VCS - Southend Airport No Stopping - RK - Not Driver - Costs Awarded - Another One Bites the Dust

Umkomaas

Debszzzz2 said:

But aren't VCS their agents? Does data protection legislation allow for the LSA to be jointly and severally liable for the actions of its agent?

What are "local road laws"? Why does LSA suppose that VCS, an unregulated private parking company, contracted by them, has any authoritative powers to determine whether a vehicle is in breach of the local road laws/bylaws and whether to make further enquiries in order to issue a PCN as a result?

Could there be an issue with any contracts that confer authoritative powers to an unregulated private parking company?

Hey @Debzzzz2 - you have certainly got a handle on this stuff, especially after such an apparent short period of time on the forum. Your ongoing help here would be very definitely welcomed. Great stuff. 👍

stop_this_nonsense

Debszzzz2 said:

But aren't VCS their agents? Does data protection legislation allow for the LSA to be jointly and severally liable for the actions of its agent?

What are "local road laws"? Why does LSA suppose that VCS, an unregulated private parking company, contracted by them, has any authoritative powers to determine whether a vehicle is in breach of the local road laws/bylaws and whether to make further enquiries in order to issue a PCN as a result?

Could there be an issue with any contracts that confer authoritative powers to an unregulated private parking company?

Which was pretty much the points I went back to them on. I specifically pointed out that VCS are there to enforce the "No Stopping" prohibition on road on their private land. VCS are there to enforce the airport's rules, not VCS's. In data protection language the airport "determines the purpose of processing personal data" and this makes them a data controller. Am pretty sure they wouldn't let just anyone install a CCTV on airport land! It makes sense, at least to me, that the airport are joint data controllers with VCS ... and jointly liable.

I am going to complain to the ICO now that I have the airport's and VCS's final say on the matter. Incidentally, VCS's response to my objection was woeful and waffled on about 'parking', 'reasonable assumptions' I was the driver, 'lawful debts', 'withdrawal of consent' and even sang the praises of their ADR kangaroo court, a.k.a. the IPC. I wept tears of laughter. I am interested in what the ICO will make of the legitimacy of the lawful basis for processing, the lack of risk assessments for intrusive surveillance (talk of VCS ANPR on site is a smokescreen, it's a fat fingered, sausage-roll munching VCS operative in a van with a camera), high risk processing (data matching and systematic recording), using personal data collected by deception (based on breach of KADOE) and not properly responding to data subjects' right to object.

Castle

You should be aware that VCS don't actually have any employees, so any personal data is being collected and processed by either Excel Parking or subcontractors.

GrannyKate

I think a view from ICO will be interesting here.  The concept of joint data controllers is very vague and like much of Information Rights law is open to subjective and/or pragmatic interpretation.  It may also be worth considering (as @castle says VCS have no employees) whether the contract between the Airport and VCS allows them to subcontract the processing of personal data to a third party and what safeguards are in place. 

Castle

GrannyKate said:

I think a view from ICO will be interesting here.  The concept of joint data controllers is very vague and like much of Information Rights law is open to subjective and/or pragmatic interpretation.  It may also be worth considering (as @castle says VCS have no employees) whether the contract between the Airport and VCS allows them to subcontract the processing of personal data to a third party and what safeguards are in place. 

I bet the privacy notices/signs don't mention which other companies will be collecting/processing your personal data and more importantly, how do you read the privacy notices/signs without stopping!

stop_this_nonsense

Coupon-mad said:

You just use the wording already written about the two cases of Smith and Edward.  The search terms I gave you reveal that wording as well as the transcripts.

Have made a small update to paragraph 10 to remove repetition (based on the feedback that @CosmicLanes received - thanks).

Is it necessary to add the paragraphs from the case transcripts cited in paragraphs 10 and 11 in the defence (and maybe the verbatim paragraphs in Jopson, rather than an excerpt)?

Half_way

If the airport is a joint data controller, then could the personal liability part of GDPR come into play?
https://data-breach.com/under-gdpr-can-an-individual-be-held-responsible/

There are other specific circumstances, however, when an individual within a company can be fined: 

Obstructing investigation into non-compliance of GDPR.

Submitting false information to the ICO or DPA. 

stop_this_nonsense

Half_way said:

If the airport is a joint data controller, then could the personal liability part of GDPR come into play?
https://data-breach.com/under-gdpr-can-an-individual-be-held-responsible/

There are other specific circumstances, however, when an individual within a company can be fined: 

Obstructing investigation into non-compliance of GDPR.

Submitting false information to the ICO or DPA. 

Maybe check out what's been happening at the Post Office. That may give you some idea of the liklihood of a company officer being held liable ... for anything!

Half_way

stop_this_nonsense said:

Half_way said:

If the airport is a joint data controller, then could the personal liability part of GDPR come into play?
https://data-breach.com/under-gdpr-can-an-individual-be-held-responsible/

There are other specific circumstances, however, when an individual within a company can be fined: 

Obstructing investigation into non-compliance of GDPR.

Submitting false information to the ICO or DPA. 

Maybe check out what's been happening at the Post Office. That may give you some idea of the liklihood of a company officer being held liable ... for anything!

stop_this_nonsense said:

Half_way said:

If the airport is a joint data controller, then could the personal liability part of GDPR come into play?
https://data-breach.com/under-gdpr-can-an-individual-be-held-responsible/

There are other specific circumstances, however, when an individual within a company can be fined: 

Obstructing investigation into non-compliance of GDPR.

Submitting false information to the ICO or DPA. 

Maybe check out what's been happening at the Post Office. That may give you some idea of the liklihood of a company officer being held liable ... for anything!

Depends upon the company, and the what and who.
Post office vs Esken group (formerly stobart ) employee is a different kettle of fish, and even if you tell them you are investigating that aspect of GDPR it might make them take notice, if anything it could give them a headache and a little extra hassle 

Coupon-mad

stop_this_nonsense said:

Coupon-mad said:

You just use the wording already written about the two cases of Smith and Edward.  The search terms I gave you reveal that wording as well as the transcripts.

Have made a small update to paragraph 10 to remove repetition (based on the feedback that @CosmicLanes received - thanks).

Is it necessary to add the paragraphs from the case transcripts cited in paragraphs 10 and 11 in the defence (and maybe the verbatim paragraphs in Jopson, rather than an excerpt)?

Not sure what you mean.

Show us the latest draft.