Remaining anonymous

UoN

Hi all

I have received a civil parking notice today for parking at work without a permit! A lovely Christmas gift form my employer and the car parking partnership.

The good news is its not my car :-) and the owner is happy to toe the line.

My question is - can my employer provide the third party with my details if they happen to have my registration on file from the old parking system?

Thus proving I was the driver in conjunction with my clocking on times?

Thanks in advance for your comments

HO87

That could represent an unlawful disclosure of personal data. The PPC might try to claim an exemption under s.35 DPA but there is ample evidence in the public domain that the likelihood of them genuinely contemplating proceedings is negligible when what they are far more likely to be doing is simply passing the matter to a debt collector. I do not see that doing that would be covered by s.35.

Trebor16

The application made under section 35 can only be made by an individual who seeks information to assist them with seeking legal advice or for the purpose of or in connection with any legal proceedings. As the PPC are not an individual and the information they would be seeking would not be personal information then they would not be able to use this section to obtain this information.

HO87

Trebor16 wrote: »

The application made under section 35 can only be made by an individual who seeks information to assist them with seeking legal advice or for the purpose of or in connection with any legal proceedings. As the PPC are not an individual and the information they would be seeking would not be personal information then they would not be able to use this section to obtain this information.

But s.35 does not in anyway limit who may seek to use the exemptions it provides? Even if it did, and limited it to a "person" then a limited company (and other entities) is a "person" for legal purposes.

Trebor16

HO87 wrote: »

But s.35 does not in anyway limit who may seek to use the exemptions it provides? Even if it did, and limited it to a "person" then a limited company (and other entities) is a "person" for legal purposes.

But they would still be able to seek personal information relating to themselves and the name and address of an employee of a company would not come under that.

Alexis27

If your employer is running a DIY ticketing scheme, they'll be a bloke in a portakabin who just sends a bunch of reg number to the 'Car Parking Partnership' once a month. He may do some sleuthing and add your name and home address if he's that much of a sad loner, but whether you or the keeper receive junk mail from them, they are one of the easiest PPC's to stick a metaphorical two fingers up at and ignore away.

HO87

Trebor16 wrote: »

But they would still be able to seek personal information relating to themselves and the name and address of an employee of a company would not come under that.

I think you might have misunderstood what the purpose of s.35 is.

It establishes that the normal rules that apply to the non-disclosure of personal data that an organisation holds on its staff, customers etc may (important word) be waived where the application for them to be disclosed is in furtherance of legal proceedings/legal advice or the settling of legal rights (there or thereabouts). It is not an extension of s.7.

In the scenario the OP paints one could well imagine a PPC approaching the OP's employer formally applying for details they may have in their records that would enable them to identify the driver of a vehicle ABC 123 at a particular point in time in order that they could issue civil proceedings. The employer could legally disclose those details to the PPC relying on s.35 to cover the disclosure.

The point that I was making was that so infrequently do PPC's issue proceedings and so doubtful are their cases, in any event, that I suspect that an argument could be constructed that would knock the bottom out of the legality of their application (that it, in essence, told "porkies") and the disclosure. The exposure a data controller has in this situation is such that many will tell an applicant to "sling their hook" and to obtain an Order that they make the disclosure before they will do so. At the end of day s.35 only says "may" (as I have pointed out).

Trebor16

HO87 wrote: »

I think you might have misunderstood what the purpose of s.35 is.

It establishes that the normal rules that apply to the non-disclosure of personal data that an organisation holds on its staff, customers etc may (important word) be waived where the application for them to be disclosed is in furtherance of legal proceedings/legal advice or the settling of legal rights (there or thereabouts). It is not an extension of s.7.

In the scenario the OP paints one could well imagine a PPC approaching the OP's employer formally applying for details they may have in their records that would enable them to identify the driver of a vehicle ABC 123 at a particular point in time in order that they could issue civil proceedings. The employer could legally disclose those details to the PPC relying on s.35 to cover the disclosure.

