Do Citylink have the right to request your PPS number?

0byme75341jo28

I was reserving a seat for a relative of mine with a travel pass, and noticed they have a new policy of requesting the PPSN of the pass holder along with the pass number (which they had always requested). Are they allowed do this? We have no issue with the principle of the idea and understand that they need to minimise abuse of the system. However, a person's PPSN is a very important piece of private information and I'm concerned about the storage of it and who has access to it.

I thought there were some regulations on who can request your PPSN. Do they have the right to do this?

L1011

Almost certainly not. Contact the DSP and Data Protection

thomasj

Almost certainly not , id say contact the data protection commission.

The new gdpr laws are coming in on April 25th. With this current practice , citylink could be in a spot of bother.

magicbastarder

as far as i can remember, GDPR means requests to access and hold data must be proportionate; so they could only request your PPS if they had a damn good reason for it that's not served by other identifying info you could give them.

listermint

magicbastarder wrote: »

as far as i can remember, GDPR means requests to access and hold data must be proportionate; so they could only request your PPS if they had a damn good reason for it that's not served by other identifying info you could give them.

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

L1011

listermint wrote: »

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

The PPS number has pre-existing legal restrictions on who can ask for it; and "transport operator" isn't one of them.

It was very specific that the PPS number was not to become a catch-all identifier like the US SSN.

Glass fused light

listermint wrote: »

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

How is the bus company getting access to use the PPS number to verify eligibility for a free travel pass?

L1011 wrote: »

The PPS number has pre-existing legal restrictions on who can ask for it; and "transport operator" isn't one of them.

Per above If the passenger is entitled to the travel pass its up to the passenger to do the legwork.

Under the current legistation they have a problem as they already collect the free pass number, so even if they could collect the number collecting both would be excessive data collection.

L1011 wrote: »

It was very specific that the PPS number was not to become a catch-all identifier like the US SSN.

Freudian slip.

goingnowhere

Transport operators have a right to inspect the travel pass ID

It was routine in Irish Rail to enter the last 6 digits of the pass number into the ticket machine and this would print on the ticket, this is legally acceptable as to link the ticket to the pass in use. Aircoach again do similar

The transport operators are fully entitled to contact the DSP and validate details of any pass provided and have been provided with a dedicated phone number for same.

There has been an ongoing issue as to how to regulate the mess that is the free travel scheme, in simple terms it would be permissible to

send to DSP, first name, last name, card number
and get back
Valid for FTP,
Not valid

The card readers do this and leave the inspector to visually confirm photo matches.


The question is, is this a reasonable and justified request? Validation that the card holder is entitled to avail of the free travel scheme seems perfectly legitimate

0byme75341jo28

goingnowhere wrote: »

Transport operators have a right to inspect the travel pass ID

It was routine in Irish Rail to enter the last 6 digits of the pass number into the ticket machine and this would print on the ticket, this is legally acceptable as to link the ticket to the pass in use. Aircoach again do similar

The transport operators are fully entitled to contact the DSP and validate details of any pass provided and have been provided with a dedicated phone number for same.

There has been an ongoing issue as to how to regulate the mess that is the free travel scheme, in simple terms it would be permissible to

send to DSP, first name, last name, card number
and get back
Valid for FTP,
Not valid

The card readers do this and leave the inspector to visually confirm photo matches.


The question is, is this a reasonable and justified request? Validation that the card holder is entitled to avail of the free travel scheme seems perfectly legitimate

It's perfectly okay for them to request the pass number, I don't think any reasonable person would think otherwise. The issue we have is specifically with the requirement to give up your PPS number in order to book in advance, which in my opinion is an entirely different kettle of fish and comes with some very obvious data protection concerns. Of course they have the right to inspect any free travel passes and perform any checks with the DSP to ensure it is valid. However, a private company should have no access to anyone's actual PPS numbers.

testicles

This post has been deleted.

