Can a business legally trace a debtor in the UK?

Parts of the ICO guidance linked below carry notices that they are under review following the Data (Use and Access) Act. Check the live ICO guidance for the current position.

Choosing a lawful basis

Under UK GDPR you need a lawful basis for processing personal data, and the right one depends on your circumstances. Businesses tracing a debtor often consider legitimate interests. When that is the basis you choose, the ICO describes a three-part assessment:

• Purpose — is there a legitimate interest, such as locating a customer to resolve a genuine unpaid account?
• Necessity — is tracing a reasonable and proportionate way to achieve it, or is there a less intrusive option, such as using contact details you already hold?
• Balancing — do the individual's interests, rights and reasonable expectations override yours?

The ICO recommends recording this assessment. Legitimate interests is not always appropriate, and you should not assume another basis, including consent, could never be relevant.

Source: ICO — How do we apply legitimate interests in practice?

Transparency

People generally have a right to be told how their personal data is used, including when you obtain it from somewhere other than them, such as a tracing provider. The ICO explains what information to provide and the limited exceptions that may apply. Tracing without contacting the person does not remove these obligations: Locate’s no-contact service is not an exemption from applicable transparency requirements. Review your privacy information so it covers tracing.

Source: ICO — The right to be informed

Data minimisation, accuracy, security and retention

The data protection principles ask you to use only the data you need, keep it accurate, hold it securely and keep it no longer than your purpose requires. In tracing, our practical recommendations are:

• Send only identity details needed to find the right adult — name, last known address, postcode and date of birth if lawfully held.
• Treat a traced address as indicative and verify it proportionately before relying on it.
• Restrict results to staff who need them.
• Set retention by reference to your purpose, not an arbitrary universal period, and delete what you no longer need.
• Flag concerns to your data protection officer or legal adviser.

Source: ICO — A guide to the data protection principles

A practical pre-trace check

Our suggested routine before each upload:

• The debt is genuine and the person traced is the liable adult
• Existing contact routes have been tried or checked
• The reason and lawful basis are recorded
• Disputes, affordability or vulnerability concerns are handled separately
• Only minimum data is included

Firm boundaries

Locate must not be used for personal curiosity, harassment, locating an ex-partner or relative for personal reasons, or tracing children. RecoverAble Locate is for businesses only, requires a lawful-use confirmation before every upload and is not a consumer people-finding service. See our Terms of Business and Privacy Notice. For practical steps, read our guide to tracing a debtor.

Questions

General information, not legal advice. Your circumstances and data-protection assessment determine what is appropriate.