Privacy policy/data protection act

[Dark Orb Choir]

The gf complained to our local council about the noise from the yearly valentines funfair which is situated on council land. She did this by filling in a webform on the council website.

She gets a phone call from the man who runs the fair and he asks what the problem is, thing is the bloke who runs the fair does not work for the council, he says someone from the council gave him her name address and phone number.

this seems a bit off to me, surely no one from the council should give out details entered on the complaints webform to an external person, is this breaking the data protection act or the councils privacy policy Privacy statement)

Whats the best i can hope for, outside of an apology, as it just seems they dont give a fuck about peoples data.

 

[taB]

Sue the bastards claiming mental anguish from the guy having rung you.

I'm anti compensation culture but I dislike inept, lazy and useless council twats more.

 

[DaGaffer]

Yeah, definite breach. Go here. Typical council, first to hide behind the DPA when it means they don't have to get off their fat arses to help you.

On the other hand, your gf complained about the noise from an annual event? How miserablist is that?

 

[TdC]

that's a bit strange. best ring your council imo, and ask them what they're about.

 

[Scouse]

Whats the best i can hope for, outside of an apology, as it just seems they dont give a fuck about peoples data.

Honestly, in this case I think your first port of call should be a lawyer. Definite breach of the DPA. What if this guy had decided that the best course of action for him was to come round and threaten your bird for making a complaint.

Having said that, I think your g/f must be a miserable cow for complaining about something that happens once a year...

 

[Tom]

FFS compensation for that? Bollocks to a lawyer, go see your MP and get whoever was responsible told off. You've not suffered, nobody has been harmed, it's cost you nothing.

 

[Chilly]

Its entirely reasonable to pass the information on. Now, if a double glazing salesman called you about it, THATS a breach.

And again: miserable wench.

 

[Scouse]

Its entirely reasonable to pass the information on. Now, if a double glazing salesman called you about it, THATS a breach.

How do you justify passing on information about a noise complaint to a carnie? What makes a man who runs a fair more responsible than a double glazing salesman?

As for why you should sue for compensation - I'm not a money grabber - but councils won't do a damn thing about data protection unless it hurts them in the pocket.

 

[Krazeh]

Tbh I wouldn't be so sure about it being a breach of the DPA. There's an argument for it being within reasonable expectations that the Council would pass details of any complaints to the event organiser for him/them to deal with, especially as it's a non-council event that just happens to be run on council land. Furthermore it's unlikely they would need your girlfriend's explicit consent before passing her details on, and it's probable they'd be able to satisfy at least one of the other conditions for processing in this case.

You should also note that even if they had breached the DPA then the most the ICO is likely to do is write to the Council to tell them not to do it again, and that will only be after your case finally gets to the top of the ICO backlog which is usually several months long. Oh and unless you've suffered quantifiable damages you'd get nowhere trying to make a claim for compensation under the DPA.

 

[DaGaffer]

Its entirely reasonable to pass the information on. Now, if a double glazing salesman called you about it, THATS a breach.

And again: miserable wench.

No its not. Not unless she made an explicit opt-in to allow her details to be passed on, and even then the council has to maintain a specific "whitelist" of allowed contacts. I'm thinking one-off carnival organisers aren't in that list. The council should act as an intermediary in the complaints process. I'm not a big fan of many aspects of the DPA, because I think its used by lazy organisations (particularly in the public sector, ironically) to shirk responsibility for doing their job, but this case is exactly the kind of thing it was designed for!

Edit. As Krazeh says, compensation is unlikely (and unnecessary imho), but it should still be reported. Next time details could be passed to someone rather more unscrupulous.

 

[Krazeh]

Not unless she made an explicit opt-in to allow her details to be passed on

Not necessary before passing her details on.

even then the council has to maintain a specific "whitelist" of allowed contacts.

No they don't

The council should act as an intermediary in the complaints process.

Only if they chose to do so, they're not under any DPA obligation to do this however.

 

[DaGaffer]

Not necessary before passing her details on.

Yes it is. This is pretty much the key obligation of the DPA. Passing on to third parties isn't necessarily against the DPA but (from the ICO guidelines) "Where an organisation is satisfied that as someone asking for information about another person’s details is authorised to access it, the Act does not prevent this" How the hell would a carnival organiser be seen as an authorised person?

No they don't

Yes they do. I've been in a situation where we've been audited by the Information Registrar after a customer complaint, and they demanded a clear list of who and how we passed info on.

Only if they chose to do so, they're not under any DPA obligation to do this however.

True, but then they have two choices; hide behind the DPA themselves (standard practice), or ask each party if they want to talk directly to each other. However, since the council has a complaints process, this kind of implies they take a responsibility for actually dealing with complaints! Not just randomly give people's details out.

