Unusual Situation

[ylop]

Does GDPA (no I have not read it and feel free to tell me you don’t have the time to explain and that I should find it and read it) apply to applications other than CCTV.

It covers all personal data, CCTV is just one form of data. It does entitle you to ask for data to be deleted but it’s not an absolute right — the data controller has to consider your request but may have good reasons for retaining your data.

 

[lustyd]

Indeed, every other piece of legislation overrides GDPR with regards to data retention to ensure that financial records, court documents, criminal records and other legal hold type information can be retained as required.

 

[nevis768]

Just to note that the circumstances entirely justify the HM's refusal to share the data on GDPR grounds. Glad it could be sorted out amicably.

They don't actually.

 

[ylop]

They don't actually.

Well the full story seems to involve medical information which is special category personal data, which requires extra safeguards. It may not have been necessary to share that part of the story but it perhaps is more useful to follow the ICO guidance and consider if consent to share it can be obtained and thus a properly informed position available to the claimant.

 

[lustyd]

I agree the decision was entirely justified and aligned with both the letter and intent of the law. It’s not even ambiguous in this instance, handing out this kind of stuff to members of the public is definitely illegal unless consent is gained beforehand.

 

[rotrax]

I agree the decision was entirely justified and aligned with both the letter and intent of the law. It’s not even ambiguous in this instance, handing out this kind of stuff to members of the public is definitely illegal unless consent is gained beforehand.

And there is the rub.

Is the injured party 'a member of the public' or does he have a specific and lawful interest?

As well as needing certain information which might be required to obtain the repair of his vessel, the stress of not being advised of the why's and wherefore's was NOT welcome.

 

[ylop]

I agree the decision was entirely justified and aligned with both the letter and intent of the law. It’s not even ambiguous in this instance, handing out this kind of stuff to members of the public is definitely illegal unless consent is gained beforehand.

the ICO disagrees! The data controller needs to consider the options but disclosure could be a lawful option, even if consent was refused.

Of course the HM could make their own life easier by updating the regulations to require them to share information!

 

[benjenbav]

I would imagine that the default procedure for the HM is not to disclose personal data save where there is an unambiguous permission to disclose, for example, to police investigating a crime or where there is a court order compelling disclosure.

That’s a position that can always be revised on advice. Whereas, if the default was to disclose on request there is a much higher likelihood of liability arising.

And, as someone observed, this HM doesn’t have an in-house legal team that can help with any questions. Instead they use external lawyers who will, of course, charge for every call on their time.

 

[Seven Spades]

It’s not wrong it’s in line with the law.

They are not.

Legitimate interest doesn’t cover this situation at all. Legitimate interest is when a company requires data to carry out the service they provide, essentially this is when it’s obvious the data is required.

In this situation, there are organisations such as police and courts who can request the data legitimately as part of proceedings. The individual under no circumstances needs the data because they are neither investigating nor prosecuting. The insurance company will investigate, possibly alongside police and may then start court proceedings on your behalf. This thread is essentially asking for permission to become a vigilante (in a loose sense) and it’s good that the law prevents that and that the marina are complying with the law.

This must be nonsense. The victim here might want to bring a small claims action against the person who caused the damage. This would indeed make him the prosecuting party. I think your interpretation is wrong.

 

[Seven Spades]

The GDPR uses “legal person” and “natural person”. I said company as it’s easier to understand for forumites.

As does the GDPR, purposefully so. In this case the underdog is the person who was being filmed as far as privacy is concerned. The OP can get redress quite easily but not by personally hunting down the person who did the damage.

It’s a strong sounding word but I think it fits the intent of finding the criminal and dealing with them personally rather than following well established and legal routes to redress. I do understand the reasoning in the OP but unfortunately that’s not how our system is set up. the question was about data privacy and the law, and in this case the marina were correct.

The legal route is to issue a claim in the small claims court after issuing a letter before action. In order to do that he needs to know who it is and where they live. That does not constitute "hunting anyone down"

 

[Lucky Duck]

The legal route is to issue a claim in the small claims court after issuing a letter before action. In order to do that he needs to know who it is and where they live. That does not constitute "hunting anyone down"

Indeed, compare this with the DVLA being perfectly happy to sell keeper details further to a civil dispute over parking charges

 

[lustyd]

Is the injured party 'a member of the public' or does he have a specific and lawful interest?

It’s quite clearly spelled out in the law. They are essentially a random off the street as far as GDPR is concerned unless and until something overrides that.

 

[lustyd]

This must be nonsense. The victim here might want to bring a small claims action against the person who caused the damage. This would indeed make him the prosecuting party. I think your interpretation is wrong.

It isn’t. I did this for a living, advising some global companies. The victim can’t bring a small claim since they don’t know who the other party is and have no evidence that they have access to. There are various ways they can go about getting access, but asking a business to break the law isn’t one of them.

 

[rotrax]

It isn’t. I did this for a living, advising some global companies. The victim can’t bring a small claim since they don’t know who the other party is and have no evidence that they have access to. There are various ways they can go about getting access, but asking a business to break the law isn’t one of them.

This, perhaps, is where your premise falls down.

The Littlehampton Harbour is a Statutory Authority, not a commercial business, although raising revenue is important.

They take money from bertholders and provide moorings and other services, including security.

I feel, and am sure it might legaly be the case, that I should have been furnished with the information required to start getting my boat repaired at no cost to myself. As a paying bertholder and holder of a harbour dues sticker at a cost of around £6k per annum, I am not a member of the public. I am a customer and after six years am well known to the HM and his staff.

They know I am not a vigilante.....................................

 

[ylop]

This, perhaps, is where your premise falls down.

The Littlehampton Harbour is a Statutory Authority, not a commercial business, although raising revenue is important.

