SAR-NCS-CCRC
The Case File > legal-correspondence
📎 Transparency Note – Provenance, Integrity and Archival Status of the PDFs
This page reproduces, for purposes of defence, research, and procedural transparency, two official PDF documents obtained through lawful disclosure and preserved under the archival standards applied throughout this dossier.
Both files originate from institutional sources and are included to ensure that the factual record remains accessible, verifiable, and available for contestation‑proof analysis. Their presence enables a coherent reconstruction of events and supports the exercise of the right of defence.
Both files originate from institutional sources and are included to ensure that the factual record remains accessible, verifiable, and available for contestation‑proof analysis. Their presence enables a coherent reconstruction of events and supports the exercise of the right of defence.
📄 Permitted Use and Restrictions
The PDFs published on this page are authorised exclusively for study, research, evidentiary reconstruction, and public‑interest scrutiny.
Any use outside these permitted purposes — including legal use against this website or its owner — is strictly prohibited.
The documents are provided solely to support transparency, procedural review, and the safeguarding of fundamental rights.
Any use outside these permitted purposes — including legal use against this website or its owner — is strictly prohibited.
The documents are provided solely to support transparency, procedural review, and the safeguarding of fundamental rights.
🧾 Scope of the Page
This page presents a structured analysis of the Criminal Cases Review Commission’s (CCRC) handling of a Subject Access Request (SAR) submitted by Mr Riccardo Gresta on 24 August 2025.
The assessment examines procedural compliance, cross‑border jurisdiction, data‑retention practices, and the Commission’s recognition of EU legal frameworks.
As stated throughout this dossier:
The assessment examines procedural compliance, cross‑border jurisdiction, data‑retention practices, and the Commission’s recognition of EU legal frameworks.
As stated throughout this dossier:
“The documents published herein are indispensable for the reconstruction of the facts and for the exercise of the right of defence.”
📌 Contestation‑Proof Statement
“The publication of the documents was formally announced in my submissions to the Criminal Cases Review Commission and in the correspondence issued by my legal representative. No objection was raised by the CCRC, nor in any subsequent communications or determinations. Accordingly, the publication proceeds in line with what had already been notified and without opposition from the Commission.”
The CCRC Case – Procedural Review and Jurisdictional Clarification
This page documents the procedural and legal implications of the CCRC’s handling of the SAR, grounded in:
- UK GDPR
- Data Protection Act 2018
- EU GDPR (Art. 3(2))
- European Convention on Human Rights (ECHR)
with particular attention to cross‑border data governance and institutional accountability.
1. Timeline of Events
- 24 August 2025 – SAR formally submitted (Ref. S20220279 / 00071‑2024)
- 27 August 2025 – SAR dispatched from Italy
- 23 September 2025 – Statutory one‑month deadline expired
- 24 October 2025 – CCRC issued a reply to Italian counsel
No acknowledgment, interim communication, or partial disclosure was provided.
No lawful justification for delay or extension was communicated, contrary to Art. 12(3) UK GDPR.
No lawful justification for delay or extension was communicated, contrary to Art. 12(3) UK GDPR.
2. Requested Materials
The SAR sought:
- the complete case file
- conviction documentation (Lewes Crown Court, 22 December 2022)
- correspondence with legal representatives and public bodies
- internal notes, annotations, metadata
- procedural records and notices of representation
All items qualify as personal data under Art. 4(1) GDPR.
3. Legal Duties of the CCRC
As a public authority and data controller, the CCRC must ensure:
- timely responses (Art. 12(3) UK GDPR; s.45 DPA 2018)
- free‑of‑charge access
- transparency regarding processing
- justification for exclusions
The absence of acknowledgment and the delayed response constitute prima facie non‑compliance.
4. Human Rights and Procedural Fairness
Failure to disclose relevant documentation interferes with:
- Art. 6 ECHR – fair trial
- Art. 8 ECHR – privacy and access to personal records
Withholding data without justification undermines procedural guarantees essential for challenging a conviction.
