Forensic-style Assessment of ESCC’s Response – SAR Ref. 24365701
1. Executive Overview
The correspondence issued by East Sussex County Council (ESCC) on 9 January 2026, in response to Individuals’ Right Request ref. 24365701, presents a number of procedural, jurisdictional and data‑protection inconsistencies.
The reply confirms the late removal of the Newsroom article but fails to address the statutory implications of the delay, the continued online presence of derivative media articles, or the Council’s obligations under UK and EU data‑protection law.
The communication adopts a limitation‑of‑liability posture rather than providing a substantive GDPR‑compliant response.
2. Late Removal and Procedural Non‑Compliance
ESCC reiterates that the press release was removed in December 2025.
However:
- the Pre‑Action Protocol deadline expired on 4 December 2025
- ESCC’s confirmation was issued on 23 December 2025
- the removal occurred after the expiry of the statutory timeframe
This constitutes a clear breach of the timeliness requirement under the Pre‑Action Protocol for Media and Communications Claims and results in the unlawful persistence of the content beyond the permitted period.
The delay materially aggravated reputational harm and prolonged the unlawful processing of personal data.
3. The “Open Court” Argument – Legally Irrelevant
ESCC asserts that the trial was conducted in open court and that information disclosed during the hearing was publicly available.
This argument is misplaced for three reasons:
a) Public availability does not override GDPR
The fact that information was spoken in court does not authorise:
- online publication
- global indexing
- cross‑border dissemination
- indefinite retention
Online publication is a separate act of processing requiring its own lawful basis.
b) ESCC did not possess a judicial record
ESCC has previously admitted that the Newsroom article relied solely on:
- the Prosecution’s Summary of Facts
- unspecified “excerpts”
No written judgment was held, verified, or consulted.
The “open court” argument therefore lacks factual and legal foundation.
c) Online publication is an autonomous processing activity
As such, it must comply with:
- accuracy
- minimisation
- proportionality
- storage limitation
- territorial scope (Art. 3(2) GDPR)
None of these obligations are addressed in ESCC’s reply.
4. Denial of Responsibility for Media Republishing
ESCC states that it is not responsible for material produced by the press or members of the public.
While correct in a narrow sense, this omits a critical point:
- ESCC is responsible for the primary source
- the primary source was inaccurate, incomplete and unverified
- the primary source was published without safeguards
- the primary source was removed late
Media responsibility is autonomous,
but ESCC’s responsibility is originating.
The reply fails to acknowledge this distinction.
5. Failure to Address GDPR Obligations
The response does not address:
- the failure to meet the statutory deadline
- the absence of georestriction
- the absence of de‑indexing
- the persistence of cached versions
- the continued dissemination of personal and sensitive data
- the Council’s duties under Articles 5, 6, 9 and 17 GDPR
The omission of these points renders the reply procedurally and substantively deficient.
6. Persistence of Online Content
Despite ESCC’s removal of the Newsroom article:
- derivative media articles remain online
- they continue to be indexed by search engines
- they continue to disseminate personal and judicial data
- the reputational impact persists
ESCC’s reply does not address the consequences of its late removal nor the foreseeable propagation of the original content.
7. Relevance of the Criminal Complaint
Your reply correctly notes that:
- a denuncia querela was filed on 12 December 2025
- the offences involved (Art. 595 c.p., Art. 13 L. 47/1948, Art. 167 Codice Privacy)
are prosecutable ex officio
This means:
- the proceedings are no longer within your discretion
- the Italian Judicial Authority is obliged to proceed independently
ESCC does not acknowledge this procedural reality.
8. Overall Assessment
The ESCC response is:
- late
- incomplete
- non‑compliant with GDPR
- procedurally insufficient
- factually limited
- legally inadequate
It fails to address the core issues raised in the original request and does not remedy the unlawful persistence of the content.
9. Forensic Closing Statement
The analysis of the documented activities indicates a pattern of conduct characterised by traceability, procedural compliance and institutional oversight, which is difficult to reconcile with the accusatory narrative.