Wheety

They're not on the list of authorised users of PPSN.

http://www.welfare.ie/en/Pages/Personal-Public-Service-Number-Register-of-Users.aspx

Or what testicles said.

schemingbohemia

Are they not looking for the PPSN to verify that the Pass number is correctly corresponding to the right pass? Bit of a double check but I would have thought certainly within the bounds of appropriate.

goingnowhere

Just remember the transport operator is under contract to accept the FTP and thus is acting as an agent of the DSP

coylemj

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

goingnowhere

coylemj wrote: »

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

The operator gets the card number and types and confirms that it is valid (in date and not blacklisted). No real difference than an annual ticket.

0byme75341jo28

coylemj wrote: »

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

In my OP I'm referring to online booking, to reserve a seat in advance.

Citylink don't actually swipe the cards on the bus, I don't think they currently have the ability to do so. The driver just looks at the photo to ensure it is being used by the correct person and gives the pass holder an "FTP" paper ticket.

testicles

This post has been deleted.

Glass fused light

testicles wrote: »

This post has been deleted.

It does have to do with data protection, per their webpage
https://www.citylink.ie/useful-info/free-travel-pass

Please note when boarding the coach you must present your valid FTP card.  
In line with Department of Employment Affairs and Social Protection requirements details of your pass and PPS number will be recorded by the driver.

The company is collecting personal data both on their web page and by the driver of the bus. They are processing and storing it in an unspecified way and are and claiming that it is in line with departmental requirements.

If the company has not been instructed by the department to collect the data the Data Protection Commissioner should be informed so that the process and procedure for data collection and storage of data and security related to the same are examined.

What they are collecting :
Name First and last
PPS no
PPS card number
Phone no
Email address
Bank Card no
Expiry date
Security number
And the name on the card used

This data is mainly from non computer savvy people.

Missing data for full ID theft : Home address and Birth date and sex.

If the company have been instructed the Data Protection Commissioner needs to contact both the company and the department.

Glass fused light

Power Stance Inspector Paul wrote: »

they are probably selling your information to crooks to commit fraud.

Don't have to sell it, just have to have a target rich enviroment and poor IT security and a tech savvy crook will collect it for free from the website or lift it from the bus.

quin4105

L1011 wrote: »

Almost certainly not. Contact the DSP and Data Protection

Citylink do have the right to right to ask for the PPS as they are acting on the behalf of social protection for the FTP. Just ring up the the department of social protection and ask them at 071-911-3673.

L1011

I'd far prefer the DPCs opinion on that. DSP can't just decide to hand out access rights to it themselves and feature creep is specifically legislated against

Fred Swanson

This post has been deleted.

AlekSmart

quin4105 wrote: »

Citylink do have the right to right to ask for the PPS as they are acting on the behalf of social protection for the FTP. Just ring up the the department of social protection and ask them at 071-911-3673.

Many appear to forget that the Free Travel Scheme is not a compulsory element of Irish Public Transport.
Obviously,the State Operators are fully engaged with the scheme,with Bus Atha Cliath electronically recording ALL DSP Customers details for each journey made.
Private operators,however,enter the scheme on an individual basis,with each company negotiating with the DSP regarding the extent of their concession.
Equally,each of the Private Operators agree a financial package with the DSP,which may be substantially different from another operator on the same corridor.
If Citylink's contract with the DSP specifies the recording of individual numbers to ensure payment,then so be it.
If a DSP customer is sufficently concerned,I suggest they refuse to provide their PPS Number,pay the requested fare,and subsequently request repayment from the DSP.
It will be interesting to see the outcome ?

You can always just file a GDPR request with Citylink to see what they are doing with your data

monument

testicles wrote: »

This post has been deleted.

Your post makes me think that you don't fully understand:

(1) GDPR
(2) The function of oversight of the Data Protection Commissioner.

testicles

This post has been deleted.

XPS_Zero

You are all confusing the travel pass number with the pps number


The bus company can ABSOLUTELY demand the former (ffsake it's detected on their machines when you place your card on them!), you have to give it to Translink every time you get a bus or a train to the north! BUT I've seen them frequently write down the pps number instead, confused. It's a frequently confused thing it seems.