They take money from bertholders and provide moorings and other services, including security.

I feel, and am sure it might legaly be the case, that I should have been furnished with the information required to start getting my boat repaired at no cost to myself. As a paying bertholder and holder of a harbour dues sticker at a cost of around £6k per annum, I am not a member of the public. I am a customer and after six years am well known to the HM and his staff.

They know I am not a vigilante.....................................

Flip the situation round. Someone else in the harbour claims your vessel caused them damage (perhaps a line broke and you weren’t on board - so we don’t have to deal with the obvious fact that you are an upstanding member of society and would have sorted it directly yourself). Now are you happy for the harbour master to provide your details to any person who asks for them on the premise your boat damaged them? Only if the HM reviews the CCTV and sees there was contact? Or only after he first discusses it with you directly?

Their statutory status or yours as a customer has nothing to do with it - they have obligations to safeguard that data. Lustyd is slightly overstating the situation by suggesting they can never give the other party’s data out, but I think BenJenBav explained the situation well: Once the data is provided you can never put the genie back in the bottle, so you want to be 100% sure that providing the data in necessary and proportionate. Some large companies will simply say, “get a court order” they aren’t actually trying to resist providing the data, they just want to be certain that the other party has no recourse against them.

Imagine if they had provided you his details and you got no response in 24h - probably most of us would assume he’s intentionally ignoring you. People then start doing stuff like posting his details on Facebook / forums trying to track him down or shame him into action. In reality he’s lying on a trolley in A&E waiting to be seen.

Still not convinced? imagine a hypothetical attractive young lady bumps boats with a letcherous middle aged man. She discussed the damage, he suggests they go for dinner to work it out and she leaves without providing her details. Should the HM provide her details to the letch? Or might it be better if she has the option of simply providing her insurers details? Why is another boater afforded any less protection of his privacy because of some subjective assessment of either their “risk” or your “creepiness”.

GDPR exists to protect YOUR data from misuse. Sometimes that will mean you have to jump through more hoops if you want someone else’s data.

 

[Frogmogman]

It really annoys me that insurance companies tend to settle rather than go after whoever has inflicted the damage.

The wing mirror of my parked van was, a few years ago, knocked off by another passing van. The driver stopped, he clearly knew what he had done, but then just drove off. I was standing in the street at the time and took his number.

As it happens, the mirror was motorized and heated, so quite expensive. Ford charged €750 to replace it. I was infuriated, that although I had been to the police, given them the registration number of the offending vehicle, and notified my insurer the driver of the offending vehicle just walked away from it. The insurer of the van in question did not reply to any of the letters or emails from my insurer, who ended up just paying out and letting the matter drop.

You might say, why get het up about it ? The insurance paid out. The point is we all pay through our premiums for this sort of thing. Insurance companies should go after these people, even if it ends up costing more.

As Voltaire pointed out about the execution of poor admiral byng… “in that country, they think it’s a good idea from time to time to kill an admiral, to encourage the others”

 

[lustyd]

This, perhaps, is where your premise falls down.

The Littlehampton Harbour is a Statutory Authority, not a commercial business, although raising revenue is important.

They take money from bertholders and provide moorings and other services, including security.

I feel, and am sure it might legaly be the case, that I should have been furnished with the information required to start getting my boat repaired at no cost to myself. As a paying bertholder and holder of a harbour dues sticker at a cost of around £6k per annum, I am not a member of the public. I am a customer and after six years am well known to the HM and his staff.

They know I am not a vigilante.....................................

You are well within your rights to start a claim against the harbour for letting it happen. That’s entirely separate to data privacy.
It’s unlikely you’d succeed but they knew it was happening and filmed it happening so we’re in a position to protect your property. They do not, however, need to hand over footage.

 

[lustyd]

Lustyd is slightly overstating the situation by suggesting they can never give the other party’s data out

I’ve never included any nuance when discussing GDPR with people who will never bother to read it. They tend to jump on things as an excuse for illegal behaviour rather than taking time to understand why the exceptions exist.
As I said at the top of the thread, reading the first section is sufficient to guess what the rest says, as the intent is very clear.

In this instance there are many in the thread who have not even considered the rights of the person causing the damage, and that’s exactly why it’s such an important law.

 

[ylop]

The point is we all pay through our premiums for this sort of thing. Insurance companies should go after these people, even if it ends up costing more.

Think about the logic of what you are saying carefully. The natural conclusion is insurers should make economically poor decisions to make a point, which will put up your premiums!

I suspect if you really wanted to risk thousands to get your loss (excess?) back there is nothing to stop you suing the other driver (or their insurer if they have one) directly. Similarly an insurer could market a policy with the mantra of “we never drop a case, that’s why we cost more” but I don’t see many people wanting to pay more!

 

[ylop]

I’ve never included any nuance when discussing GDPR with people who will never bother to read it.

I have some sympathy with that approach. But when you say things like “asking business to break the law isn’t one of them” if misleads them even more and feeds the “GDPR says no” myths which exist amongst those too lazy to understand the essence of the rules.

As I said at the top of the thread, reading the first section is sufficient to guess what the rest says, as the intent is very clear.

I have literally read the entire thing, some of it dozens of times - I’m not sure I would agree - if that was the case we wouldn’t really need the rest, it could have been left for guidance notes rather than law. But I get your point that arguing with people who haven’t even bothered to read the introduction is probably fruitless.

In this instance there are many in the thread who have not even considered the rights of the person causing the damage, and that’s exactly why it’s such an important law.

100% agree. Ironically in my experience they are exactly the same people who if their data gets shared without consent get up in arms about it, and start shouting about GDPR! The same seems to be true with other types of rights.