Do data privacy requirements apply to watch lists and sanctions lists?
<p>There are different sanctions lists and watch lists all over the world maintained by governments &amp; ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA &amp; FBI watch lists and many more. They often contain quite a lot of personal information about name variations, addresses, DOBs etc. which is usually considered as PII (as soon as it allows identifying a person) and should fall into a regulation of GDPR and similar. However, this data is openly accessed and even aggregated by projects like OpenSanctions.</p>

<p>So here's the question -- is it a special exceptional case that data privacy rules do not apply to sanctioned person data, or is it a worldwide violation of data privacy rules (very unlikely)? In a former case, who is authorised to decide that this person's data can be accessed without a restriction?</p>

<p>A more practical question would be, if let's say I want to collect some data about disqualified directors in the UK (<a href="https://beta.companieshouse.gov.uk" rel="nofollow noreferrer">https://beta.companieshouse.gov.uk</a>) or another country, should I apply technical measures in line with the regulation (GRPR for instance) to protect this data in my system (e.g. encrypt it at rest)?</p>

<p>Please advise if it's an off-topic &amp; I should move this question to another hub.</p>

<p>There are a few different grounds under which PII can be handled. Perhaps the most discussed at the moment of GDRP introduction is consent, because of the wave of consent-seeking. But there are a number of other grounds. "Necessary for contract execution" is a trivial one, to deliver a pizza you'll need an address.</p>

<p>The relevant ground for sanctions lists is also pretty obvious in hindsight, you may process PII in order to comply with legal obligations. Note that this is still an integral part of the GDPR, not an exception to the GDPR. That means you need to apply all the basic GDPR rules. You need to explicitly store where you got the PII from, for which purpose, and you need to document how you're using it. </p>

<p>Note that this might be hard - why do you need to <strong>store</strong> this data? Why can't you just check the list as the moment it's relevant? The GDPR for a large part depends on you justifying your actions, not just in hindsight but already up front.</p>

gdpr