More spying

[michael769]

Do you actually have an example of this because I was unaware DVLA were disclosing details for marketing purposes?

My only specific example is myself. The DVLA confirmed to me that they "may" have sold my personal details to third parties who "might" have used it for marketing purposes and that they were unable to comply with my request not to do so in the future. Paisley Sherrif court took the view that the law required that they did comply with my request and granted an interdict agaisnt the Secretary of State.

This led to them changing their policy to allow individuals to ask them to not sell such data.

The DVLA's data policy can be found here

The relevant passages are

It is unlawful to do this without express consent from the individual.

Can you point me in the direction of the relevant statute or legal rulingas it is certainly not in the Data Protection Act and is news to the Information Commissioner

The Information Commissioners interpretation of the law is that the only statutory requirements is to stop doing for marketing if asked (Sect 11). Anything else is simply part of the IC's best practice guidelines that are in no way legally binding.

[MGF]

The relevant parts of the DPA 1998 are below.

In the abscence of your consent I cannot see how selling your personal information to advertisers is lawful.


Section 1 (1)

“processing”, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including—

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d) alignment, combination, blocking, erasure or destruction of the information or data;


This clearly includes selling the information.


Section 4.— The data protection principles.

(1) References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

Schedule 1

1.
Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a) at least one of the conditions in Schedule 2 is met


Schedule 2


1.
The data subject has given his consent to the processing.



2.
The processing is necessary—

(a) for the performance of a contract to which the data subject is a party, or
(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3.
The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4.
The processing is necessary in order to protect the vital interests of the data subject.

5.
The processing is necessary—

(a) for the administration of justice,

(aa) for the exercise of any functions of either House of Parliament,

(b) for the exercise of any functions conferred on any person by or under any enactment,

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6.—

(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.


As the DVLA never admitted to you that they did sell your personal info to a 3rd party for advertising and reading the above I cannot see much evidence this is the case.

[michael769]

The relevant parts of the DPA 1998 are below.

In the abscence of your consent I cannot see how selling your personal information to advertisers is lawful.


[See main post for the act text]

I don't agree with your interpretation.

The key bit here is the words in Schedule 1 at least one of the conditions in Schedule 2 is met. As consent is only one of those conditions, in my opinion, if any of the others conditions are met this means that consent is not required.

The relevant condition for would be marketers is 6(1): The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed.

If the organisation feels that marketing or making money from selling personal data to marketers is a "legitimate interest" then it would appear that they have no need for consent. Given the number of (many quite large) companies that indulge in these practices I feel that it is likely that this is also the view taken by their specialist legal advisers.

Obviously there is a degree of weasel words in interpreting "legitimate interest" in such a way, but as neither the Information Commissioner or his EU counterpart has shown any willingness to try to prevent these practices, even though it is endemic within commerce, charity and the public sector, unless a court was to establish a legal precedent that prevents it, or the Secretary of State exercises his powers under 6(2) to exclude maketing purposes - then data controllers pretty much have carte blanche to make as much money as they can from what they know about you, and they don't even need to tell you that they have your details let alone tell you what they are doing with it (unless, of course you ask them - but for that you have to know, or suspect, what they are up to).

As the DVLA never admitted to you that they did sell your personal info to a 3rd party for advertising and reading the above I cannot see much evidence this is the case.

Perhaps not but a Permanent Sherrif of Paisley and Renfrewshire was satisified that on the balance of the probabilities that they had sold my details after having recieved a request from me to desist; and that they were likely to do so again in the future and thus in order to prevent future illegality that it was necessary to order the then Secretary of State for Transport and the Secretary of State for Scotland to take all steps required to prevent it.

[MGF]

The relevant parts of the DPA 1998 are below.

In the abscence of your consent I cannot see how selling your personal information to advertisers is lawful.


[See main post for the act text]

I don't agree with your interpretation.

Maybe not but your understanding of the term "legitimate interest" is at odds with its generally accepted meaning in law. The term is used extensively in public law and in this case would basically refer to the role of the DVLA.

How does making money on the side by selling personal information to advertisers fit with the business of the DVLA?

How the DVLA 'feel' about what is in their 'legitimate interest' is not relevant to the meaning of legitimate interest in law. You wouldn't come to the conclusion they are 'weasel words' if you had studied any of the cases in which courts have had to decide on them.

...neither the Information Commissioner or his EU counterpart has shown any willingness to try to prevent these practices, even though it is endemic within commerce, charity and the public sector, unless a court was to establish a legal precedent that prevents it, or the Secretary of State exercises his powers under 6(2) to exclude maketing purposes - then data controllers pretty much have carte blanche to make as much money as they can from what they know about you, and they don't even need to tell you that they have your details let alone tell you what they are doing with it (unless, of course you ask them - but for that you have to know, or suspect, what they are up to).

You say it is 'endemic within commerce' but have not provided any examples of organisations selling personal details for marketing purposes without your consent.

As the DVLA never admitted to you that they did sell your personal info to a 3rd party for advertising and reading the above I cannot see much evidence this is the case.

Perhaps not but a Permanent Sherrif of Paisley and Renfrewshire was satisified that on the balance of the probabilities that they had sold my details after having recieved a request from me to desist; and that they were likely to do so again in the future and thus in order to prevent future illegality that it was necessary to order the then Secretary of State for Transport and the Secretary of State for Scotland to take all steps required to prevent it.

Are you saying that the DVLA denied they had sold on your details for the purpose of advertising but the Court found in your favour?

Or is it the case that the DVLA didn't bother getting involved and so the court was left to decide on the basis of your evidence?

[jont]

You say it is 'endemic within commerce' but have not provided any examples of organisations selling personal details for marketing purposes without your consent.

And there of course is one of the problems - unless you manage to somehow uniquify the information you give to any particular company, when new unwanted junk starts arriving it's impossible to know who sold your details on. (for my email, I tend to use <company> @ <mydomain> so if any spam starts arriving I know who not to do business with again and it's easy to turn off email from that address. It's a bit harder with postal addresses

[Gareth]

for my email, I tend to use <company> @ <mydomain>

Some years ago, before postcodes were widely used, I knew someone who provided slightly different postcodes so that when the junk mail came through the door, he could tell which supplier had sold on his address.

[MGF]

This would have been in the days before the DPA 1998 I guess.

What is being suggested is that unscrupulous traders are selling on name and address details without the consent of the individual. I am sure that happens.

However what is also being suggested is that governement departments/agencies are doing the same thing. Something which, when asked about, they deny. That's a very serious allegation and if it is true needs to be dealt with. I for one don't want the DVLA selling on my personal information for commercial gain.


I don't get junk e mail except from those companies that I request it from. It is extremely rare for me to get junk mail.

As a general rule I always tick the box for no marketing e mails and always tick the box for not passing on to third parties. I am also particular about who I provide my information to. Prefering companies with a good reputation.

Works for me.

[jont]

As a general rule I always tick the box for no marketing e mails and always tick the box for not passing on to third parties.

Likewise, although working your way through the double or triple negatives gets tiring (eg Please untick this box if you don't want to not receive any marketing information).

Signing up for the Mail Preference Service also noticeably dropped our volume of junk mail after about 3 months.