TOCs sharing out information on passengers

[SickyNicky]

I will ring Scotrail tomorrow and give one last chance for them to respond appropriately. By the looks of things, the industry might well benefit from a common training course/reference point on compliance with the DPA.

What did they say, RJ?

 

[RJ]

What did they say, RJ?

Only caught up with them today. They're very hard to get hold of - ring customer relations, more often than not nobody answers the phone. It cuts you off after a minute of waiting. Write to them and they don't respond for 6 weeks upwards.

They were still being obtuse today so I gave them until the end of the week to send me the information I require in its entirety.

 

[Wolfie]

Only caught up with them today. They're very hard to get hold of - ring customer relations, more often than not nobody answers the phone. It cuts you off after a minute of waiting. Write to them and they don't respond for 6 weeks upwards.

They were still being obtuse today so I gave them until the end of the week to send me the information I require in its entirety.

Write to them copied to the Information Commissioner - I am pretty sure a call from the ICO, with the threat of a nice fine, will speed things up......

 

[BrownE]

Only caught up with them today. They're very hard to get hold of - ring customer relations, more often than not nobody answers the phone. It cuts you off after a minute of waiting. Write to them and they don't respond for 6 weeks upwards.

They were still being obtuse today so I gave them until the end of the week to send me the information I require in its entirety.

Its bizarre how two parts of the same group can be so very different. FGW were the model of efficiency for my request, they even had an internal meeting about my SAR.

How odd.

 

[RJ]

Still no response since I telephoned Scotrail on the 25th February. I now feel that I have exhausted the Customer Relations channel. I've been trying to get the request seen to since November 2013, called them and emailed them numerous times and it appears that they have no intention of fulfilling the request. The only option left is to get the ICO to intervene. It will probably take a few months to get a response, but that is better than nothing which is what Scotrail seen to me doing at the moment.

 

[Zoidberg]

Still no response since I telephoned Scotrail on the 25th February. ... The only option left is to get the ICO to intervene. It will probably take a few months to get a response, but that is better than nothing which is what Scotrail seen to me doing at the moment.

Thanks for the update - best of luck for a swifter response from the office of the ICO.

 

[ex-railwayman]

In this case, the Penalty Fare was for around £68.40, so I lodged a part payment with a £50.00 Rail Travel Voucher. Any member of railway staff requesting payment for a fare is legally obliged to accept RTVs if tendered as payment, although this is something that IPFAS appeared to be unaware of.

As this is a legel entity, IPFAS have no redress, ignorance of the law is no excuse, as someone else has quoted later on in this thread.
Could it be because IPFAS is part of SouthEastern, which is the TOC you are challenging and they're just trying to throw you off track (no pun intended). I cannot understand how a supposedly independent organisation can be owned by a Rail Passenger Operating Company, it goes against all logic, how the DfT accepted this sounds highly dubious, but, then again, we are talking about our Government.....

Good luck with your future endeavours, anyway.

Cheerz. ex-railwayman.

 

[RJ]

There is a specific contextual definition of the term "independent," which IPFAS do fulfill. Information on this and commentary on their affiliation with the Integrated Kent franchise holder (presently Southeastern, was Connex South Eastern) can be found in the SRA Penalty Fares Policy document, clauses 4.38 - 4.40.

Thank you for your wishes. Last correspondence I had with Southeastern was them offering me a three figure "gesture of goodwill" payment for the way they handled matters. I declined to accept this. I gather that the matter I raised in the original post, among others, continue to be investigated by the Information Commissioner's Office.

 

[andypops]

Thanks for the update. Always keen to hear the latest on this topic.

 

[RJ]

Update.

Your complaint to us

In your case, the matters you have raised that are relevant to the DPA relate to the first and sixth data protection principles.


The first principle says that:

“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
a) at least one of the conditions in Schedule 2 is met, and
b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met”

The sixth principle says that:

“Personal data shall be processed in accordance with the rights of data subjects under this Act.”

You are concerned that Southeastern Limited shared your personal data with a number of other train operating companies without your consent or a legitimate reason to do so. I can see that this relates to an email sent by an employee on 21 May 2013 asking if anyone had sent a voucher to you, disclosing your name and postcode in doing so.

You are also concerned that Southeastern failed to fully comply with a subject access request (SAR) you made on 4 October 2013, within the prescribed timeframe. I can see that you asked for a copy of all the information held about you and several emails were exchanged on this matter.

Our decision

I wrote to Southeastern about this matter and have now received its response. On the basis of all of the information provided by you and Southeastern, we have decided that it is unlikely that Southeastern has complied with the requirements of the DPA in this case.

This is because it would appear likely that it failed to process your personal data in accordance with the requirements of the first principle, when it shared information relating to you with some other train operating companies outside of one’s reasonable expectations and unfairly. It also appeared to fail to supply a complete response to your SAR within the 40 day timeframe, based on all the evidence available to me.

However, based on the information provided in relation to this complaint, the Information Commissioner has decided that further regulatory action is not required at this time.

When deciding whether regulatory action is appropriate, we take into account the organisation’s general record of compliance with the DPA. This may include any previous assessments we have made, or any regulatory action we have already taken against the organisation. We may also consider any other information that is in our possession (including information given during the course of our assessments).

