ICO and NHS

I have a short email address. Those that know, know, so not posting here.

Suffice to say it is of the form x@x.xx so is only 6 characters. It is 100% valid. I have used it for a couple of decades now - this is not new. I am not alone. [side note, I tried to sort x@xx email, which is not easy, and did not get off the ground, but some people have done this, and it is valid]

I registered to get access to on-line COVID passes with the NHS or is it NHS Digital, or what? To be honest it is not 100% clear. Privacy policies and the like should make this clear, but even now I am not sure. My MP believes it is Welsh government. The fact I am not 100% sure is part of the problem.

[update: https://access.login.nhs.uk/privacy says it is joint data controllers of the devolved (Welsh) administration and NHS Digital]

They would not allow me to register, so I created a temporary address (longer) and registered. Simple. I even have the whole domain rfc2822.uk for this purpose.

I then tried to change the email address to my normal x@x.xx email address, and their system would not accept it.

NHS expecting me to change my personal data to fit them

So I emailed their data controller requiring them, under my right of rectification under (UK) GDPR to correct my email address. They refused. Note the original (temporary) email is no longer valid, and hence meets the definition of not "accurate" personal information. Indeed, I do not even have the domain any more.

I wrote to ICO, and have exchanged several emails to ICO, and escalated and asked for review of the case.

Basically the ICO said: There is nothing in data protection legislation that prevents an organisation from having a system that has a minimum requirement for an email address.

This seems odd, as how can an organisation accurately record personal information if they do not accept a valid email address, i.e. they have a "minimum requirement" for what is "valid"?

This has gone on for some time, and I am not alone, there are others I know with similarly short email addresses that have issues with NHS (and other organisations). There are others I know with related issues on incorrect data validation at "sign up".

Just to be 100% clear, the NHS fully accept my email address is a valid email address, and have emailed me, to that email address, to say so, as have ICO.

I also asked ICO more generic questions about whether an email address is personal information, and if I can expect (require) an organisation to correct it when it is wrong. They confirmed that is the case, so I again wrote to NHS quoting them - no reply. What a surprise.

I have written to my MP as well, and asked them to chase, and they have written to NHS (Welsh Government).

Latest from ICO is "For clarification, as the NHS has not recorded your email address then we are unable to suggest that they are recording inaccurate information. 'Inaccurate' would apply to information that was recorded incorrectly. There is no suggestion that they have done this."

Seriously, I'm shocked. This has, all along, been about the NHS refusing to correct my email address. So I have explained, again, to the ICO, that the NHS have recorded my wrong email address and are refusing to enact my request under my right to rectification to correct it under UK GDPR.

We will see how it goes, but this is a matter that relates not just to email, but other things.

• Organisations will insist someone has to meet some format for a name - a forename and surname (not all have this), a name with more than one letter (not all have this), etc.
• Organisations will insist a UK mobile phone number has to start 07, and organisations will even blacklist some operators 07 mobile numbers as not valid mobile numbers!
• Organisations routinely try to impose rules on email addresses.
• I really expect organisations to have shit when it comes to recording gender, which is rather topical.

The law does not stop companies from having rules to take their service as long as not discriminating based on some protected criteria. They can refuse me because my email address is too short. IMHO this is wrong.

But once they have accepted a customer/client, perhaps with wrong, or temporary personal details, they do have to comply with GDPR and have to correct incorrect personal information. So it would be better if they accept the correct personal information in the first place. In seems to me that GDPR (or UK GDPR) has a flaw in not covering this properly for "sign up". People should not be able to use email address, mobile number, name, or gender, as a reason to refuse to accept a customer/client.

This is even more so when it is not some company, but an organisation like the NHS. I have an NHS presence, I have to, as a UK citizen, and they have data on me right now that is not "accurate". That needs fixing.

Update: 1st Jul: The ICO now seem to be suggesting that because the email address they recorded at the time was correct (accurate) that they do not have to correct it now that it has become inaccurate. This would suggest organisations do not have to update name, address, phone number, email address, well, any personal information they hold when it becomes inaccurate over time. That seems a stretch!

Update: Someone has suggested this is "the same on all GDS platforms", and that it is not fair for me to "bother" the NHS. I appreciate the NHS have a hard time, but if this is the case the all the NHS have to do is contact whoever maintains their platform for them, explain they have a legal requirement to correctly record personal data, so have 30 days to "fix" this, and the NHS will have done what they need. Instead the NHS have so far chosen to spend time arguing with me, and then updating their site to state that an email address has to be at least 7 characters (previously it accepted it but did not send the confirmation email so it did not work). At the end of the day, someone, somewhere, on some platform, just has to change a 7 to a 6 in some code (or better still, follow the RFC for validating email, which will be a simple regex or library). It is not a hard fix for whoever does it - if the layers of people above that, all the way to the NHS, simply tell them to do it.

When is an email address not an email address?

I just saw an interesting tweet...

