Data Protection and public counters

EternalHope

How does Data Protection apply if one is interviewed at a counter say in a government office? Someone told me they had to go to a council office to report some problem with thieir house and others in the queue could hear them.

Someone also said they need to go to a SAFE registration at welfare and may be interviewed at a counter where personal details will be given/may be overheard.

Does Data Protection Act apply in above circumstances.?

hullaballoo

No, it doesn't.

jgorres

Why does it not apply?

hullaballoo

I'd be more interested to see why anyone would think it could apply. I'm not just being facetious, it could be an opportunity to debunk some myths about Data Protection that seem to be commonplace.

We've tried a legal myth-debunking thread in the past but absent specific scenarios such as the above, it was difficult to maintain because invariable the 2nd or 3rd post was about Gardaí and their hats.

coylemj

EternalHope wrote: »

Someone also said they need to go to a SAFE registration at welfare and may be interviewed at a counter where personal details will be given/may be overheard.

This 'someone' that you're listening to sounds like they're a bit paranoid and they don't know what they're talking about. That 'SAFE' environment includes the room where I had my identification documents checked and my photo taken for the new public services card, it was a small interview room in my local social welfare office (there's two such rooms set aside in Dun Laoghaire) and there's nobody there except you and the official.

lazeedaisy

There is a sign up in all offices saying if you wanted a private conversation, to ask for it!

So if they are that paranoid they can take up the offer,

Some people do ask for it, it's no big deal...

Gatling

coylemj wrote: »

This 'someone' that you're listening to sounds like they're a bit paranoid and they don't know what they're talking about. That 'SAFE' environment includes the room where I had my identification documents checked and my photo taken for the new public services card, it was a small interview room in my local social welfare office (there's two such rooms set aside in Dun Laoghaire) and there's nobody there except you and the official.

I've seen several safe places in welfare offices it was the front counter with a white plastic curtain .

coylemj

Gatling wrote: »

I've seen several safe places in welfare offices it was the front counter with a white plastic curtain .

A white plastic curtain - what more do you need for privacy?

Remember the 'Get Smart' (1960s spoof TV spy series) Cone of Silence?

jgorres

Hi hullaballo,

hullaballoo wrote: »

I'd be more interested to see why anyone would think it could apply. I'm not just being facetious, it could be an opportunity to debunk some myths about Data Protection that seem to be commonplace.

We've tried a legal myth-debunking thread in the past but absent specific scenarios such as the above, it was difficult to maintain because invariable the 2nd or 3rd post was about Gardaí and their hats.

And I am interested why you think it applies (personally, I do not know).

Just stating "No, it doesn't." might only add some other myths.

If you state something you should be prepared to give some supporting arguments.

Regards,
jgorres

screamer

Ha you should try being in a and e for a while. Very personal questions being asked and answered and 0 privacy. Whoever is worried about being heard in a council office needs a good dose of reality.

jgorres

coylemj wrote: »

This 'someone' that you're listening to sounds like they're a bit paranoid and they don't know what they're talking about.

Privacy is an important issue and hasn't anything to do with paranoia. If others fell fine posting their issues on Facebook or tweeting it around it is up to them.

coylemj

jgorres wrote: »

Privacy is an important issue and hasn't anything to do with paranoia. If others fell fine posting their issues on Facebook or tweeting it around it is up to them.

Are you the 'someone' in this thread?

jgorres

coylemj wrote: »

Are you the 'someone' in this thread?

Yes. But how do you know?

spurious

Isn't Data Protection about information stored about you in an electronic form? Not spoken words across a counter listened to by earwiggers.

gothic_doll

spurious wrote: »

Isn't Data Protection about information stored about you in an electronic form? Not spoken words across a counter listened to by earwiggers.

