get professional environmental searches? I.e. not just an Environment Agency search. Assuming of course that not everyone is doing full due diligence and the answer is not 100% of purchasers!

In addition, for those environmental searches, do you have a preferred supplier?

Thanks in advance

Morning all,

Currently preparing an LBA in a case relating to a property conveyance, in particular to searches.

There is quite a lot of evidence that I would like to use that is on the Internet Archive "Wayback Machine" which shows the evolution of the defendant companies approach to searches and why the search that we received was not fit for purpose due to deliberate decisions that the company had made in its report criteria.

Could any experts please advise if there are any issues with doing this? We will likely include a "schedule of facts" in the LBA for agreement/disagreement/disputed that will include these things so would be aiming to have the authenticity of the pages agreed (e.g. In 2019, your website stated X in relation to this search type").

Anything that I'm missing?

Thanks in advance.

EDIT: Sorry, this is in England.

Evening all,

Further to some previous posts I've made regarding controller / processor confusion, additional things have come to light which may well be interesting to the community. Apologies, might be deliberately vague.

Firm A - Controller
Firm B - Processor; privacy policy says they will share data with their 3rd parties as part of the processing
Firm C - Processor instructed by Firm B as one of those 3rd parties (randomly selected online rather than having an existing contract with Firm B)

All well and good so far.

However:

Firm B shared far more data with Firm C than was necessary for the processing purposes.

A DSAR made to Firm C revealed that data had been stored in a standard personal email account for well over the retention period.

In handling the DSAR, Firm C instructed Firm D to assist with the DSAR, apparently to do a search of their computer to find the data and send it to us.

The data was then printed and scanned on an open scanning device we think belonging to Firm D that sent the data to us via Firm E, an email relay provider. The scanned file received was not encrypted.

Both Firm A and Firm B are/were unaware of the DSAR made to Firm C. There is no evidence that Firm B had any form of DPA or even contract with Firm C, nor alerted them to data handling etc. at the point of instruction.

What has gone wrong and where, if anywhere?!

Thanks in advance

Hi all,

I wonder if someone could please explain Article 14 requirements on a data controller in simple terms? This is further to my post a few days ago regarding controller/processor confusion, but keeping it separate as it's a different question - hope that's ok!

In particular, I'm interested in 3(a) and (b), requiring the data controller to inform the data subject.

As per previous post, there are three firms involved:

Firm A - definitely data controller

Firm B - previously processor of Firm A, now asserting data controller (but don't know if that's valid)

Firm C - solicitor acting for Firm B in response to data rights requests, asserting themselves as independent data controller

We submitted data rights (rectification) requests to Firm B, assuming they would forward to Firm A. Instead, out of the blue we received responses to the requests from Firm C.

We have not received anything at all in relation to data policies etc from Firm C, but Article 14 (3)(a) and (b) seems to suggest that we should have done?

So, two questions if I may:

1. Should we have received something relating to data privacy, rights etc from Firm C?
2. Does just having a published privacy policy suffice?

To be honest, we are not overly happy with how any of this is being dealt with, particularly as the responses are full of "legalese" and don't really get to the crux of the issue, so would like to understand how Firm C were appointed.

Thanks in advance

Good morning all,

I wonder if anyone could help me unpick what is going on here?!

I had a financial contract with Firm A who are the controller.

Firm B acted for Firm A as a processor which:

1. their privacy policy confirms, and
2. was confirmed directly to us a couple of years ago when a DSAR sent to Firm B was passed back to Firm A, with guidance provided at the time by Firm B saying that "as data processor we need to pass the request to our controller".

We are in dispute with both Firms for a number of reasons but one is in relation to record keeping and record accuracy.

We submitted a number of Right to Rectification requests to Firm B (for data that was collected and processed in the same period that they had previously stated they were a processor). They responded to these requests via Firm C, their solicitor. Firm C was making the judgements on whether or not the requests should be upheld.

In the response, Firm C stated that their Client, Firm B, as a data controller, had no legal requirement to inform Firm A of the receipt of the requests, the changes made and any rejections.

I have now confirmed with Firm C that they also assert themselves as data controller.

So I am confused as to how Firm A, B and C can all assert themselves as data controllers for records that were originally collected and processed only on behalf of Firm A, by Firm B.

Thanks in advance for any help in unpicking.