5. Cross‑Border Jurisdiction and EU GDPR Applicability
Because Mr Gresta resides in Italy, the CCRC’s processing engages:
- Art. 3(2) EU GDPR
- Italian data‑protection standards
- dual‑framework compliance obligations
The Commission must therefore operate within both UK and EU legal regimes.
6. Recognition of EU Jurisdiction
The CCRC’s reply of 24 October 2025 was addressed to Avv. Paolo Pucciarmati (Rome Bar), without objection to:
- his professional standing
- the declared intent to publish
- the legitimacy of cross‑border representation
This confirms:
- procedural recognition of EU jurisdiction
- applicability of Art. 85 GDPR (freedom of expression and information)
- validity of the SAR under both UK and EU law
7. Data Retention and Accountability
The CCRC stated that physical files are destroyed three months after case closure.
Given the final decision date of 21 July 2025, the retention period expired on 21 October 2025.
Given the final decision date of 21 July 2025, the retention period expired on 21 October 2025.
However:
- the SAR response was issued on 24 October 2025
- no evidence of suspended destruction was provided
- no internal record of preservation was disclosed
This raises concerns under:
- Art. 5(1)(e) GDPR – storage limitation
- Art. 5(2) GDPR – accountability
7 bis. Document Preservation and Evidentiary Reliability
Even assuming (hypothetically) a receipt date of 30 September 2025, the CCRC remained legally obliged to suspend all destruction activities until the SAR was concluded.
Destruction during the pendency of a SAR constitutes a substantial breach of the right of access.
Destruction during the pendency of a SAR constitutes a substantial breach of the right of access.
Any documents later produced:
- after presumed destruction
- without guarantees of integrity
- without traceability
cannot be considered reliable or admissible for defensive verification.
Accordingly, the reconstruction provided by Mr Gresta — based on memory and previously acquired official materials — must be regarded as factual and broadly reliable.
8. Professional Profile and Contestation Rights
The SAR included documentation attesting to Mr Gresta’s professional expertise in:
- data protection
- regulatory compliance
- procedural analysis
These credentials were not disputed.
Given the inconsistencies in the response, it is appropriate to:
Given the inconsistencies in the response, it is appropriate to:
- request clarification
- contest the adequacy of disclosure
- seek redress before supervisory authorities
9. Jurisdictional Clarification and Lawful Disclosure
The CCRC operated within EU jurisdiction when:
- transmitting documents to Italy (27 June 2024)
- responding to a PEC address of a registered Italian lawyer (24 October 2025)
Despite this, the Commission invoked exclusive reliance on UK GDPR, excluding EU protections and denying rights guaranteed under EU law.
At no point did the CCRC object to publication.
Accordingly, Mr Gresta retains full entitlement to:
Accordingly, Mr Gresta retains full entitlement to:
- analyse
- reproduce
- publish
the materials for transparency, public interest, and accountability.
10. Formal Complaint and Next Steps
A formal complaint is being prepared for submission to:
- the Information Commissioner’s Office (ICO)
- the Italian Data Protection Authority (Garante)
The complaint will document:
- the SAR of 24 August 2025
- the absence of acknowledgment
- the continuing non‑disclosure
- the implications for procedural fairness and human rights
📑 Final Remarks
The CCRC’s handling of the SAR reveals systemic issues in cross‑border data governance and institutional transparency.
As a public authority entrusted with safeguarding justice, its failure to respond adequately undermines legal integrity and public confidence.
As a public authority entrusted with safeguarding justice, its failure to respond adequately undermines legal integrity and public confidence.
The documentation published on TheRecordSpeaks.it serves the sole purpose of restoring factual clarity, defending procedural rights, and promoting lawful accountability.
🧾 Civic Observer – Evidentiary Commentary
1. Context of the Requests
Two distinct requests were submitted in August 2025:
- Formal request by Italian counsel for the complete case file
- SAR by Mr Gresta for all personal data
The Commission responded only to the SAR.