The pps number can access secure info (if you had access to a govt computer anyway....it's not much use without that I'm not aware of any services where you can access them JUST with a pps number)


The FT scheme is funded by a block grant they are not paid fare by fare BUT some companies (like Swords Express used to) keep a record of FT pass usage on their services (and the method is recording the card number) because during the recession years DSP underpaid both CIE and private sector companies leading to both giving a DE FACTO subsidy to the FT system with their other fares, something only corrected in the last two budgets.


So it's perfectly ok to give them the travel card number. I do it every single time I go up north.

On the back of the card the PPS is on the left and the card number is on the right. That's the number they are supposed to record.

0byme75341jo28

XPS_Zero wrote: »

You are all confusing the travel pass number with the pps number


The bus company can ABSOLUTELY demand the former (ffsake it's detected on their machines when you place your card on them!), you have to give it to Translink every time you get a bus or a train to the north! BUT I've seen them frequently write down the pps number instead, confused. It's a frequently confused thing it seems.


The pps number can access secure info (if you had access to a govt computer anyway....it's not much use without that I'm not aware of any services where you can access them JUST with a pps number)


The FT scheme is funded by a block grant they are not paid fare by fare BUT some companies (like Swords Express used to) keep a record of FT pass usage on their services (and the method is recording the card number) because during the recession years DSP underpaid both CIE and private sector companies leading to both giving a DE FACTO subsidy to the FT system with their other fares, something only corrected in the last two budgets.


So it's perfectly ok to give them the travel card number. I do it every single time I go up north.

On the back of the card the PPS is on the left and the card number is on the right. That's the number they are supposed to record.

But Citylink require you to enter the PPS number on their online form to reserve a seat. That's the issue here, whether they should be allowed request for such important personal information.

monument

testicles wrote: »

Unfortunately for you, I understand both intimately. Also, it's the Data Protection Commission these days.

It really doesn’t matter what they’re called after the rebrand, the point the authority is the one the public can complain to when there is a data protection issue and there is no requirement to go to the department first.

As ever, I’m open to correction.

AlekSmart

Coleman Agreeable Winter wrote: »

But Citylink require you to enter the PPS number on their online form to reserve a seat. That's the issue here, whether they should be allowed request for such important personal information.

There is a workaround for those who see the request as oppressive......One Can pay the appropriate fare and remain totally anonymous ?

Fred Swanson

This post has been deleted.

testicles

This post has been deleted.

monument

testicles wrote: »

This post has been deleted.

This is the summery of the principles of and rights under GDPR from the DPC:

The GDPR is based on the core principles of data protection which exist under the current law. These principles require organisations and businesses to:

collect no more data than is necessary from an individual for the purpose for which it will be used;
obtain personal data fairly from the individual by giving them notice of the collection and its specific purpose;
retain the data for no longer than is necessary for that specified purpose;
to keep data safe and secure; and
provide an individual with a copy of his or her personal data if they request it.
Under the GDPR individuals have the significantly strengthened rights to:

obtain details about how their data is processed by an organisation or business;
obtain copies of personal data that an organisation holds on them;
have incorrect or incomplete data corrected;
have their data erased by an organisation, where, for example, the organisation has no legitimate reason for retaining the data;
obtain their data from an organisation and to have that data transmitted to another organisation (Data Portability);
object to the processing of their data by an organisation in certain circumstances;
not to be subject to (with some exceptions) automated decision making, including profiling.

Are you really trying to claim that there's a full GDPR exception for all matters PPS Numbers? Maybe there is -- I'm asking this question and open to a yes or no answer.

