Article 13 GDPR (Data Protection Act 2018)

Umkomaas

abedegno wrote: »

Hmm, I did number them but they didn't copy across properly. Let me try again.

That looks great and will hopefully focus them!

spook104

So I made a request to Horizon.

The request included my name and registration plate and I asked them to email or post me the information I had requested.

I received an email back stating they could not complete the request until I had proved who I am by providing photo graphic id, a utility bill and a copy of my v5.

This seems wrong to me as they are asking me to provide more personal information as proof of ID than they actually hold on me.

I would understand the request a little more if I had said only email the information to me but I said post it to the address you already have. Also the I'd still be entitled to find out what data they held on me even if I had sold the car as the (AFAIK) so why the v5.

What should my next step be? I don't wish to give them any more data. I understand they can ask me to prove who I am, but surely just confirming the address they already have would be sufficient?

Thoughts/Advice please?

Castle

spook104 wrote: »

What should my next step be? I don't wish to give them any more data. I understand they can ask me to prove who I am, but surely just confirming the address they already have would be sufficient?

Thoughts/Advice please?

How about contacting DVLA and getting them to confirm, (for free), the RK details for your vehicle(s); so that you can provide the parking companies with a copy of the DVLA letter when you submit your SAR:-
https://www.gov.uk/request-information-from-dvla

Wiseguy

spook104 wrote: »

I would understand the request a little more if I had said only email the information to me but I said post it to the address you already have. Also the I'd still be entitled to find out what data they held on me even if I had sold the car as the (AFAIK) so why the v5.

What should my next step be? I don't wish to give them any more data. I understand they can ask me to prove who I am, but surely just confirming the address they already have would be sufficient?

Hi, Recital 64 of the GDPR states that controllers must use all reasonable measures to verify the identity of the person making the request. I would expect that all data controllers will require some kind of evidence of identity and a driving licence / passport plus a utility bill would be sufficient. I would agree the V5 is not of any relevance because as you say, the car could have been sold or you may have changed the name of the registered keeper which would be a breach of data on your part if you did that - I'm guessing the only way they would know if you are lying is if they requested the car's details again from the DVLA but sounds like a fishing expedition to me.

The disclosure of your identification information is a further collection of your data but it is only for the purpose of verification, so once you've been verified I'd be inclined to make a request for erasure of that information on the basis it is no longer needed.

DW190

Castle wrote: »

How about contacting DVLA and getting them to confirm, (for free), the RK details for your vehicle(s); so that you can provide the parking companies with a copy of the DVLA letter when you submit your SAR:-
https://www.gov.uk/request-information-from-dvla

The "Subject Access Request" address is :

SubjectAccess.Requests@dvla.gsi.gov.uk

The address you posted directs you to the paid for enquiries.

Castle

DW190 wrote: »

The "Subject Access Request" address is :

[EMAIL="SubjectAccess.Requests@dvla.gsi.gov.uk"]SubjectAccess.Requests@dvla.gsi.gov.uk[/EMAIL]

The address you posted directs you to the paid for enquiries.

You need the "Information about you or your vehicle" section, (which is about half way down the page).

IconHash

Did some reading and found out that you do not need to make a request via post. Companies must provide a way for you to do it electronically (By phone or E-mail). I called UKCPS earlier requesting my info and they said they only accept letters, i told them it is a requirement (section 15) that they allow me to do it via E-mail or over the phone, the lady said they only allow by post.

I contacted the ICO and explained the situation to them, they said i was correct and that they have to allow me to make a request electronically, i was told to call back again record the call and give them another chance to accept the request and explain it was a requirement. He said i would need the recording as evidence when i made the complaint.

I'm filling a complaint with the ICO over UKCPS violating the terms of GDPR as we speak!

abedegno

Indeed, as per ICO website here:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/
A subject access request is valid if submitted by any means.

I intend to make a subject access request written in my own feces...

Coupon-mad

Useful to know they have to allow an email SAR. UKCPS never supply an email addy so this will force them to do so.

Noree

NGP Ltd seem to have their privacy policy in place. Might have to SAR by email. Other than the template on this thread, does anyone know of any other email template examples?

https://www.ngpltd.com/privacy