 

[Dark Orb Choir]

Just got a call from the person in charge of the council "events" team, it was her that advised someone to give my details to the co proprietor of the funfair.

She appologised and i got the impression she wanted me to leave it there, she rang me from a mobile which suggests she was in the toilet ringing me so no one else would here what she was saying.

I said i wanted to take it further so she said she would contact the council legal services team and they would call me today.


And the GF isnt anti funfair and is not a not in my back yard kind of person, its just the fair last 10 days and this years its got must larger and the noise is really noticeable, so much so that my son cant get to sleep (fair finishes at 10.30 pm)

If i don't hear amything by tomorrow ill ring the local paper and see what they say about it.

 

[rynnor]

I'm amazed at the stupidity of the council worker - if you get any further consequences that you believe are as a result of this complaint then you'd have very good grounds to sue them.

As it is I would definately complain to all n sundry - this episode seems to indicate that the council arent training their staff properly in regards to their statutory duties under the Data Protection Act.

This could have turned out very messy and still could tbh.

 

[Chilly]

quick, lets bog down councils with pointless moanings so they dont have time to work on the boring stuff like balancing budgets and paying the police!

 

[taB]

quick, lets bog down councils with pointless moanings so they dont have time to work on the boring stuff like balancing budgets and paying the police!

Yes, lets. Most council workers do fuck all and get superb pay and benefits.

 

[Krazeh]

Yes it is. This is pretty much the key obligation of the DPA.

Not really, the key obligation of the DPA is to comply with the 8 principles. None of these principles are more or less a key obligation than any of the others.

Passing on to third parties isn't necessarily against the DPA but (from the ICO guidelines) "Where an organisation is satisfied that as someone asking for information about another person’s details is authorised to access it, the Act does not prevent this" How the hell would a carnival organiser be seen as an authorised person?

I'm not sure which specific piece of guidance you've quoted from there but it must be remembered that the guidance is general advice about the DPA and in most cases does not cover every specific scenario.

In this case it's an issue surrounding the first principle which requires that individuals are made aware of how and why their data will be processed, and that the organisation has met at least one of the conditions for processing, except in the case of sensitive personal data where they also have to meet at least one of a number of additional conditions.

Now there is an argument that it's a reasonable expectation that the Council would pass on details of any complaints to the events organiser, especially as it wasn't a council run event. However I do appreciate that not everyone would agree and that there may have been a case for the Council to have been clearer about the fact it would be making that disclosure.

With regards to the issue of consent there's nothing in the first principle that requires consent to have been obtained before personal data is processed, which would include disclosing it to third parties. Consent is only required in cases where an organisation cannot satisfy any of the other conditions for processing. From experience organisations were usually able to satisfy 2 or 3 conditions for processing in most cases but asked for consent either because it was deemed easier or because they were required under other legislation or regulatory regimes.

Yes they do. I've been in a situation where we've been audited by the Information Registrar after a customer complaint, and they demanded a clear list of who and how we passed info on.

I must admit I've never been audited by the ICO nor attended an ICO audit but having read the results of several audits I don't recall there being much in them about asking the organisations to provide lists of everyone they disclose information to. Certainly I don't ever recall seeing an organisation having to specifically detail the exact organisations/people they disclosed to and it was usually done in terms of types of organisations/people i.e. local councils, NHS Trusts, Police Forces, Credit Reference Agencies etc.

Also any list asked for would surely only be for those disclosures that were routinely expected to take place. An organisation would be unlikely to be asked about who they may make disclosures to on a non-routine basis as they would not know until the actual situation arose.

True, but then they have two choices; hide behind the DPA themselves (standard practice), or ask each party if they want to talk directly to each other. However, since the council has a complaints process, this kind of implies they take a responsibility for actually dealing with complaints! Not just randomly give people's details out.

Perhaps in this case the Council should have made it clearer that they were going to pass the details across to the Event organiser but I still disagree that the Council were in any way required or obliged to act as a complaint handler or intermediary. Just because they have a complaints process doesn't mean they have to deal with complaints about issues over which they don't really have much control.

On a final note I just want to add that having worked for the ICO I've seen similar cases to this, i.e. people complaining to the Council about a third party who has a relationship with the Council and then the Council having disclosed their details to the third party, and cases were found in favour of the Council.

Further even in cases where the ICO found against an organisation the initial remedial action was simply to contact the organisation to make them aware it was unlikely they had complied with the DPA and to tell them what they should do in the future to make sure they did comply. Nothing more was done by the ICO and nothing more would be required by the organisation apart from confirming they had put in place what ever changes had been suggested.

 

[Sar]

The local council's Health & Environmental section should have dealt with this and investigated it as a complaint and got back to her with the outcome, and not passed her details on to the carnie without her say so.

It's a blatant breach of the DPA.

