A few weeks ago I asked GCHQ (Government Communications Headquarters) to send me any information they held about me as part of their Optic Nerve, ‘Tempora‘, PRISM or other similar programmes. This request was made under the Subject Access Request provisions of the Data Protection Act (1988). Their reply is intriguing:
“GCHQ has conducted a search of its records and determined that it has not processed any personal data to which you are entitled to have access. You should not assume from this response that GCHQ has or has not processed any personal data about you. GCHQ only investigates individuals whose activities relate threats to the UKs national secruity, economic wellbeing of the national or serious crime [sic]. Unless you have been involved in such a threat it is unlikely that we would be interested in you.”
So GCHQ may have processed my personal data, but if they have they are not going to tell me becasue I am not entitled to know. If they don’t hold any data about me then wouldn’t it have been easier to say that? As far as I understand the DPA (which isn’t very well), there are only limited circumstances in which an individual is not entitled to their data, such as where it’s not possible to disentangle other people’s data who you don’t have access rights to from yours. But GCHQ don’t say this is a factor. Neither do they say they have any sort of special exemption from the DPA. So on what grounds am I not entitled?
The line that GCHQ “only investigates individuals whose activities relate threats…” is untrue, unless their definition of “investigates” excludes the act of mass untargeted surveillance (or invasive universal targeting). But I didn’t ask them this – I asked them for any information they hold about me, not whether I am being investigated.
I need some expert advice on the Data Protection Act…