This. Pretty sure it only refers to stored information about yourself, and how it is protected, transmitted, shared etc. Ie: Spoken words are not data, unless they are being officially digitally recorded (which might apply in various circumstances)

haveringchick

I think the best thing to do if you are extra concerned about others overhearing you conversation in public offices is to explain your concern to the public servant and ask to be interviewed in private
However I understand current procedure is to explain to such customers that this can be arranged but an appointment wil need to be agreed, may be hard to setup, and the application will not progress until after then
Do the extra cautious mind them being last in the queue?
I mean applying for a drivers licence, a passport in a hurry, SW, registering births deaths and marriages, paying LA rent etc can you really be bothered?

hullaballoo

jgorres wrote: »

And I am interested why you think it applies (personally, I do not know).

Just stating "No, it doesn't." might only add some other myths.

If you state something you should be prepared to give some supporting arguments.

I don't think it applies. It doesn't apply. I cannot see how answering the question, "Does the DPA apply" with, "no" could be considered ambiguous.

It isn't really a matter for argument so I am unsure how I could further back up what I have set out.

Anyway, we've gotten to the crux of it in the end. Data Protection only protects data, which is capable of being processed and relates to the person. Words in the air are not data.

The real issue in this thread is whether the individual's privacy rights are being impinged by being asked questions of a personal or sensitive nature in circumstances where the answers might be overheard.

Are a person's privacy rights being impinged in that situation?

No, they aren't.

Victor

spurious wrote: »

Isn't Data Protection about information stored about you in an electronic form?

No, it applies to all organised records that have personal information. The roll book at school is personal information. Your pay slip is personal information. Your medical file is personal information. On the basis that they aren't in an electronic version, would you think it OK for this information to not be subject to Data Protection?

Not spoken words across a counter listened to by earwiggers.

hullaballoo wrote: »

Anyway, we've gotten to the crux of it in the end. Data Protection only protects data, which is capable of being processed and relates to the person. Words in the air are not data.

They are data, especially when overheard and written down or recorded on one of those newfangled wireless telephones with cameras and tape recorders.

Typical questions at the PSC counter in a DSP office:
Name
Date of birth
Place of birth
Address
Telephone number
PPS Number
Mother's name
Mother's date of birth
Father's name
Father's date of birth
Are you in receipt of a payment from the Department of Social Protection?

The real issue in this thread is whether the individual's privacy rights are being impinged by being asked questions of a personal or sensitive nature in circumstances where the answers might be overheard.

Are a person's privacy rights being impinged in that situation?

No, they aren't.

When the questions are being asked in a situation where there is a power imbalance, I would beg to differ. "Oh you want to discuss your situation in a private officer? Sure, we'll schedule your appointment with the homeless service next month."

Marcusm

hullaballoo wrote: »

I don't think it applies. It doesn't apply. I cannot see how answering the question, "Does the DPA apply" with, "no" could be considered ambiguous.

It isn't really a matter for argument so I am unsure how I could further back up what I have set out.

Anyway, we've gotten to the crux of it in the end. Data Protection only protects data, which is capable of being processed and relates to the person. Words in the air are not data.

The real issue in this thread is whether the individual's privacy rights are being impinged by being asked questions of a personal or sensitive nature in circumstances where the answers might be overheard.

Are a person's privacy rights being impinged in that situation?

No, they aren't.

Surely the individual choosing to answer the questions in a public arena amounts to a disclosure by the individual to the public and not by any putative processor in any event?

Victor

Marcusm wrote: »

Surely the individual choosing to answer the questions in a public arena amounts to a disclosure by the individual to the public and not by any putative processor in any event?

In a power imbalance, one step away from bullying and under duress.

EternalHope

coylemj wrote: »

This 'someone' that you're listening to sounds like they're a bit paranoid and they don't know what they're talking about. That 'SAFE' environment includes the room where I had my identification documents checked and my photo taken for the new public services card, it was a small interview room in my local social welfare office (there's two such rooms set aside in Dun Laoghaire) and there's nobody there except you and the official.