2. The CCRC’s Response (24 October 2025)
The CCRC:
- confirmed holding personal data
- disclosed only a subset (application form, internal narrative, Statement of Reasons)
- withheld broader case materials
- invoked s.23 Criminal Appeal Act 1995 to justify non‑disclosure
3. Sources of Information
The CCRC acknowledged receiving information from:
- Lewes Crown Court
- Hastings Magistrates’ Court
- East Sussex County Council
and generating internal documentation.
4. Evidentiary Critique
A dual‑track inconsistency emerges:
- Privacy rights (SAR) → acknowledged and partially fulfilled
- Defence rights via counsel → disregarded
This obstructs the effective exercise of defence rights, particularly given that the CCRC’s decision exhausts domestic remedies.
📌 Civic Observer’s Conclusion
The CCRC chose to respond solely to the SAR, ignoring the broader disclosure request made by Italian counsel.
This selective approach highlights a procedural gap: the Commission recognised data‑protection rights but failed to respect the right of defence through legal representation.
This selective approach highlights a procedural gap: the Commission recognised data‑protection rights but failed to respect the right of defence through legal representation.
The omission strengthens the evidentiary narrative of obstruction and justifies escalation to supervisory authorities and public disclosure of the incomplete record.
Methodological Seal
The evidentiary record preserved on this page reflects a consistent and traceable sequence of institutional actions, omissions, and cross‑border engagements. Each element has been reconstructed exclusively from verifiable correspondence, statutory deadlines, and the Commission’s own communications. The coherence of the documented chronology, combined with the absence of timely disclosure and the lack of lawful justification for procedural deviations, supports a contestation‑proof assessment of the events. The analysis remains aligned with the principles of transparency, accountability, and the right of defence, and is presented in a manner that ensures methodological integrity and factual reliability.
No. | Document Requested in SAR | Document Provided by CCRC | Status | Notes |
| 1 | Full case file (ref. 00071/2024) | ✔ Online application form<br>✔ Internal case narrative<br>✔ Statement of Reasons | Partially provide | External documents and solicitor correspondence omitted |
| 2 | Official conviction record – Lewes Crown Court (22/12/2022) | ❌ Not provided | Omitted | Central to defence; explicitly requested |
| 3 | Correspondence with former defence solicito | ❌ Not provided | Omitted | No communications included or referenced |
| 4 | Documents received from ESCC, CPS, Probation Service | ❌ Not provided | Omitted | CCRC confirms receipt but does not disclose |
| 5 | Requests and responses exchanged with third parties | ❌ Not provided | Omitted | No trace of external interactions |
| 6 | Materials used in final decision | ✔ Decision Pathway<br>✔ Statement of Reasons | Partially provided | Completeness unclear; no supporting attachment |
| 7 | Materials expressly excluded from decision | ❌ Not listed | Omitted | No justification or inventory of exclusions |
| 8 | Internal correspondence (Case Review Manager and Commissioners) | ✔ Included in part | Partially provided | No chronological log; scope unclear |
| 9 | Evidence of SAR receipt and suspension of destruction | ❌ Not provided | Omitted | No confirmation of internal handling or safeguards |
| 10 | Legal basis and details of data sharing with third parties | ❌ Not provided | Omitted | CCRC confirms sharing but offers no documentation or rationale |
| 11 | Response to declared intent to publish | ❌ No objection raised | Implicitly accepted | No challenge to publication stated in SAR or reply |
Procedural Closure – Status Recorded
This notification was formally issued to all relevant entities, who were offered the opportunity to provide clarifications or counter‑documentation. As of the present date 21 February 2026, no objections, corrections, or alternative factual reconstructions have been submitted. The notification phase is therefore considered procedurally closed. A right of reply remains available, but any late submissions will not alter the factual framework established during the notification period.
The Record Speaks
