There are different sanctions lists and watch lists all over the world maintained by governments & ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA & FBI watch lists and many more. They often contain quite a lot of personal information about name variations, addresses, DOBs etc. which is usually considered as PII (as soon as it allows identifying a person) and should fall into a regulation of GDPR and similar. However, this data is openly accessed and even aggregated by projects like OpenSanctions.

So here's the question -- is it a special exceptional case that data privacy rules do not apply to sanctioned person data, or is it a worldwide violation of data privacy rules (very unlikely)? In a former case, who is authorised to decide that this person's data can be accessed without a restriction?

A more practical question would be, if let's say I want to collect some data about disqualified directors in the UK (https://beta.companieshouse.gov.uk) or another country, should I apply technical measures in line with the regulation (GRPR for instance) to protect this data in my system (e.g. encrypt it at rest)?

Please advise if it's an off-topic & I should move this question to another hub.

  • 1
    GDPR is all about against "profiling" as person. It is ironic that prominent figure may have public track record public over the news. In such case, those info may not even protect by GDPR. There is also argument of "what if the people name removed from the public blacklist" ? Then it is possible you must remove that data, unless it is used as generic aggregation. But to be sure, you should ask the question in LAW stackexchange, quora, reddit etc. – mootmoot Jun 1 '18 at 15:15
  • 1
    Oh, btw, in many country, it is illegal to collect such history record and sell it to third party. In addition, financial institution are "not suppose" to use such track record to profile their customer, they can only use the sanction list as it. – mootmoot Jun 1 '18 at 16:08
  • Are you asking about government publication of sanctions lists, or private republication? – cpast Jun 2 '18 at 0:43
  • @cpast the practical part of this question is more about private republication, e.g. if I want to provide some services (screening or alike) that use this data – Vladimir Salin Jun 2 '18 at 17:18
  • Thanks @mootmoot, good points. The question seems to be moved to law hub already – Vladimir Salin Jun 2 '18 at 17:20

There are a few different grounds under which PII can be handled. Perhaps the most discussed at the moment of GDRP introduction is consent, because of the wave of consent-seeking. But there are a number of other grounds. "Necessary for contract execution" is a trivial one, to deliver a pizza you'll need an address.

The relevant ground for sanctions lists is also pretty obvious in hindsight, you may process PII in order to comply with legal obligations. Note that this is still an integral part of the GDPR, not an exception to the GDPR. That means you need to apply all the basic GDPR rules. You need to explicitly store where you got the PII from, for which purpose, and you need to document how you're using it.

Note that this might be hard - why do you need to store this data? Why can't you just check the list as the moment it's relevant? The GDPR for a large part depends on you justifying your actions, not just in hindsight but already up front.

|improve this answer|||||
  • Very well explained, thanks. So even published in sanctions lists, this data remains PII and needs to be operated carefully and with justified reasons – Vladimir Salin Jun 5 '18 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.