Maybe 'you' should have gone to Aimien Street http://www.askaboutmoney.com/threads/safe-registration-for-a-public-services-card.184043/page-2#post-1392928

hullaballoo

Victor wrote: »

They are data, especially when overheard and written down or recorded on one of those newfangled wireless telephones with cameras and tape recorders.

Spoken words are not data. If they are committed to record by a data controller/processor, that's totally different. For the purposes of this thread, the question relates to whether the DPAs apply to an overheard conversation and they do not.

Typical questions at the PSC counter in a DSP office:
Name
Date of birth
Place of birth
Address
Telephone number
PPS Number
Mother's name
Mother's date of birth
Father's name
Father's date of birth
Are you in receipt of a payment from the Department of Social Protection?

The answers to these questions are undoubtedly personal information as defined by the Acts but there are many other necessary elements before the DPAs take effect and they are not present in the example given here.

When the questions are being asked in a situation where there is a power imbalance, I would beg to differ. "Oh you want to discuss your situation in a private officer? Sure, we'll schedule your appointment with the homeless service next month."

This is becoming problematic because it's tantamount to misinformation and it could become dangerous for anyone reading this who might seek to rely on a comment like the above.

The relative footing of the parties involved here has no impact on whether or not one party's privacy rights are being infringed. Whether there's a perceived or real power imbalance is totally irrelevant.

gizmo555

hullaballoo wrote: »

Anyway, we've gotten to the crux of it in the end. Data Protection only protects data, which is capable of being processed and relates to the person. Words in the air are not data.

If a person at a public counter is discussing their personal details with an official, presumably the official will either be referring to records already in existence, or will be using the information provided to create or update records. To that extent, the Data Protection Acts likely would apply and requiring the person to discuss these details in an open public space is arguably a breach of the obligation to keep the data safe from unauthorised access.

If you want to find out for sure, you could make a complaint to the Data Protection Commissioner. She is obliged to investigate and give a decision and there is no charge for making a complaint.

PS - the decision of the Data Protection Commissioner in Mick Wallace's complaint against Alan Shatter would seem to indicate that details being discussed in the above way likely would be held to be a breach of the duty to secure the data.

hullaballoo

Who's requiring that?

gizmo555

hullaballoo wrote: »

Who's requiring that?

I don't know if anyone is being required to, but from the description in the OP it seemed possible.

So, if people availing of public services are being required to discuss their personal details with officials in open public spaces where the conversations could be overheard, in my opinion there could be an arguable basis to take a complaint to the Data Protection Commissioner. And as I said, she would be obliged to investigate and give a decision.

Uno my Uno.

gizmo555 wrote: »

I don't know if anyone is being required to, but from the description in the OP it seemed possible.

So, if people availing of public services are being required to discuss their personal details with officials in open public spaces where the conversations could be overheard, in my opinion there could be an arguable basis to take a complaint to the Data Protection Commissioner. And as I said, she would be obliged to investigate and give a decision.

I disagree.

You need to examine the act to see specifically to who it applies and what obligations it places on this people or organizations. As stated above the act relates to "data" only and places obligations on how it is controlled transmitted etc. spoken words or a conversation are not data as defined by the act. It is possible that any notes or records of that conversation could be data and in that case the act would apply but only to the notes and not the conversation itself.

gizmo555

Uno my Uno. wrote: »

I disagree.

You need to examine the act to see specifically to who it applies and what obligations it places on this people or organizations. As stated above the act relates to "data" only and places obligations on how it is controlled transmitted etc. spoken words or a conversation are not data as defined by the act.

Well, as I said, it's just my opinion and for a definitive decision you'd need to go to the Commissioner. However, Alan Shatter's disclosure about Mick Wallace was spoken word, yet it still resulted in an adverse finding against him by the then Commissioner Billy Hawkes for breaching Wallace's data protection rights.

Uno my Uno. wrote: »

It is possible that any notes or records of that conversation could be data and in that case the act would apply but only to the notes and not the conversation itself.

