Data protection issue

unholyangel

Ergates said:

In terms of data protection - they are right, they shouldn't give out the fitters details.  Whilst you have good cause to want the name and address, it's not Carpetright's duty to provide that, therefore their responsibility to protect the data overrides your need for it.

I suspect that Carpetrights rather hands off approach to fitting (making sure the money for the fitter never goes through their hands) is deliberate so they can duck issues such as this.

Do you have an estimate of how much it would cost to correct the damage?

No, it's not right in terms of data protection. Data protection has an exemption for disclosure relating to legal proceedings. Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply. 

But not only does data protection not prevent them disclosing the details, if they were acting as an agent then they would need to disclose the agency to you. Personally, I'd issue carpetright a letter before action and tell them if they think the fitter is liable/carpetright are protected by laws of agency, then they can name the fitter as additional defendant to the proceedings. 

I doubt it will get that far though and the LBA would cause it to be passed to someone higher up who knows they're on a hiding to nothing. 

eskbanker

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

AmberDepp

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

But they could SAR them and it's very likely the fitter's details would appear in their records.

eskbanker

AmberDepp said:

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

But they could SAR them and it's very likely the fitter's details would appear in their records.

Nothing to lose by trying but if Carpetright have already refused to provide these then they'd have to be negligent to release them in a SAR response.

unholyangel

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

I'm not referring to processing of data necessary for law enforcement. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex3

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

• legal proceedings, including prospective legal proceedings;

• obtaining legal advice; or

• establishing, exercising or defending legal rights.

And yes, I was referring to the fitter since it was disclosure of the fitter's details being discussed. 

user1977

unholyangel said:

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

I'm not referring to processing of data necessary for law enforcement. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex3

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

• legal proceedings, including prospective legal proceedings;

• obtaining legal advice; or

• establishing, exercising or defending legal rights.

And yes, I was referring to the fitter since it was disclosure of the fitter's details being discussed. 

But I can't see that it's necessary for Carpetright to disclose the details merely because they may assist the OP's prospective legal action (whereas it would, for example, be necessary for Carpetright to use personal data to pursue their own legal cases).

unholyangel

user1977 said:

unholyangel said:

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

I'm not referring to processing of data necessary for law enforcement. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex3

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

• legal proceedings, including prospective legal proceedings;

• obtaining legal advice; or

• establishing, exercising or defending legal rights.

And yes, I was referring to the fitter since it was disclosure of the fitter's details being discussed. 

But I can't see that it's necessary for Carpetright to disclose the details merely because they may assist the OP's prospective legal action (whereas it would, for example, be necessary for Carpetright to use personal data to pursue their own legal cases).

It is necessary if they want to play the "we weren't party to the contract" card. You can't be protected by the laws of agency if you don't disclose that there is an agency. Therefore disclosure was necessary to establish legal rights. 

See here under undisclosed principal and also unidentified princpal (it helpfully outlines the 3 scenarios you come across when agency is involved):
https://publications.parliament.uk/pa/ld200304/ldselect/lddelreg/135/13505.htm

user1977

unholyangel said:

user1977 said:

unholyangel said:

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

I'm not referring to processing of data necessary for law enforcement. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex3

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

• legal proceedings, including prospective legal proceedings;

• obtaining legal advice; or

• establishing, exercising or defending legal rights.

And yes, I was referring to the fitter since it was disclosure of the fitter's details being discussed. 

But I can't see that it's necessary for Carpetright to disclose the details merely because they may assist the OP's prospective legal action (whereas it would, for example, be necessary for Carpetright to use personal data to pursue their own legal cases).

It is necessary if they want to play the "we weren't party to the contract" card. You can't be protected by the laws of agency if you don't disclose that there is an agency. Therefore disclosure was necessary to establish legal rights. 

See here under undisclosed principal and also unidentified princpal (it helpfully outlines the 3 scenarios you come across when agency is involved):
https://publications.parliament.uk/pa/ld200304/ldselect/lddelreg/135/13505.htm

We may be talking at cross-purposes - I had already made the point above about undisclosed principals. But I think others may have thought that "but because I want to sue X, you need to give me their details" is a general rule even where agency isn't involved.

unholyangel

user1977 said:

unholyangel said:

user1977 said:

unholyangel said:

eskbanker said:

unholyangel said:

Data protection has an exemption for disclosure relating to legal proceedings.

While there are some DPA exemptions relating to crime prevention or investigation, these are for 'competent authorities processing personal data for law enforcement purposes (eg the police conducting a criminal investigation)' rather than supporting a customer wanting a company to disclose personal details of an individual in order to sue, and hence the Norwich Pharmacal process being required to secure such details in scenarios such as trying to obtain details from a bank of a mistaken recipient of funds.

unholyangel said:
Plus if the trader is actually a limited company (or other body corporate), data protection doesn't apply.

Are you referring to the fitter here?

I'm not referring to processing of data necessary for law enforcement. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/exemptions/#ex3

The third part of this exemption can apply if it is necessary for you to disclose personal data for the purposes of, or in connection with:

• legal proceedings, including prospective legal proceedings;

• obtaining legal advice; or

• establishing, exercising or defending legal rights.

And yes, I was referring to the fitter since it was disclosure of the fitter's details being discussed. 

But I can't see that it's necessary for Carpetright to disclose the details merely because they may assist the OP's prospective legal action (whereas it would, for example, be necessary for Carpetright to use personal data to pursue their own legal cases).

It is necessary if they want to play the "we weren't party to the contract" card. You can't be protected by the laws of agency if you don't disclose that there is an agency. Therefore disclosure was necessary to establish legal rights. 

See here under undisclosed principal and also unidentified princpal (it helpfully outlines the 3 scenarios you come across when agency is involved):
https://publications.parliament.uk/pa/ld200304/ldselect/lddelreg/135/13505.htm

We may be talking at cross-purposes - I had already made the point above about undisclosed principals. But I think others may have thought that "but because I want to sue X, you need to give me their details" is a general rule even where agency isn't involved.

It can be used even where agency isn't involved. But it doesn't exist as a general rule. Rather it's an exemption to the general rule (that data should only be used as expected/for the purposes it was collected and disclosed with consent). 

1931modela

Hi all, appreciate all the suggestions etc and just to update the thread, I persevered with the CarpetRight branch as I got nowhere with head office (What a waste of time contacting them, despite being promised they would get back to me regarding complaint, no one ever has)
I managed to get the branch manager to visit and inspect damage, even though I had supplied pictures of damage he could see for himself that there was no way the damage could have been done any other way then dragging carpet across wall corners. 
Anyway short answer is he spoke with fitter who reluctantly agreed to cover the cost of the repairs.
Happy days, but lesson learnt and will not use CarpetRight or any firm that subs out work like they did.