I work for my local council, and we'd get completely bollocked over something like this.

Passing on a resident's name, address and phone number to a 3rd party without consent? Especially to the person the complaint is about?

Sorry, but the breach couldn't be more obvious. And I've been dealing with the DPA for 15+ years.

The council have a duty of care to their residents first and foremost, and she should be making a complaint directly to the head of service or CEO's office pronto.

From their website:

Generally we will not share your information with outside parties unless we have to legally or where the law allows this.

They had no need to legally, as I said earlier their Environmental Health officers should have dealt with this first hand and reported back to her.

 

[Sparx]

I used to work in HR before IT and had dealings with DPA. It is blatantly obvious that they shouldnt have given any details like address and contact numbers to anyone, especially someone at the aim of a complaint.

What would happen now if their house gets torched now? would it be then that the council is at fault for giving out that info, of course it is

 

[Dark Orb Choir]

Just been told the bloke from the council legal services team that deals with freedom of information / IT type stuff is going to ring me back today.

 

[TdC]

yay result! don't let him wiggle out

 

[Dark Orb Choir]

the sarcastic bloke from the council was almost laughing at me for my temerity to even bring thus complaint up.

he says that he thought it was perfectly reasonable for the funfair operator to be given the gf's details as this was the quickest way to get the complaint sorted out, he said it was not a breach of the DPA

i have to email him with my complaint and he will email me back with his reason why he thinks its not a breach.

 

[TdC]

ah what a cockbadger! remember to be as clear and precise as you can, preferably with actual times and people spoken to. try not to get annoyed or anything eh

 

[Sparx]

never swear either, customer service people love it when you do, means they are winning and will hang up and blame it on a too agressive customer

 

[Zenith.UK]

i have to email him with my complaint and he will email me back with his reason why he thinks its not a breach.

So the first stage of the complaints procedure will have been satisfied, and since you're not satisfied with the outcome you'll be escalating it over this fuckwit's head.

Wash, rinse, repeat until acceptable result.

 

[inactionman]

What the bloke from the council told you is complete bollox. I've worked directly on information sharing projects in the public sector, giving advice on this kind of thing (never been proven wrong, even by the favourite 'specialist lawyers' in this area Pinsent Masons) and they need consent to share information with anyone outside the council, unless it's covered by a statutory power (which this isn't), although this may change with the introduction of the ludicriously broad information sharing powers in the proposed coroners bill. Hell they need consent to do use the information within the council for any purpose isn't set out when they ask for the information. All they should have passed on is that there's a complaint, and the nature of it, nothing about the complainant.

Bear in mind that they'll close ranks and try to stonewall you, don't be surprised if all records 'magically disapear' or they never receive anything if you don't use registered post. Get a record that proves their was a phone call from the guy who runs the fair from the phone company. Make a subject access request for all the records they hold on you regarding this matter. Make a freedom of information request around their compliants processes (general and environmental).

Then escalate the complaint, make it in writing (registered post is best, and keep copies of everything). Don't accept anything from them if it isn't in writing, ensure that your complaint letter says this (they'll try to do things on the phone, less paper trail). Keep escalating your complaint and making a general nuisance of yourself until you get the results you want.

If all internal avenues of complaint are exhausted and they still haven't resolved it to your satisfaction, get your local opposition councillor and the local paper involved (they love this). If that doesn't work copy everything and complain to the information commisioner.

 

[DaGaffer]

Of course you could always do what my mate Darren does and record all your conversations with public officials. I particularly enjoy his conversations with the CSA, especially when they sent him someone else's bank details by mistake...

 

[Zenith.UK]

Yep, recorded phone calls are great fun. Don't you have to tell the person on the other end upfront that you're recording the call?
The new ROM I just flashed to my phone comes with this capability so I'll be trying it out over the next few days.

 

[rynnor]

Yep, recorded phone calls are great fun. Don't you have to tell the person on the other end upfront that you're recording the call?

Yes you do but the trick is to say it quickly right at the start of the call when they are probably saying their standard starter bit as they are unlikely to hear what you said properly - move straight onto your first question - seamless

 

[Dark Orb Choir]

change of tack by the bloke from the legal services department,after he told me if i emailed in to say what my complaint was, and him telling me straight that there was no breach, but he would reply back to my email with the reasons there was no breach.

i get this


Dear Richard,

I am writing to acknowledge receipt of your e-mail below. I am getting the full background details of this matter from the events team, and once I have these I will in a position to give you a full response. I anticipate being able to respond to you by the end of this week.


now, after reading inactionmans post (thanks) i am going to email him back saying i would like the his responce in writing. ??????



i am not really interested in any compensation, apparently the gf cant get any as she is just distressed, its all about the careless attitude of the council, plus the guy i spoke to form legal services spoke to me like i was something he had trodden in.


.