Clearly, the decision in the Shatter case contradicts this.

hullaballoo

Is a DPC finding definitive? I would have thought findings of law were the sole preserve of the courts but I might be old-fashioned.

gizmo555

hullaballoo wrote: »

Is a DPC finding definitive? I would have thought findings of law were the sole preserve of the courts but I might be old-fashioned.

No, the complainant and respondent both have the right of appeal through the courts, which Mr Shatter availed of. He was unsuccessful in the Circuit Court and is appealing this decision to the High Court.

http://www.irishtimes.com/news/politics/alan-shatter-to-appeal-data-protection-case-to-high-court-1.2091418

Uno my Uno.

gizmo555 wrote: »

Well, as I said, it's just my opinion and for a definitive decision you'd need to go to the Commissioner. However, Alan Shatter's disclosure about Mick Wallace was spoken word, yet it still resulted in an adverse finding against him by the then Commissioner Billy Hawkes for breaching Wallace's data protection rights.



Clearly, the decision in the Shatter case contradicts this.

No it doesn't, and I don't think that is controversial. Mr Shatter's disclosure was spoken but the data he disclosed was not, hence the application of the act. A conversation with the person who is the subject of the data does not involve a disclosure.

If you haven't examined the act and its application your opinion is somewhat baseless is it not?

Tom Young

The definition of Data under the 1988 Act answers the question properly.

A No is a correct answer in so far as conversations published, but not recorded.

Once a note, record, etc. exists, then matters change.

Taking a simplistic view of the OP query, I'd say No, but suggest based on the nature of the publication/discussion there may be a reasonable expectation of confidence and/or privacy in terms of those discussions.

It is often the case in banks, etc. that people are over liberal in terms of not protecting their transactions and data required to complete same.

OP: question is correctly answered in the negative. Grey area occurs where information is recorded and stored, the DPA applies - Controller and Processor engaged as recipients of data conveyed.

The grey area is a reasonable expectation and confidence and privacy which I think should fall to the agent to use his or her discretion in transacting with clients.

gizmo555

Uno my Uno. wrote: »

No it doesn't, and I don't think that is controversial. Mr Shatter's disclosure was spoken but the data he disclosed was not, hence the application of the act. A conversation with the person who is the subject of the data does not involve a disclosure.

The scenarios outlined by the OP were ones in which third parties could overhear the conversations with officials and the personal information discussed. To the extent that any of that personal information is or will be recorded as personal data, in my opinion allowing a situation where it could be overheard may amount to a breach of the duty to secure the data.

Uno my Uno. wrote: »

If you haven't examined the act and its application your opinion is somewhat baseless is it not?

I have examined the act and its application, in detail. Have you?

Marcusm

gizmo555 wrote: »

The scenarios outlined by the OP were ones in which third parties could overhear the conversations with officials and the personal information discussed. To the extent that any of that personal information is or will be recorded as personal data, in my opinion allowing a situation where it could be overheard may amount to a breach of the duty to secure the data.



I have examined the act and its application, in detail. Have you?

I could see your point where the official was disclosing the private information; eg are you unhappy to continue to receive disability allowance? In general, I would have thought that the answers given by officials at inquiry counters are likely to be the application of rules to facts provided by the member of the public. Such as an answer to a question as to whether they might qualify for something or other. Perhaps if a person was legitimately inquiring on behalf of another then the official might be disclosing data but in general, I don't see the scenario in which they would. Unlikely that the official would, for example, read out an individual's employment or personal history.

gizmo555

Marcusm wrote: »

In general, I would have thought that the answers given by officials at inquiry counters are likely to be the application of rules to facts provided by the member of the public. Such as an answer to a question as to whether they might qualify for something or other.

This was not one of the scenarios outlined by the OP. Both of the OP's scenarios would necessarily have involved the officials concerned recording at least some of the information provided.

