Article 13 GDPR (Data Protection Act 2018)

abedegno

jackfrost1 wrote: »

I do wonder how the PPCs have set themselves up to deal with GDPR.

I wonder if it would be possible to bury them under so many Data Subject Access Requests that they cannot meet them? (ie requests from you and me to see what they hold/how they process our data)

The deadlines are quite strict and there is the potential for harsh penalties if they are found not to be compliant.

They have probably done nothing, or very little - in common with most companies or public bodies (who are not exempt). Law enforcement is slightly different, there is a separate little-known set of rules called the "Law Enforcement Directive" which EU member states should have signed into law on the 6th of May, but the UK instead rolled this legistlation into the Data Protection Bill alongside EUGDPR.

The big change between the DPA and DPB/EUGDPR is that Subject Access Requests no longer carry the £10 fee - so if a sufficiently large entrepreneurial group of people could indeed orchestrate the submission of a large number subject access requests at the same time to a PPC. There is a caveat in the legislation that allows the data processor to levee a charge if the request is deemed "manifestly unfounded or excessive", so a data subjected sending repeated requests themselves is likely to fall into the category.

To make a SAR request you don't even need to have received a parking notice - simply making use of a free ALDI Parking Eye car park (for example) and being the registered keeper of a vehicle captured on CCTV/ANPR means that the data processor (Parking Eye) hold personally identifiable information that you are entitled to request.

The potential for harsh fines is unlikely to arise except maybe in the most serious circumstances - the ICO is severely underfunded and toothless and doesn't fine anywhere near it's currently permitted limit so it's unlikely to do so after GDPR. If you report non-compliance to the ICO (as I have done) the response from them is that you would need to take the organisation to court for breach.

jackfrost1

I think that caveat is designed to stop one person making numerous vexatious requests.

It would be nigh on impossible for a PPC to claim that multiple subject access requests were part of a concerted group effort

Castle

jackfrost1 wrote: »

The deadlines are quite strict and there is the potential for harsh penalties if they are found not to be compliant.

Section 173(3) now makes it an offence to "alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive"

Computersaysno

abedegno wrote: »

how are they going to record your consent to permit an ANPR camera to capture the license plate of your car

The same way every CCTV operator in the UK [and there are a few of those] will do....

Castle

Computersaysno wrote: »

The same way every CCTV operator in the UK [and there are a few of those] will do....

But you don't normally enter a "legal" contract when you pass a CCTV camera, well I hope not!

abedegno

Looks like Parking Eye have updated their privacy policy:
https://www.parkingeye.co.uk/privacy-policy/

They have a phone number with a recorded message detailing the privacy policy - 0333 1235 984 :-)

pysspd

HX Car park management give the following on their web site in their response to GDPR ...

'1) If parked within the terms and conditions of the car park for the full duration of your stay

As a compliant user of our privately managed car parking site, the personal data we obtain is your registration number. We may capture images of the vehicle, occupants or bystanders. A full list of your Rights under GDPR are summarised above. Where your data is obtained it will be retained for 3 months only. We then erase your registration and any other images from our records.'

I can see no legitimate interest in holding these data for three months if a 'compliant' user of their 'facilities'. From tomorrow I will be sticking in a data request every time I park in an ANPR facility.

abedegno

I'm just finished listening to the parking eye privacy recording - took 5 minutes end to end! I wonder how that works in with grace periods....

abedegno

pysspd wrote: »

From tomorrow I will be sticking in a data request every time I park in an ANPR facility.

Has anyone got a list (latitude and longitude) of parking eye car parks - I'm tempted to write an IPhone app that sends off such a request every time I physically pass into one :-)

Umkomaas

I wonder if it would be possible to bury them under so many Data Subject Access Requests that they cannot meet them? (ie requests from you and me to see what they hold/how they process our data)

SAR bombs are currently being primed!