Ms Anna Morgan:

There are two types of statutory inquiry we can process under section 110 of the 2018 Act. We can take one of our own volition or we can commence an inquiry which is complaint-led. There are a range of factors which will influence our decision on whether to commence an inquiry of our own volition. For example, if we see trends or patterns which point to particular issues within a sector or specific organisation and which raise wide-scale concerns regarding the processing of personal data, in other words if systemic issues are pointed to, it will factor significantly into a decision on whether it is appropriate to open an such an inquiry. Factors include volumes of data subjects being affected along with different types of processing operations and the different types of data being processed. Obviously, there are special categories of personal data that merit particular protection under the GDPR.

If there are certain subsets of data which fall into the mix and which pose higher risks to the rights and freedoms of individuals in the context of data protection, that is an issue which will weigh heavily on our decision on whether to commence a statutory inquiry. Equally, it is not just trends in complaints submitted to us that have a bearing on how we decide where to apply the significant resources required to carry out statutory inquiries. We may have indications from civil society of a belief that there are issues with a particular organisation or sector or industry. There are a number of privacy advocacy groups that are very active in this area. Equally, issues may be brought to our attention by the media and, of course, elected representatives also. There is a range of sources from which we can be alerted to particular issues, including our own internal monitoring of issues, breach notifications, complaints and trends raised by queries submitted to our information and assessment unit. All of this is factored into the mix.