Joanna Hoof
Lead Case Officer
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

Subject: Response to ICO Decision – Case Reference: IC-349990-F6C5

25 February 2025

Dear Ms. Hoof,

Thank you for your response regarding my complaint against East Sussex County Council (ESCC). I appreciate the ICO’s role in assessing data protection concerns and would like to clarify several critical points that warrant further investigation under the Data Protection Act 2018 and GDPR.

1. Failure to Provide Promised Data and Gross Negligence in Financial Management

ESCC’s Data Protection Officer informed me that I would be contacted in January 2025 with the requested documents regarding my subject access request (SAR). However, no such contact was made, nor was any data provided. This failure constitutes non-compliance with GDPR Article 12(3), which mandates a response within one month unless an extension is properly justified.

Furthermore, ESCC’s financial mismanagement has resulted in a budget deficit of £55.3 million for 2025/26, rising to £83.6 million by 2027/28, according to their own Cabinet report (RPPR Update Report.pdf, September 2024). This reflects systemic failures, which have directly impacted essential services, including Children’s and Adult Social Care—areas where personal data protection is of critical importance.

2. GDPR Violation: Sending a Password Without the Corresponding Data

ESCC sent me a password to access a data resource but never provided the actual data, rendering access impossible. This is a clear failure to comply with GDPR requirements regarding transparency and accessibility of personal data. Under Article 15, individuals have the right to access their personal data in a comprehensible format, which ESCC has failed to fulfill.

3. Misidentification and Identity Mismanagement

I have raised concerns that ESCC has wrongly associated me with another individual of the same name, leading to significant misrepresentation and potential harm. The council stated they would investigate if I provided evidence, yet they have not acknowledged or acted upon the supporting documents I have already supplied. This contradicts their obligations under Article 5(1)(d) GDPR, which requires organizations to ensure data is accurate and up to date.

4. Legal Implications Under Estoppel

For 12 years, I was under a contractual arrangement that included agreed-upon contact with Emily, which ESCC has not upheld. These assurances fall under the legal principle of estoppel, particularly:

• Promissory Estoppel: The council made clear commitments regarding contact, which were not honored.
• Equitable Estoppel: Their actions led to detrimental reliance, affecting my family life.
• Proprietary Estoppel: There has been a failure to uphold rights that were expected and relied upon.

This has resulted in Laches, where the unreasonable delay in fulfilling their obligations has caused ongoing harm and loss. These failures are not just breaches of policy but reflect a disregard for fundamental legal and ethical duties.

5. Public Disclosure of Personal Data by ICO

Your letter suggests that my FOI Decision Notice reference (FE0647813) is incorrect. However, this does not address my core concern: that my personal data was publicly disclosed, violating data protection law. If an unredacted version of the Decision Notice was previously published online, this constitutes an ICO compliance failure. While I note that processes have since changed, I expect a full clarification on whether my personal data was improperly shared.

Request for Further Action

Given the above points, I request the ICO to:

1. Investigate ESCC’s GDPR violations, particularly their:
   • Failure to provide SAR data despite assurances.
   • Sending a password without the corresponding data.
   • Wrongful association of my identity with another individual.
2. Confirm whether my personal data was publicly disclosed in the FOI Decision Notice and provide assurance that corrective measures have been implemented.

I look forward to a detailed response addressing these matters and outlining the next steps the ICO intends to take. 

Kind Regards
Mr. Martin Newbold