Data Protection and a Naughty Company

FlyingParsnip

Hi - first post but hopefully of use, or corrections if wrong.

As I understand it, in this country (UK), if a website uses cookies or other methods to collect data about you / your computer / other information using analytical software (Google Analytics), then the website MUST by LAW inform you of this.

If they don't, and they collect information or data, then this is a breach of your personal data protection. Also, if the said website in which you put your information in doesn't give you a privacy policy when you input your details in regards to any parking appeal, the again, this is a breach of Data Protection.

So, if a company that sends out invoices for parking charges invites you to use website "x" to either pay or lodge an appeal, but doesn't notify you of the fact they use various methods to collect your data, then they rather possibly could be in the sticky brown stuff with the Information Commissioners Office,

Any thoughts to this?

How many people have entered their details on one of these "parking appeal" websites without any thought to the privacy or protection of the data they are inputting?

Thanks in advance for any replies!

Coupon-mad

Well, I'm no DPA expert but I suppose if people voluntarily input their for an appeal then the parking firm can use that data regarding the unwarranted piece of rubbish they describe as a 'parking charge'. I'm not aware they use it for any other purpose but if they do (e.g. if they use it regarding a different matter) then you might have a case.

Firms that collect data have to be registered with the ICO and are required to only use the data for the *reason* (excuse of a 'charge') it relates to. Most of these rubbishy PCNs also state some old drivel on the back about how to complain to the ICO.

Not sure what misuse of data you have in mind?

FlyingParsnip

Well, I'm referring to the ICO website and their guide to "pecr" - cookies and similar technologies.

It's just that due to recently going through the process of entering an appeal online, I discovered in my network logs traffic going to and from Google Analytics servers and to a different server which stores data in relation to the visit that I made to this website that you put your data into for said appeal. However, having worked in IT long enough to know what you must and must not do regarding data protection and collecting data, the company who owns the website for entering appeal information has not fulfilled the requirements of the data protection act.

My thought would be that in defence to an appeal, they cannot use online methods of capturing your data as they are not in compliance with the data protection act, and as such, due to their breach, their so called parking charges are null and void!

I'm interested to see all responses though!

Coupon-mad

Good stuff - why not put your knowledge to use and submit a complaint/concern about this company to the ICO, explaining it in detail on the online form, with screenshots and your network logs traffic evidence.

Nothing to lose and it costs the PPC money to have to respond to the ICO. All good!

FlyingParsnip

Sure - that is my thought - but it would be interesting to know how many people have posted an appeal online using a particular website, as it could be quite unfortunate for this particular company to have to deal with what I could only imagine a torrent of complaints in relation to them not being compliant with the data protection act.

Do I name and shame said organisation?