Further information

As you are aware, we asked Southeastern about the safeguards that are in place to help ensure it handles personal data properly and we are satisfied with its response.

Southeastern has explained the reason why details relating to you were shared with the other train operating companies in the emails provided was due to a misunderstanding of the correct process to follow by one employee, when settling an account involving a voucher being used. As I understand it, it was not necessary to advise the other train operating companies of your details to find out where the voucher had originated from. Therefore, it would seem unlikely that the processing in question met a condition for processing under the first principle and was likely to have been unfair.

In respect of the way your SAR was processed, Southeastern has explained that it was responded to within the 40 day timeframe and that it provided you with an extensive amount of records. It says that after receipt of this information, you wrote to Southeastern again asking for further emails that had not been picked up by its initial searches. Southeastern confirm that the additional information was located and provided within 9 days and is satisfied that you have been provided with all the information you are entitled to.

Based on the information available to me, it would seem likely these further emails should have been supplied as part of Southeastern’s initial response, within the 40 day timeframe, which is why I have made the assessment above.

As a result, I have made some good practice recommendations to Southeastern and I am also aware that it plans to take a number of steps to strengthen its data protection safeguards in these specific areas.

Having carefully considered all relevant information that we hold about this complaint at the present time, we have decided that formal regulatory action is not required.

Next steps

However, most organisations want to put things right when they have gone wrong and learn from complaints that are raised with them. We have therefore asked Southeastern to consider the information we have provided during the course of this assessment and take steps to prevent the situation from happening again.

We will keep a record of your complaint and take this assessment into account if we receive further complaints about Southeastern. The information we gather from complaints may form the basis for action in the future.

Thank you for bringing this matter to our attention. This case is now closed.

 

[maniacmartin]

Southeastern Limited is the name of a company that does not exist!

It's rather disappointing that although the ICO found in your favour on both counts, they aren't going to take any punitive action anyway.

 

[bb21]

It's rather disappointing that although the ICO found in your favour on both counts, they aren't going to take any punitive action anyway.

Is anyone seriously expecting punitive actions?

While it would have been nice, it was never remotely a realistic possibility.

 

[richw]

Is anyone seriously expecting punitive actions?

While it would have been nice, it was never remotely a realistic possibility.

It was never going to happen with just one case, on the other hand if there were other cases punitive actions may have occurred

 

[ModernRailways]

It was never going to happen with just one case, on the other hand if there were other cases punitive actions may have occurred

Which is exactly what was said. They say that they will take it further should more cases of this come to light.

 

[RJ]

I felt that a breach of the Data Protection Act had taken place. I wanted that acknowledged and recorded by the ICO, which was done. I did not expect that any further action would be taken on this occasion.

With the legal right to request name and address, comes the legal responsibility to process that data lawfully. In all cases, but especially where people have to give their name and address involuntarily under the auspices of the Railway Byelaws. In the interests of crime prevention, passengers should ask staff requesting these details to confirm that their organisation will handle that personal data lawfully. What are the implications for each party if if that person representing the company cannot provide any such guarantee?

Furthermore, I have heard back from the ICO after exhausting several channels, to no avail, to get Scotrail to respond to my request.

Thank you for your email in relation to your concerns about First Scotrail Limited. You say ‘I am having difficulty in obtaining personal information on myself from First Scotrail. After over 40 days of waiting for a response (I did get an auto response and reference number when I sent it) I didn't hear anything back. After three months and numerous phone calls, they still haven't sent me the information I require. Only a useless form for a CCTV request. It appears that they are not aware of how to deal with personal information requests under the Data Protection Act.’

The Data Protection Act 1998 (DPA)

The DPA requires that all data controllers comply with eight broad data protection principles of ‘good information handling’ which require, among other things, that data controllers hold accurate, relevant data, which are subject to appropriate security, and processed fairly and lawfully.

What we do

We want to know how organisations are doing when they are handling information rights issues. We also want to improve the way they deal with the personal information they are responsible for. Reporting your concerns to us will help us to do that. Our aim is to raise information rights practices within organisations. We do this by taking an overview of all concerns that are raised about that organisation with a view to improving their compliance with the DPA. Our role is not to investigate or adjudicate on individual concerns but we will consider whether there is an opportunity to improve the practice of the organisations we regulate.

We cannot look into every concern we receive and the law does not say we must. We will put most of our effort into dealing with matters we think give us the best chance of making the biggest difference to information rights practices. Depending on the circumstances, we may give advice about handling personal information, provide guidance, or ask them to review their procedures.

Your concerns

From the information you have provided to us it does appear that Scotrail have breached the legislation as they have not responded to your subject access request within 40 days. We have asked Scotrail to take the following steps to rectify this:

Respond to your subject access request.

Although we do not intend to write to you again, we will keep the concerns raised on file. This will help us over time to build up a picture of Scotrail’s information rights practices.

Thank you for bringing this matter to our attention.

Scotrail did finally do something a couple of weeks ago - they sent a SAR personal data request form through the post, along with an apology for sending the wrong form. I don't have any intention of filling it out. Previous request stapled to it with a cheque in the post now.

 

[island]

The DPA does not require requests for personal data to be in any particular form or format