And to this day no one knows where that guitar disappeared to at the end

I’m especially ticked off that he likes Au Hasard, Balthazar, as that’s been my go-to pseuds-cornerish answer to “what’s your favourite film?” for 35 years. Now I have to find another one

Kate, I don’t even mind (all that much) the lack of holding to account - it’s the failure to take the opportunity to educate the public about something that has happened much too often, and puts lives at risk

Yes, the LAA (or, strictly, the MoJ, given that the former is an executive agency of the latter) will be a controller

Certainly in the event of a regulatory investigation, or a legal claim by an affected individual, they would need to justify the retention, and if they couldn’t do so, they would be in breach of UK GDPR storage limitation principle

As to why they were still holding the old data, that’s less a data protection question (there, the law just says “don’t hold for longer than you need to”) and one around any specific legal aid laws/guidance or LAA’s own policies

As a matter of law, if the LAA assesses that this presents a likely high risk to data subjects it must inform them itself, “in clear and plain language”, giving them a contact point, describing likely consequences and the measures being taken to address and mitigate the breach’s adverse effects