Marcusm

gizmo555 wrote: »

This was not one of the scenarios outlined by the OP. Both of the OP's scenarios would necessarily have involved the officials concerned recording at least some of the information provided.

When they record it, it becomes data subject to DPA. Until disclosed by the member of the public it is not in the possession or control of the data controller. How could the utterance of the data by the member of the public be an inappropriate disclosure by the putative data controller.

Uno my Uno.

gizmo555 wrote: »

The scenarios outlined by the OP were ones in which third parties could overhear the conversations with officials and the personal information discussed. To the extent that any of that personal information is or will be recorded as personal data, in my opinion allowing a situation where it could be overheard may amount to a breach of the duty to secure the data.



I have examined the act and its application, in detail. Have you?

I have examined it, at great length, I sat and passed an exam on it as well.

Might a conversation be overheard? Possibly but I don't believe that amounts to a breach of the Act.

gizmo555

Uno my Uno. wrote: »

I have examined it, at great length, I sat and passed an exam on it as well.

Good for you. Me too.

gizmo555

Marcusm wrote: »

How could the utterance of the data by the member of the public be an inappropriate disclosure by the putative data controller.

Because the Data Protection Acts apply to the processing of personal data. "Processing" is defined in the legislation as:

(a) obtaining, recording or keeping the information or data,
(b) collecting, organising, storing, altering or adapting the information or data,
(c) retrieving, consulting or using the information or data,
(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or
(e) aligning, combining, blocking, erasing or destroying the information or data;

If I ask you "What's your name please?" with the intention of recording your reply and you answer "Marcus", I am obtaining personal data about you. And, in my opinion, this may amount to a breach of my duty to secure the data, if third parties can readily overhear our conversation.

Also, I might refer to personal data already recorded about you in the course of the conversation, e.g., "Is your address 1 High Street, Ballygobackwards?"

EternalHope

Marcusm wrote: »

I could see your point where the official was disclosing the private information; eg are you unhappy to continue to receive disability allowance? In general, I would have thought that the answers given by officials at inquiry counters are likely to be the application of rules to facts provided by the member of the public. Such as an answer to a question as to whether they might qualify for something or other. Perhaps if a person was legitimately inquiring on behalf of another then the official might be disclosing data but in general, I don't see the scenario in which they would. Unlikely that the official would, for example, read out an individual's employment or personal history.

in my first scenario

Someone told me they had to go to a council office to report some problem with their house and others in the queue could hear them.

are they not having to give detail. Your name? John Smith? address a t which the problem is? 1 any street, anytown. is this not being recorded so the staff member can pass it on?

In the other scenario

Someone also said they need to go to a SAFE registration at welfare and may be interviewed at a counter where personal details will be given/may be overheard.

They have to bring identification and so the conversation will be something
I have come to register
Your name? John Smith
your address? i any street any town
and you have evidence you live at 1 any street anytown?
and your mother's maiden name was?
bloggs

Is this not being recorded and stored?

brian_t

EternalHope wrote: »

in my first scenario
are they not having to give detail. Your name? John Smith? address a t which the problem is? 1 any street, anytown. is this not being recorded so the staff member can pass it on?

In the other scenario They have to bring identification and so the conversation will be something
I have come to register
Your name? John Smith
your address? i any street any town
and you have evidence you live at 1 any street anytown?
and your mother's maiden name was?
bloggs

Is this not being recorded and stored?

If this is been overheard by others in the queue then aren't they hearing it firsthand from you.

The staff member has no responsibility for this.

gizmo555

brian_t wrote: »

If this is been overheard by others in the queue then aren't they hearing it firsthand from you.

The staff member has no responsibility for this.

The staff member may not, but the organisation does.

Victor

Marcusm wrote: »

When they record it, it becomes data subject to DPA. Until disclosed by the member of the public it is not in the possession or control of the data controller. How could the utterance of the data by the member of the public be an inappropriate disclosure by the putative data controller.

No. The department has all the information already. They are essentially cross-examining the client.