As above, I'm open to correction, but my take from what I've read and heard from data protection experts is that GDPR covers PPS numbers. This extends to any body or company misusing PPS numbers being open to being fined under GDPR.

barefoot

I too tried to reserve a seat with Citylink this week. I filled in the details requested but stopped when asked for PPS number. Like most of you posting here I immediately knew it was a goof-up on someone's part. I made a number of phone calls and eventually made a complaint to the 'powers that be.'....government department. I checked Citylink website again tonight and I am happy to report the PPS number is no longer requested.

AlekSmart

barefoot wrote: »

I too tried to reserve a seat with Citylink this week. I filled in the details requested but stopped when asked for PPS number. Like most of you posting here I immediately knew it was a goof-up on someone's part. I made a number of phone calls and eventually made a complaint to the 'powers that be.'....government department. I checked Citylink website again tonight and I am happy to report the PPS number is no longer requested.

Did your "Power that is" confirm a change of policy on the Company's or DSP behalf ?

I note that the specific warning regarding PPS number remains on the Citylink website ?

https://www.citylink.ie/useful-info/free-travel-pass

Please note when boarding the coach you must present your valid FTP card.
In line with Department of Employment Affairs and Social Protection requirements details of your pass and PPS number will be recorded by the driver.

yenom

I would suggest you send this to Social Welfare's Client Identity Services. They wouldn't be happy with this. All the bus company should need is your name and PSC number.

AlekSmart

Some time ago,I had a conversation with an FTP holder who was giving out yards about having to pay to visit his daughter in Northern Ireland.

I,enthusiastically pointed out that he could indeed travel free "up there" by getting a Northern Irish Senior Smart Card,available to holders of OAP Free Travel Passes down South.

The Gentleman,informed me very tersely,that he would NEVER ! apply to agents of the British Crown for permission to travel in his own Country.

It never dawned on him,it seems,that he was prepared to pay his own money directly into the Crown Purse,via Translink...rather than having the broader Irish population make the payment on his behalf....

Public Transport makes people behave in strange,often illogical ways.....;)

XPS_Zero

It seems obvious someone asked for the wrong number at the bus company hence the change.

I really don't see it being a big deal that they have it through tbh, you are using a social welfare program (Free Travel) and they are a provider of that program, when you use Jobseekers or Disability or PTJIS you give your pps, I don't see why this would be different.
The DSP do tell you when they give you the card to not give you PPS to anyone so I understand the OPs concerns, though I do find the reaction to this stuff a little over the to, like the (mostly incredibly stupid) overreaction to the new PSC cards:

"MY PPS NUMBER IS ON THAT WHAT IF I LOSE IT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" ...yeh...your pps was on the old cards too.

"theres biometrics on that card!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
1. So what if there was? Do you care that you use a fingerprint to open your iphone? Did you go ballistic over that? Did you go ballistic when the US customs and border protection agency photographed and fingerprinted you entering the USA? Why are you afraid of your own govt having it if yo uare not bothered by apple or the US govt (which is presenting turning towards outright fascism) having it?
2. Do you remember the DSP taking your fingerprints? No cos it didn't happen. Not a bad idea though. The photo is of a type that can go through facial recognition and the card is CAPABLE of holding biometrics like prints, hence that term.

The question is not do they have it it's how secure it is from hacking by people who might abuse it.

They ought to be taking the card number, that is enough. They don't need a pps number. They don't bill for FT cards individually they get a block grant. They might monitor their own user levels but they should be taking the card number not the actual pps number.




You don't actually need the NI smart pass to go up north, you only require that for travel WITHIN northern ireland. You can go cross border on bus or train with the irish card. The SmartPass is better though because instead of having to write out a ticket on the bus you can put it on the card reader and it just bings like a Leap card. Of course their readers are not set up for DSP cards only the NI one.

I should point out that you can book for a DSP pass a seat on IE (for a fee) and on Translink bus and train (without a fee , you get a ticket but no gaurenteed seat) online and neither of them ask you for either the card number or pps. It seems a little unreasonable for them to ask for the pps number IMO. Online you should just be able to get the ticket with the card number or without anything and the driver ask you for the pass, regardless of any online booking or seperate ticket you are meant to have the chip card on you at all times so they can check that at their leasure, they even have a number on the back they can call to verify the cards current status if they've any doubts.
So on all levels there really is no reason for them to have your pps number.

