Anyone know their law in data protection regarding railways?
I agree that there is no provision in the Act which differentiates the Railways from any other user of data.
If you submit a complaint to a TOC about a member of staff, are the TOC allowed to tell the staff member who complained? Taking into consideration the member of staff was Guilty of the Offence committed while on a train.
It is hard to see how the member of staff could be Guilty of an Offence without that Guilt being established by a Court, and to see how that Court could have established Guilt without having first heard Evidence from Witnesses, and how those Witness Statements or oral Evidence could have been presented without the identity of the Witnesses being demanded by the Court. If they have been found Guilty then the identities of the Witnesses will certainly have been established (some protection can be provided if Witnesses are believed to be at risk).
But perhaps you didn't actually mean "
the member of staff was guilty of the offence" and this is just your belief, in which case you are asking if the Act restricts the employer from divulging the name of the Complainant while investigating the Complaint? (whether the Complaint is upheld or not).
It would be a perilous investigative policy which divulged the name of a Complainant, as it must meet the test that personal data shall be used "for specified purposes and not in a way that is incompatible with those purposes", and Section 10 requires the prevention the processing of personal data that is likely to cause damage or personal distress to the person whose data is processed. But note that the Act only applies to Data, its processing, storeage etc., it does not apply to information in human memory and so there would be possible disclosures of a purely oral nature which would not be captured by the Act.
Would the member of staff be entitled to go to a third party to take further action for a member of the public complaining about a valid issue?
"Go to a third party?" Yes. The Data Protection Act concerns the Data, so would only regulate the exchange of personal data, between parties, as above. An anonymous tale could be told to, for example, a journalist who may then be able to investigate and establish the identites and then to obtain confirmation during interviews (do we see much evidence of thorough investigative journalism for the sort of story you have in mind?).
All Companies with data records should have a Policy to regulate the handling of personal data and these may extend a little further than the strict requirements of the Act. I would expect that Policies would generally include prohibition of the disclosure of personal information that is not necessary for the functions of the Company.