Missing parcels and DPA

Bowbell2020

My instructions via website and text to delivery driver via mobile to leave my parcel in my porch outside my flat. Instead of doing that, the parcel was left outside the gated area in the public domain and went missing. After a lot of emails and proof of where it was left, proof of my text conversation with delivery driver and photos of the lay out of the estate I was refunded and told they would not re-deliver, frankly did all they could not to make it easy for me. The question I have is as the parcel was left in a public place which not only residents in the gated area could see but anyone passing the parcel on the public path outside is this a breach under the Data Protection Act 2018 as my name and address were clearly visible and not only does someone have the parcel but also my identifiable information? This has made me feel extremely vulnerable. If this is a breach of the DPA, is the Information Commissioner's Office the route to go down to take this issue further?

flaneurs_lobster

Quick answer : No.

Longer answer : The DPA deals with how an organisation treats personal information held about you and how that information can only be used for legitimate, legal purposes.

I would assert that printing your name and address onto a label and sticking it onto a parcel containing goods intended for you at your residence is a legitimate use of your data. 

However you choose to complain about your useless delivery company, the DPA and its Commissioner would not be of much help.

powerful_Rogue

Bowbell2020 said:

My instructions via website and text to delivery driver via mobile to leave my parcel in my porch outside my flat. Instead of doing that, the parcel was left outside the gated area in the public domain and went missing. After a lot of emails and proof of where it was left, proof of my text conversation with delivery driver and photos of the lay out of the estate I was refunded and told they would not re-deliver, frankly did all they could not to make it easy for me. The question I have is as the parcel was left in a public place which not only residents in the gated area could see but anyone passing the parcel on the public path outside is this a breach under the Data Protection Act 2018 as my name and address were clearly visible and not only does someone have the parcel but also my identifiable information? This has made me feel extremely vulnerable. If this is a breach of the DPA, is the Information Commissioner's Office the route to go down to take this issue further?

In what sense? There is very little someone can do with that information.

A_Geordie

powerful_Rogue said:

In what sense? There is very little someone can do with that information.

I would argue the opposite. Someone who has full name and address could use that for malicious purposes. It could enable them to gather more personal data about that person such as social media or even using a third party service to carry out a tracing enquiry or financial report on that individual, all for the purposes of committing fraud or some other criminal offence.

The fact the courier ignored the requests of the OP and left it on a public path or out in the open is unacceptable. Whilst they may have the right to use the personal data for the purposes of delivering, it must be done lawfully and fairly. 

Nothing will come of it from the ICO for this kind of issue but the OP could potentially sue the courier. There was a European court case last year that confirmed that having a fear is sufficient damage to warrant compensation. Not legally binding on the courts over here but would be highly persuasive. 


Alternatively, the OP could ask the courier to pay for 12/24 months worth of subscription for credit monitoring services to ensure nobody uses their personal data for malicious purposes and catch it early to take action. 

born_again

Bowbell2020 said:

My instructions via website and text to delivery driver via mobile to leave my parcel in my porch outside my flat. Instead of doing that, the parcel was left outside the gated area in the public domain and went missing. After a lot of emails and proof of where it was left, proof of my text conversation with delivery driver and photos of the lay out of the estate I was refunded and told they would not re-deliver, frankly did all they could not to make it easy for me. The question I have is as the parcel was left in a public place which not only residents in the gated area could see but anyone passing the parcel on the public path outside is this a breach under the Data Protection Act 2018 as my name and address were clearly visible and not only does someone have the parcel but also my identifiable information? This has made me feel extremely vulnerable. If this is a breach of the DPA, is the Information Commissioner's Office the route to go down to take this issue further?

GDPR relates to how companies store data, not how any letter/parcel has address on, or how would any delivery person be able to deliver the item.
Even if it had been left inside, then any person in the building would have been able to see your details.

eskbanker

I agree with OP that it's technically a DPA breach, in that the courier is responsible for ensuring that personal data is "handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage", so if inadequate delivery practices permit name and address data to be accessed by someone unauthorised then that clearly breaches that principle.

Whether it's an actionable breach is a different matter though....

powerful_Rogue

A_Geordie said:

powerful_Rogue said:

In what sense? There is very little someone can do with that information.

I would argue the opposite. Someone who has full name and address could use that for malicious purposes. It could enable them to gather more personal data about that person such as social media or even using a third party service to carry out a tracing enquiry or financial report on that individual, all for the purposes of committing fraud or some other criminal offence.

The fact the courier ignored the requests of the OP and left it on a public path or out in the open is unacceptable. Whilst they may have the right to use the personal data for the purposes of delivering, it must be done lawfully and fairly. 

Nothing will come of it from the ICO for this kind of issue but the OP could potentially sue the courier. There was a European court case last year that confirmed that having a fear is sufficient damage to warrant compensation. Not legally binding on the courts over here but would be highly persuasive. 


Alternatively, the OP could ask the courier to pay for 12/24 months worth of subscription for credit monitoring services to ensure nobody uses their personal data for malicious purposes and catch it early to take action. 

I think your drifting into the realms of fantasy if you think someone is going to scour the streets looking for parcels to get a name and address and perform those kinds of activities.

A_Geordie

powerful_Rogue said:

I think your drifting into the realms of fantasy if you think someone is going to scour the streets looking for parcels to get a name and address and perform those kinds of activities.

Well, I never knew identity fraud was a fantasy but we all have differing opinions so if that's your opinion then I respect it. However, I have first hand experience of someone stealing a parcel left on my drive that was left in the open and then soon after that, attempts have been made under my name to open credit accounts and other expensive purchases.  

I am not suggesting that people are scouring streets looking for parcels (but they do rifle through bins for bank statements and other personal data) but it is not beyond the realms of possibility that someone who has stolen a parcel, may have the inclination to try and use someone's identity to their advantage. 

the_lunatic_is_in_my_head

powerful_Rogue said:

I think your drifting into the realms of fantasy if you think someone is going to scour the streets looking for parcels to get a name and address and perform those kinds of activities.

Sadly nothing is surprising these days:

https://www.thetelegraphandargus.co.uk/news/23936329.identity-thieves-search-rubbish-find-details/

born_again

A_Geordie said:may have the inclination to try and use someone's identity to their advantage. 

To be fair here. Not a lot that can be done with a simple name & address, they need far more than that to commit ID fraud.

powerful_Rogue

the_lunatic_is_in_my_head said:

powerful_Rogue said:

I think your drifting into the realms of fantasy if you think someone is going to scour the streets looking for parcels to get a name and address and perform those kinds of activities.

Sadly nothing is surprising these days:

https://www.thetelegraphandargus.co.uk/news/23936329.identity-thieves-search-rubbish-find-details/

That article talks about personal details also including dates of births, bank statements or other documents within the rubbish bins which I totally agree with could be used for nefarious purposes.