POL00288913 - Post office Group Litigation - Decision paper: Deletion of data held on Fujitsu Telecoms

Evidence on official site

POL00288913

POL00288913
CONFIDENTIAL AND LEGALLY PRIVILEGED woNe LE
POST OFFICE GROUP LITIGATION

19 November 2019 DICKINSON

1.4

1.2

24

2.2

23

24

25

3.1

Decision paper: Deletion of data held on Fujitsu Telecoms

SUMMARY

A decision is sought as to whether data held by Fujitsu on Fujitsu systems dedicated to the use
of delivering the Post Office HomePhone and Broadband Managed Services should be deleted
or preserved in light of the ongoing duty to preserve documents which may be relevant to the
Group Action and/or Project Starling.

This question is being raised as part of Post Office's GDPR compliance under which there is a
duty to only retain personal data if needed. It is a legitimate basis under, and an exemption from,
the GDPR to preserve personal data if it is needed for litigation purposes.

FUJITSU TELECOMS

We have been informed by lan Mills of Fujitsu that the data which is sought to be deleted is data
from 2013 onwards which contains the records of Post Office telecom sales. For example, the
product(s) purchased by current and previous customers, customer invoicing details, and
customers personal details (such as address, name, etc). This data also contains the FAD code
of the branch at which the product(s) were sold. As explained further in paragraph 2.3 below, it
is proposed that the FAD code data will be maintained with the remainder of the data being
deleted.

Post Office pay branch agents for any customers who sign up through the branch network
directly or through a referral via online or a contact centre. The FAD code is recorded as part of
a sale and used to reconcile branch sales. Post Office pay the branch for the one off sale and
also as a monthly on going back book basis and the FAD code data is used to generate these
payments.

This FAD code data (which is held within the records that are proposed to be deleted) may
therefore be used for the reconciliation of branch sales which could impact on branch accounts.
However, the FAD code has not been designated for deletion and will therefore be maintained.
Further, the FAD code data is also held in a separate location by FJ. FJ hold a record of the
FAD code against a sales order in their MI Data Warehouse, which is held indefinitely and is
made available to Post Office via MI reporting. This data will be maintained and not effected by
the deletion of data in Fujitsu Systems. This data may also be used for the purposes of
reconciling branch accounts.

We also understand from Fujitsu that there is no additional cost to Post Office maintaining the
data which is proposed to be deleted — the continued hosting of this data would be covered as
part of the fully managed service which is provided by Fujitsu to Post Office.

It should be kept in mind that at this stage the Claimants have not yet pleaded their case on Post
Office's back office reconciliation processes and the scope of their claim is therefore unknown.

RECOMMENDATION
The decision of whether to delete the data needs to be weighed against:

3.1.1 the risk of data being deleted which may be relevant for future trials; and

AC_168873860_1 1
POL00288913
POL00288913

3.1.2 there being no additional costs to maintaining the data for the next 12 month.
3.2 It is unlikely the above data will be needed in the Group Litigation. Given that the Claimants
have not yet pleaded their case on Post Office's reconciliation practices, we cannot rule out the
possibility that this data may be needed or may contain more relevant and probative information
than we are currently aware of. We therefore believe the data should be preserved (with that
decision reviewed in 12 months’ time). This is a highly conservative course of action and thus a
weak (but legitimate) justification for preservation of personal data from a GDPR perspective.
However, even if this step is not GDPR compliant, it is highly unlikely that the ICO would

investigate this matter or take any enforcement action as that would trespassing on Court's
requirements to preserve documents for litigation.

AC_158873860_1