how does GDRP effect parking?

ladaowner55

I noticed that the signs in my car park state

By enter this car park you agree to have your personal data processed and we will use this to hound you for the debt.

I've 2 issues

1) only the driver could ever agree to that, not the owner.

2) ICO says permission must be obtained in written, verbal and not by silence?

Taken from the ICO where they don't meet this requires

We have checked that consent is the most appropriate lawful basis for processing.

We have made the request for consent prominent and separate from our terms and conditions.

We don't use pre-ticked boxes or any other type of default consent.

We give separate distinct options to consent separately to different purposes and types of processing.

We name our organisation and any third party controllers who will be relying on the consent.

We tell individuals they can withdraw their consent.

We ensure that individuals can refuse to consent without detriment.

We avoid making consent a precondition of a service.

Umkomaas

All to be tested, no doubt.

But I don't expect the DVLA or the ICO to be bending over backwards to assist the little man in all this, not when they risk the corporate wrath of the private parking industry and its hangers-on.

beamerguy

The new GDPR is as ambiguous as the DVLA

From what I have read and seen on TV, even the
ICO appear to be clueless in the interpretations

In short, government and their departments
are a complete shambles

Hot_Bring

As others have said, entirely untested as yet BUT there is some possible fun to be had. If you've ever had an invoice from any of these scammers it would be funny to send them a Subject Access Request about what data they hold on you and who they've given it to. If nothing else it will cost them some time .... at best if they don't comply then it's ICO time

nosferatu1001

They don't rely on consent when requesting keeper details

ladaowner55

Hot_Bring wrote: »

As others have said, entirely untested as yet BUT there is some possible fun to be had. If you've ever had an invoice from any of these scammers it would be funny to send them a Subject Access Request about what data they hold on you and who they've given it to. If nothing else it will cost them some time .... at best if they don't comply then it's ICO time

Already done just that and because it is council land so asked them too. Lets see what happens. Council have a legal requirement to check all contractors comply with GDRP, so sent them a FOI asking them to show me where they checked the parking company and to what standards.

Working for another government company I know they wont have done this because we haven't

ladaowner55

I was on a GDRP course last week and the trainer had a quick look and said those were the main points.

This is most damming of all you must word "You have the right to have your data removed" and it does not. It says email here for data concerns, not good enough in my limited knowledge.

The sign says full terms and conditions on web site or phone number not good enough. ***. I how can I make a decision without the full T&Cs at hand on the date in question. I have no phone or internet so no access to the full T&Cs

ICO says avoid making consent a precondition of a service. **** I want to park without give you consent to my personal data

ICO says name your organisation and any third party controllers who will be relying on the consent. **** They just listed back end systems, payment systems, law enforcement. I need names like paycom6, Avon police, Bristol Council, so I can chase them to see if they comply.

ladaowner55

correct about DVLA but to process my data they must now have my consent. DVLA might be able to supply them my name and address but don't mean they can process it?

Coupon-mad

Tomorrow is June 1st and the forum suggestion is DVLA and PPC SAR/complaint bombs by EVERYONE this month, and onwards:

https://forums.moneysavingexpert.com/discussion/5849784/june-2018-start-of-the-new-ppc-and-dvla-fightback-gdpr-related

Suggested wording for SAR or DVLA complaint gratefully received because the (snowflake, can't write a letter) element of the British public always want a darn template these days.

steve1500

A PPC does not need consent to process your information, they can rely on "In their legitimate interests"


There are one or two exemptions, but highly unlikely that it would apply for invoices

However you get them under the fair processing notice Article 13 of GDPR

Coupon-mad

I'm concentrating more on the DVLA using automated decisions to release data and not informing a registered keeper.

As well as a SAR to every PPC.