united-kingdom gdpr european-union data-protection
Does the UK have a (enforcable) law linked with the Data Protection Act to control document&#39;s metadata?
<p>Reading the information on the <a href="https://ico.org.uk/" rel="nofollow noreferrer">ICO's website</a>, I came across a few items mentioning how to handle metadata on my organization's workflow like <a href="https://www.gov.uk/hmrc-internal-manuals/shared-workspace-business-manual/sw03270" rel="nofollow noreferrer">THIS</a> or <a href="https://www.gov.uk/hmrc-internal-manuals/shared-workspace-business-manual/sw03420" rel="nofollow noreferrer">THIS</a>.</p>
<p>I noticed they use expressions like &quot;should consider&quot; or &quot;is recommendable&quot; when they refer to handling a document's metadata.</p>
<p>As I understand, they do not enforce any &quot;special treatment&quot; to these pieces of information.</p>
<p>Other European countries, like Spain, have special laws that describe how public bodies or private companies must handle metadata.</p>
<ol>
<li>Is there an equivalent law applicable in the UK?</li>
<li>Who is responsible for the information contained in such metadata?</li>
</ol>
<p><strong>EDIT I</strong></p>
<p>This is a follow up question after reading @Amon comment.</p>
<p>Let's say for a given organization the person responsible for Data Protection Act compliance do all due dilligences up to his/her knowledge to make sure that the company is compliant.</p>
<p>At one point, a third party discover a vulnerability that produces a data breach and notify the organization's DPO with the details of the data breach, but the DPO &quot;do not believe&quot; the info and just ignore the new information.</p>
<ol>
<li>Is that &quot;bad practice&quot;?</li>
<li>Is this something regulated?</li>
<li>Is there any responsible for &quot;ignore that&quot;?</li>
<li>Who else should be notified?</li>
</ol>

<p>Specific laws or regulations relating to metadata are unnecessary, and possibly counter-productive.</p>
<p>UK data protection law is centered around the GDPR, which is largely principle-based – instead of providing a checklist of very concrete compliance measures, it is the data controller's responsibility to determine appropriate measures in order to achieve the data protection principles. For example, this obligation is expressed in Art 24 GDPR:</p>
<blockquote>
<p>Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. […]</p>
</blockquote>
<p>What risks exist for what activities is extremely contextual. Leaking information through metadata is a <em>potential</em> risk, but it's not a risk in every context. Thus, data controllers <em>should</em> consider whether metadata could pose a privacy problem in their workflows, but they are not necessarily required to redact such metadata.</p>
<p>This provision of the UK GDPR is already enforceable, but it would need a case by case analysis to determine whether the risk analysis and selection of technical and organizational measures have been conducted incorrectly.</p>
<p>The documents you linked are a HMRC internal manual. These are not normative – they do not bind other organizations. Instead, the existence of these manuals is an expression of HRMC's own obligation to consider various risks and implement appropriate technical and organizational measures (TOMs). Of course, other organizations could use such manuals as a starting point for their own analysis.</p>