The perils of legislating for electronic communication... An e-mail address means an actual e-mail address, not one that appears to be an e-mail address but has never been set up or registered to a user. (UKEAT) https://t.co/XpTl55YYWy

— Graham Smith (@cyberleagle) 15 February 2019

This case hinges on what is an email address. The key issue was that someone mistyped their email address on a form, leaving out a dot in the local part and hence did not get an email that was sent. The email did not bounce (which is not that uncommon), so the sender has no way to know the email address was not right.

The judgement is odd to me, it is that it is not in fact an email address if it is not valid. i.e.

I have come to the view that the expression “an email address” means an actual email address and not, as here, an address that has never been set up or registered to any user or users.

So, to be an email address, it has to be set up or registered to a user, whatever that means!

This raises all sorts of questions. What does set up, or registered even mean even? Who has the authority to say if an email address is registered to someone - where is this register kept? What if the email is registered to someone else, i.e. it is not the email address that was intended?

This does, however, raise a huge issue with both judgements like this and legislation like the PECR (The Privacy and Electronic Communications (EC Directive) Regulations 2003). In both cases there is a big issue which seems to have been missed - how does someone determine what they have? How does one actually apply the law/ruling in practice?

In this judgement, how does the sender know if the email address is an email address where the test is whether it is set up, or registered to any user (not even to the intended user). There is no test for that, and no way for the sender to know. They cannot rely on "does the email bounce?" as in this case the email did not, and that was not good enough.

In the PECR there is a test of whether the email address is for an individual subscriber. This too is defined, but it depends on the way the subscriber contracts for the communication service. This is something that the sender has no way to tell, but it changes whether they can send an email without being in breach of the regulations. Essentially the PECR only works if the sender has to assume every possible email address may be of an individual, so is not valid for unsolicited marketing. They have no way to know, meaning ALL emails are in scope and should not be sent (if unsolicited marketing emails). If that was the intention of the law, then why not say that - why create the illusion in the law that sending to commercial subscribers is OK when there is no test a sender can apply in order to comply. Either that of the sender has a defence that they could not know, and so the law is effectively useless. Basically the law is bad law as those that need to follow it have no way to reliably do so.

In this judgement there is a similar issue - the party sending the email needs to know they have an email address or not as it changes what they do and what timescales things have. They have no test they can apply to determine if what looks like an email address is in fact an email address based on this judgement.

Indeed, as warned in the case, the intended recipient of the email can game the system by providing an email they know to be invalid but which does not bounce.

You also have the question of when the email is valid. Is it set up, or registered to a user when supplied, or when the email was sent? Anyone with a domain can decide if and when an email is valid on a whim as they require.

And then there are wildcard domains, which some people have, and emails using wildcards and pattern matches. None of these (as complete email addresses) are registered to a user so does that mean all such email addresses are now invalid, and not an email address under law?

Shame...
Update...

After a bit more discussion, I still feel quite strongly this is just wrong.  The wording is :-

(3)  An early conciliation certificate will be deemed received—
(a)  if sent by email, on the day it is sent; or

To me, this makes it pretty clear that the sender has done their job if they send an email (to the address notified to them). This is pretty common wording for email and post, and it means that if the person providing the address makes a mistake, then that is their problem. The sender is expected to send to the address notified - there is not any more you can expect from them, and it is not their fault if the address turns out to be wrongly provided to them, and also not their fault if the delivery system (post, or email) does not get it to the recipient.

The wording could have been something that requires the recipient to have actually received the notice/certificate. I have seen things like that. That would put the onus on the sender to somehow check the recipient has got it, and make the sender responsible for correct addressing and delivery. But that is not the wording in this case. To me, this means a typo is the problem of the person that makes the typo.

The ruling could have said a typo is the problem of the person making the typo, with possible exception that something that is obviously not an email address should be spotted by the sender (i.e. just has to have the appearance of an email address, or meet the internet standards). The ruling could have said this is all down to communicating, and the email has to actually be the correct one for the recipient, and if the email does not get to them, it is not "deemed received".

To me, the whole point of "deeming" it received is because actual receipt is not the senders problem. If the law as that it actually has to be received, by the right person, it would not need a clause on "deeming" it so.

The actual ruling is in the middle. It says that it is not "an email address" even if it "looks like one" if not "set up" or "registered to a user". So a typo is the problem of the person making the typo if and only if their typo ends up being a valid email address. But if their typo makes an email that is not a valid email address it is the problem of the sender (who has no way to tell there was a typo), even if the mistyped email has a valid domain with MX record and email correctly goes to that server.

Surely the judge should have clearly decided - "whose responsibility is it if a typo is made?" Having decided that, one way or the other, he could make a ruling on whether this is an email address or not. This ruling does not actually answer that.

This comment muddies the water even more :-

Since the object of the Form is to enable communication, the intention must have been to solicit an email address that could be used to send the certificate. If so the phrase must mean an actual email address.  That is what the request on the form sought. I find it difficult to accept that Parliament intended the words “an email address” to include invalid addresses that could not be recognised as an email address by a server and forwarded.

But the email address was one that could be "recognised and forwarded" as the domain part was not mistyped, so the mail could be sent to the correct MX record. This is the same as sending a letter to a postal address. What happens then is down to name or department written on the letter, but it has been delivered to the "address" by the postal service.