The UK data protection regulator, the Information Commissioner’s Office, has issued an enforcement notice against Father Christmas under the General Data Protection Regulation (679/2016/EU). The notice relates primarily to the Naughty Children List.
The notice is particularly noteworthy because it has been issued against a business headquartered in the North Pole and which does not appear to have any presence within the EU. This is only the second action ever taken by the ICO against an entity outside the EU (the first being taken against AggregateIQ, based in Canada).
The ICO found that Father Christmas’ use of the Naughty Children List failed to comply with the GDPR in the following ways:
- It processed personal information, including names and addresses of UK individuals, in a way that the data subjects (the children) were not aware of and without a lawful basis for that processing.
- Extreme damage or distress was likely as a result of the children being denied presents without previous fair and transparent disclosure by Father Christmas.
Given the seriousness of the matter, the UK’s ICO has engaged a law firm to represent it. The chosen law firm, the London-based Paemee Bygge & Effoff, issued a statement earlier today, stating that what made the offence particularly serious was Father Christmas’ use of automated decision making to categorise children as Naughty or Nice without the prior explicit consent of the affected data subjects, or the disclosure of meaningful information about the logic involved.
Father Christmas, represented by the New York law firm of Kallthat Bygge Mijnis Faabygger, has denied the ICO’s charges and has issued the following statement: “According to Article 22 GDPR, explicit consent for ADM is only required a) if there are legal effects or similarly significant effects, and b) the decision making is performed solely by automated means. On the facts, it is our contention that there no legal effects. Moreover, each decision was reviewed by an Elf, and therefore Article 22 does not apply because it fails the ‘solely’ test.”
In related proceedings, the Manchester-based class-action law firm Ringit, Up & Kerching has brought a class action on behalf of the children on the Naughty Children List. At a press conference, a partner at Ringit, Up & Kerching stated that “Father Christmas’ creation of the Naughty Children was clearly an unwarranted abuse of the fundamental rights of freedom of individuals. The denial of presents was clearly as significant as a legal effect – ask any child. Furthermore, the ‘solely’ test in Article 22 assumes intervention of natural persons, whereas there is no provision of the GDPR which makes an Elf a natural person.”
Matters have been further complicated by the representative action launched today by Mr Potato Head, together with his friends Woody, Dinosaur and Mr B. Lightyear. Mr Potato Head said: “We are sick and tired of our personal data being processed by Father Christmas and other toy retailers and distributors without so much as a by-your-leave. My name clearly indicates my ethnic identity and, as such, is a special category of data requiring explicit consent which, I can confirm, has not been given. We are launching this representative action today on behalf of all toys and will be claiming damages for financial loss and emotional distress”. Mrs Potato Head was unavailable for comment.
We also understand that Father Christmas’ reindeer, Dasher, Dancer, Prancer, Vixen, Comet, Cupid, Donner and Blitzen, are being represented by the Luxemburg law firm We’R Small Donowt Anstill Getpayd. “We too are tired of having our personal data exploited without any kind of lawful basis. We understand that Father Christmas has placed tracking devices on our persons and is able not only to monitor our location on a real-time basis but also our consumption of carrots, milk and mince pies. As a result, we are constantly bombarded with online advertisements for weight-loss products, anti-fungal hoof cream, and antler polishers. This kind of profiling is invidious, intrusive, and a fundamental assault on our privacy.” The reindeer are currently in discussion with Mr Potato Head about joining his representative action.
However, the display of unity amongst the reindeer was severely damaged when the ninth reindeer, Rudolf, declined to engage the services of We’R, Small, Donowt Anstill Getpayd, and instead engaged the Hollywood law firm Smile Lieand Kashintothemacks. In a press statement, the Hollywood law firm stated: “We confirm that we are representing Rudolf the Red-Nosed Reindeer in all matters, including in relation to actions relating to Mr Rudolf’s privacy and abuse of the rights to his name. We deny categorically the rumours of Mr Rudolf’s frottage with an unnamed Hollywood actress. If Mr Rudolf’s nose is red, it is because he was born that way.”
The European Data Protection Board, previously the Article 29 Working Party, has announced that, given the seriousness of the legal issues raised, it will be issuing emergency guidance. “We confirm,” said the statement from the EDPB, “that we will be continuing the tradition of the Article 29 Working Party and that our guidance, when issued, will use ten words where one word would have been enough.”
In breaking news, we understand that there is disagreement amongst the Supervisory Authorities as to which should be the lead authority. The UK’s ICO has declared that it was the first supervisory authority to launch the action and therefore that it is the natural lead authority, and the fact that the UK is incapable of working in harmony with any European nation is irrelevant. The CNIL (France) has replied that, as the cleverest of the Supervisory Authorities, and the one with the best food, it was the natural body to take the lead. The DPC (Ireland) has replied that, due to Ireland’s tax breaks and the DPC’s particular application of data protection rules, it was the lead authority for all the major social media organisations, and that should include Father Christmas too. The BfDI (Germany) has stepped in and asserted that since Germany invented Christmas, and has won more World Cups that anyone else, it should be the lead authority for Father Christmas and, as far as it was concerned, that settled the matter.
Legal proceedings from the Elves are expected imminently.
More like this (not quite like this) at www.thisisdpo.co.uk.