Huge Data Protection Breach?

dataprotectionbreach

Good evening

Earlier today I discovered that my car, its number plate and the ticket I was issued have been placed online by a parking company and can be viewed by anyone.

I then discovered that I could access hundreds of other car registrations, tickets, and other personal information from the parking providers website by changing numbers in the url.

I know that we all walk past thousands of cars every day and can see their number plates but am I right in thinking this is a little bit dodgy?

I did my research on the company and due to the expertise of their director, it cannot be an accident that they are so easily accessible.

Should I take any action or am I overthinking this?

KeithP

Report your findings to the Information Commissioner's Office.
Let them investigate.

The_Slithy_Tove

This has happened before, can't remember which PPC. They got into quite a bit of trouble for it.

The_Deep

I did my research on the company and due to the expertise of their director, it cannot be an accident that they are so easily accessible.

I am not sure I understand, do you mean the Companies House information? Which Company?

dataprotectionbreach

The ICO investigation was into Islington Council and resulted in a £70,000.00 fine.

The parking company I am dealing with have done the same as Islington Council.

The evidence I have has been passed to the ICO who are taking the breach seriously.

Due to the large number of people affected by the breach and who's data can be easily accessed by anyone, it would be inappropriate to name the parking company.

I'll update the thread once the ICO investigation has been completed.

Half_way

Apart from the.reg numbers, is there anything else linked to the numbers, such as times in car park, overstays/ lengths of stay, or more serious payment method, or names, and addresses?

dataprotectionbreach

In the worst case some customers had placed notices in their car windows giving names. contact numbers and jobs. This was clearly to try and make the parking company act with some compassion. Photos have been taken of these signs and put online along with the car registrations. All can be easily accessed.

Johno100

The_Slithy_Tove wrote: »

This has happened before, can't remember which PPC. They got into quite a bit of trouble for it.

Yes, I remember all the various time stamped photos of the vehicles were available. I can't remember if it was just by altering (going up or down) on a number in the URL or they'd left a directory on their computer system open.

1505grandad

Would it be our friends UKPC?

https://www.theregister.co.uk/2013/04/08/ukpc_pictures_leaked/

Coupon-mad

LOL!

Exclusive Britain's privacy watchdog will investigate a major car-parking contractor after its website allegedly leaked drivers' personal information.

Readers will be relieved to know, however, that representatives of chesty TV princess Katie Price say she has avoided having any sensitive private information revealed during the affair.

What a relief!

In all seriousness, maybe the Director of this current company thinks he's some sort of DPA expert and internet engineer but turns out to be clueless. Seen that before.

fisherjim

This was the best one from those lowlife ding-bat muppets at UKPC who are still in business despite all their misdemeanours:


http://nutsville.com/2013/03/31/british-parking-association-member-ukpc-in-epic-data-protection-failure/


If it's them again they should be put out of business.