The point that I was making was that so infrequently do PPC's issue proceedings and so doubtful are their cases, in any event, that I suspect that an argument could be constructed that would knock the bottom out of the legality of their application (that it, in essence, told "porkies") and the disclosure. The exposure a data controller has in this situation is such that many will tell an applicant to "sling their hook" and to obtain an Order that they make the disclosure before they will do so. At the end of day s.35 only says "may" (as I have pointed out).

I fully understand section 35 and I dispute what you say about a PPC being able to approach a company and ask for personal details relating to an employee. The PPC can only ask for information which relates to themselves from the employer, not personal data relating to another individual. For the employer to provide the personal data of an employee in such circumstances would be a breach of the DPA.

Section 7 states the following:-

Right of access to personal data.

(1)Subject to the following provisions of this section and to [F1sections 8, 9 and 9A], an individual is entitled”
(a)to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b)if that is the case, to be given by the data controller a description of—
(i)the personal data of which that individual is the data subject,
(ii)the purposes for which they are being or are to be processed, and
(iii)the recipients or classes of recipients to whom they are or may be disclosed

The data being requested by a PPC would not be personal data relating to themselves so even if they made a request under section 35 for the data, as it is not personal the data controller would not be obliged to provide it to the PPC.

HO87

I am always loathe to take issue is in this way but I am afraid your understanding of the law is incorrect.

The data held by an employer, a data controller, about its employees will contain "personal data" - that is data about their employees that meets the definition set out in s.1(e) DPA. As a consequence that company is under a duty (amongst other things) not to disclose any of that data to other parties unless they are permitted to do so as a result of their ICO registration or as otherwise permitted by the Act.

The circumstances under which a data controller may disclose the personal data they hold are tightly defined and are known as exemptions (to the general requirement not to disclose it at all). Exemptions are fairly commonsense - national security, crime, and by order of a court. However, - as s.35 allows - if a data controller is approached to disclose "personal data" it holds then it may disclose that data if it is satisfied that the disclosure is to enable the person/body/company applying for it to pursue legal proceedings (usually against the person the "personal data" of whom they are applying for) or to enable them to establish their legal rights. In this context "personal data" is as defined and does not simply mean data that is personal to the applicant.

This is the very route that PPC's are able to exploit in obtaining details of vehicle hirers from car rental companies. They have no authority to require it be disclosed to them but s.35 enables them to apply on the basis that they require the data, inter alia, to pursue proceedings and that is how they are obtaining it.

Trebor16

I'm sorry, but your intepretation of section 35 is totally wrong.

Section 7 allows an individual to ask any organisation to give details of any personal information held by that organisation about them as an individual. The organisation can refuse the request if any of the exemptions under section 29 apply.

The individual can then make a request under section 35 if they require information for the purpose of seeking legal advice or any form of legal proceedings.

Note it is the individual who can ask.

A company such as a PPC cannot use section 35 to obtain personal data about an individual, they can only use it to obtain personal information about themselves.

The example you give of obtaining driver details from car hire companies is not a very good one. These companies will usually pay the PPC and then bill the hirer, as per the rental agreement, so the PPC doesn't even have to worry about obtaining the hirer/driver details from the car hire company.

HO87

Trebor16 wrote: »

I'm sorry, but your intepretation of section 35 is totally wrong.

I'm very sorry that you think so but before we embroil ourselves in an extended exchange I would respectfully suggest that you have got yourself hung up on the definition of the term "personal data". As I pointed out in my earlier post this phrase has a very specific legal definition set out in s.1(e) DPA - read here. The term - in the context of s.35 - does not simply mean data that is personal to the applicant it means personal data of any kind.

Otherwise, presumably, when a doctor disclosed a copy of a patient's records to his own (the doctor's) solicitors via s.35(2) in the case of Mensah v. Jones [2004] EWHC 2699 (Ch) (Para 11 being relevant) the High Court was entirely mistaken in ruling that the doctor's disclosure was lawful?