EFlow - Are they GDPR compliant ?

DjTaz

I passed through the toll bridge last week and i am not registered on their system , now i dont do this very often but it was 5 in the morning and i forgot to pay the toll as unregistered , and i got a letter in the post today.
All well and good , i paid the fine , but it got me thinking ... how did they get my name and address ?

Surely this is private information and its being shared with a public company ... don't the new European laws cover the sharing of information against my will between companies ?

Just wondering as i thought it was strange that they can track me down so easily !

Any clarifications are welcome as i really haven;t done much research on this at all, but it made me wonder.

Thanks all.

wench

Consent is only one of the ways data can be shared, and generally the weakest basis.
The setting up of the barrier free toll and associated data needs is covered by legislation instead

https://www.eflow.ie/help-guidance/faqs/the-m50-toll-road/data-protection/

magicbastarder

DjTaz wrote: »

Just wondering as i thought it was strange that they can track me down so easily !

it's almost like you were driving round in public with some sort of identification mark on your car whose purpose is was to be able to track you down if you did something you shouldn't have done!

dudara

There are several bases in the GDPR which organisations can use to justify sharing or processing your data. Consent is one of these justifications, but there are others such as being able to provide service under a contract or for legitamite reasons of the business.

But there was also a lot of data protection law before the GDPR, so eFlow was set up with appropriate legal cover to be able to get data, in order to collect unpaid fines etc.

DjTaz

magicbastarder wrote: »

it's almost like you were driving round in public with some sort of identification mark on your car whose purpose is was to be able to track you down if you did something you shouldn't have done!

But not by any company who wants to track me down. I havent broken any laws , so what gives them the right to access my information from a third party

dudara

DjTaz wrote: »

But not by any company who wants to track me down. I havent broken any laws , so what gives them the right to access my information from a third party

You had forgotten to pay the toll, so they were entitled to follow up. The legislation under which the toll roads were set up grants them that right. See the link shared above

The operation of this system involves limited access by a private entity (emovis operations Ireland) to official vehicle ownership data, but an appropriate legislative basis exists for such access (under the provisions of the relevant Roads Acts).

DjTaz

dudara wrote: »

You had forgotten to pay the toll, so they were entitled to follow up. The legislation under which the toll roads were set up grants them that right. See the link shared above

Thanks Dudara ,
I'm reading the links now, but i think they may be in breach of European Privacy laws, ill keep checking.

dudara

I’d be interested to hear how you think they’re in breach, because I’d be 99.9% certain they are compliant.

DjTaz

dudara wrote: »

I’d be interested to hear how you think they’re in breach, because I’d be 99.9% certain they are compliant.

I dont think they conform to section 2 or Section 2a


Section 2
As a minimum to ensure fair processing, the person must be appropriately informed in accordance with the requirements of Section 2(1)a of the Acts as outlined in more detail in Section 2D.This requires that the persons must be informed as to all uses that will be made of their data including to whom it will be disclosed.

Section 2A
Once appropriate and detailed information is supplied to all persons under the requirements of Section 2(1)(a) of the Acts, the additional conditions of Section 2A must also be met.Section 2A(1) relates to consent.Where this consent is sought as a condition for the provision of the service in question rather than on a purely optional basis, then the strong view of the Commissioner is that it is doubtful that it can be considered to be freely given and therefore should not normally be solely relied upon as a justification for the sharing of personal data.This is especially so where such sharing is on a systematic, routine basis.

dudara

Section 2a1 is about where consent is required. eFlow do not require your consent as they have a legislative basis to process your data, hence 2A1 does not apply to them.

Section 2 refers to the terms laid out in section 2D. Subsection 3 states that this does not apply

in any case where the processing of the information contained or to be contained in the
data by the data controller is necessary for compliance with a legal obligation to which the
data controller is subject other than an obligation imposed by contract, if such conditions as may be prescribed by regulations made by the Minister are complied with.

Let me put it another way and apply a bit of common sense here. You used the toll road, knowing that you are legally obliged to pay. Legislation has been enacted to allow for that to happen and eFlow are entitled to act as a Processor. GDPR and Data Privacy Laws allow for this scenario.

GerardKeating

DjTaz wrote: »

But not by any company who wants to track me down. I havent broken any laws , so what gives them the right to access my information from a third party

But you had, you did not pay the toll

magicbastarder

DjTaz wrote: »

so what gives them the right to access my information from a third party

you drove on a road you knew there was a toll levied on; that itself is consenting to be tolled, and an implicit acceptance of the Ts and Cs of not paying the toll.

if you stole a packet of cigarettes in a newsagent, would you bellyache if the newsagent shared the CCTV with the gardai in order to track you down?

Dravokivich

Data Protection is about controlling who has access to data. GDPR is about the harvesting of excessive data that is not/no longer required for services provided.

I don't see why you feel you've a valid concern regarding either of those. As all these are accessible solely based on your use of their service. If they've been shown to call up registration details to a vehicle that has not used the service, then it would be questionable. But generally that's only happened due to miss-identification, with partially obscured registration plates.