AlekSmart

XPS_Zero wrote: »

It seems obvious someone asked for the wrong number at the bus company hence the change.

I really don't see it being a big deal that they have it through tbh, you are using a social welfare program (Free Travel) and they are a provider of that program, when you use Jobseekers or Disability or PTJIS you give your pps, I don't see why this would be different.
The DSP do tell you when they give you the card to not give you PPS to anyone so I understand the OPs concerns, though I do find the reaction to this stuff a little over the to, like the (mostly incredibly stupid) overreaction to the new PSC cards:

"MY PPS NUMBER IS ON THAT WHAT IF I LOSE IT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" ...yeh...your pps was on the old cards too.

"theres biometrics on that card!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
1. So what if there was? Do you care that you use a fingerprint to open your iphone? Did you go ballistic over that? Did you go ballistic when the US customs and border protection agency photographed and fingerprinted you entering the USA? Why are you afraid of your own govt having it if yo uare not bothered by apple or the US govt (which is presenting turning towards outright fascism) having it?
2. Do you remember the DSP taking your fingerprints? No cos it didn't happen. Not a bad idea though. The photo is of a type that can go through facial recognition and the card is CAPABLE of holding biometrics like prints, hence that term.

The question is not do they have it it's how secure it is from hacking by people who might abuse it.

They ought to be taking the card number, that is enough. They don't need a pps number. They don't bill for FT cards individually they get a block grant. They might monitor their own user levels but they should be taking the card number not the actual pps number.


You don't actually need the NI smart pass to go up north, you only require that for travel WITHIN northern ireland. You can go cross border on bus or train with the irish card. The SmartPass is better though because instead of having to write out a ticket on the bus you can put it on the card reader and it just bings like a Leap card. Of course their readers are not set up for DSP cards only the NI one.

My customer was a regular traveller to Northern Ireland and well aware of the extent and nature of his Irish Free Travel Entitlement,however as both of his children lived in different locations within Northern Ireland,his internal local travel there was substantial.

Essentially,as with many within Public Transport,all he wanted to do was give-out about stuff......no real interest in the actual workings,but kinda quite satisfied that he had a nice juicy "reason" to be aggrieved

XPS_Zero

AlekSmart wrote: »

My customer was a regular traveller to Northern Ireland and well aware of the extent and nature of his Irish Free Travel Entitlement,however as both of his children lived in different locations within Northern Ireland,his internal local travel there was substantial.

Essentially,as with many within Public Transport,all he wanted to do was give-out about stuff......no real interest in the actual workings,but kinda quite satisfied that he had a nice juicy "reason" to be aggrieved

Yes I do see the irony. The cash is going to them one way or the other, either via his taxes or via a direct fare. If he bought a paper and a bottle of water in the station on his way up the VAT was going in the block grant to Translink as part of the regular income sharing deals.

THe other thing is it's not really goning to the "British" per say. Translinks a NI service run by a power sharing executive that includes plenty of green Irish folk, and of course transports an area overseen by the north-south council (intended to be en embryonic all Island govt with powers gradually added) which includes...THE IRISH GOVERNMENT!


Plus Translink don't make a profit and send their cash to the Brits, the Brits have to give the north a massive block grant. Translnk also includes a raft of Irish citizens working for it that those fares and FT block grants help pay their wages.


Then there is the joint IE-Translink staff on Enterprise where you are as likley to get a conducters accent greeting you with nerth sida dubLin dere as you are a Shankill road twang aye!

You'd think he'd be all in favor of turfing cash to the Enterprise since it's the kind of project that brings both sides of the coin together and breaks down the barriers! Guess he was one of these types who thinks a united ireland will be a "cut and paste onto the south" job rahter than a combination thing, which is how it will actually go.

Irish people are professional moaners and whingers, no better race on earth.