Nutsville on UKPC DPA Breach

Aaron_Aadvark

nigelbb wrote: »

The law in fact does allow anyone to publish photos that they take in a public place as there can be no reasonable expectation of privacy.

But there is a difference between those taken for private or journalistic purposes, and those taken for business purposes.

nigelbb

nigelbb wrote: »

The law in fact does allow anyone to publish photos that they take in a public place as there can be no reasonable expectation of privacy.

Aaron_Aadvark wrote: »

But there is a difference between those taken for private or journalistic purposes, and those taken for business purposes.

No there isn't. Since you believe that there is please point me at the statute.

Aaron_Aadvark

nigelbb wrote: »

No there isn't. Since you believe that there is please point me at the statute.

See the Data Protection Act 1998.

See also Information Commissioner's "The Guide to Data Protection"

Personal data


means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect
of the individual.


Processngin relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including –
(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d) alignment, combination, blocking, erasure or destruction of the information or data.

What needs to be protected by information security aarangements?It is important to understand that the requirements of the Data Protection Act go beyond the way information is stored or transmitted. The seventh data protection principle relates to the security of every aspect of your processing of personal data.So the security measures you put in place should seek to ensure thatonly authorised people can access, alter, disclose or destroy personal data;

Half_way

While i can see a possible issue if the someones name is clearly shown such as on a disabled pass, but the pictures on the nutsville site arent all that clear, and even the photos linked to/displayed elsewhere only show the number plates.
If someone has been on the site and permantly downloaded the photos ( ie saved to my phoos folder) or saved and re-uploaded the photos elesewhere then UKPC may have a shot at breach of copyright ( as as far as i know the person/company taking the photos owns the copyright in those images)

The only other way they could breach the DPA is by listing peoples names/vehicles and how much they (UKPC) think they owe them in unpaid tickets,from what i can gather the ukpc extra site only contained photos or anonymous cars and number plates.
nutsville may find themselves in trouble over copyright, more than UKPC may find themselves in trouble over ( what i see ) as a small website issue, if i was UKPC i would be asking nutsville to takedown 'my' pictures and issue an apology on their website - as well as having strong words with whoever did that website or is (was?) responsable for it.

Much as we all loathe these companys methods of operation, i get the feeling that this "data breach" is all just making a mountain over a molehill.

Stroma

I don't see it like that Half Way, there was a breach and complaints have been made, there can possibly be no breach of copyright as the images were on an open website, and there was no watermarks or security on this.

Aaron_Aadvark

Half_way wrote: »

While i can see a possible issue if the someones name is clearly shown such as on a disabled pass, but the pictures on the nutsville site arent all that clear, and even the photos linked to/displayed elsewhere only show the number plates.
If someone has been on the site and permantly downloaded the photos ( ie saved to my phoos folder) or saved and re-uploaded the photos elesewhere then UKPC may have a shot at breach of copyright ( as as far as i know the person/company taking the photos owns the copyright in those images)

The only other way they could breach the DPA is by listing peoples names/vehicles and how much they (UKPC) think they owe them in unpaid tickets,from what i can gather the ukpc extra site only contained photos or anonymous cars and number plates.
nutsville may find themselves in trouble over copyright, more than UKPC may find themselves in trouble over ( what i see ) as a small website issue, if i was UKPC i would be asking nutsville to takedown 'my' pictures and issue an apology on their website - as well as having strong words with whoever did that website or is (was?) responsable for it.

Much as we all loathe these companys methods of operation, i get the feeling that this "data breach" is all just making a mountain over a molehill.

1.6million photos is quite a large molehill.

Half_way

Aaron_Aadvark wrote: »

1.6million photos is quite a large molehill.

how many?? i still cant see the issue - still maybe this time tommorow things will be clearer.

One thing that puzzles me though - why the interior shots of cars?

nigelbb

Aaron_Aadvark wrote: »

See the Data Protection Act 1998.

See also Information Commissioner's "The Guide to Data Protection"

Personal data


means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect
of the individual.


Processngin relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including –
(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d) alignment, combination, blocking, erasure or destruction of the information or data.

What needs to be protected by information security aarangements?It is important to understand that the requirements of the Data Protection Act go beyond the way information is stored or transmitted. The seventh data protection principle relates to the security of every aspect of your processing of personal data.So the security measures you put in place should seek to ensure thatonly authorised people can access, alter, disclose or destroy personal data;

That's a total red herring. Photographs of cars in a public place are not data which is personally identifiable. The photos on that website do contain some data e.g. photos of permits etc but that is a separate issue.

Aaron_Aadvark

nigelbb wrote: »

That's a total red herring. Photographs of cars in a public place are not data which is personally identifiable. The photos on that website do contain some data e.g. photos of permits etc but that is a separate issue.

From the Information Commissioner's CCTV Code of Practice.

"This code provides good practice advice for those involved in operating CCTV and other devices which view or record images of individuals. It also covers other information derived from those images that relates to individuals (for example vehicle registration marks)."

nigelbb

Aaron_Aadvark wrote: »

From the Information Commissioner's CCTV Code of Practice.

"This code provides good practice advice for those involved in operating CCTV and other devices which view or record images of individuals. It also covers other information derived from those images that relates to individuals (for example vehicle registration marks)."

That's an opinion not statute.

A vehicle registration mark is not personal data beyond the fact that you can in certain circumstances trace the registered keeper of that vehicle. Not the driver & not the owner.