GDPR/Data Protection?

Runaude

I had work done on my car recently, the mechanic arrived and carried out the work with no problems. He took a photo of my car registration plate and of my driving license. Is this a breach of data protection laws?

The mechanic now has my photo id on his phone with so much personal data that can be used for identity fraud. Should I take this further or am I being paranoid? I paid in full and have no issues, I don't understand the need to have my ID on his phone?

fritzelly

Would take this to the highest court in the land, with a pic of your reg he could get a mortgage, credit card and god knows what in your name

Mod
Take it easy fritzelly.







Ps troll alert

Runaude

fritzelly wrote: »

Would take this to the highest court in the land, with a pic of your reg he could get a mortgage, credit card and god knows what in your name

Ps troll alert

What the hell are you talking about? It is a legitimate question? Some of us care about data protection, I assure you my question is in good faith. Your sarcasm doesn't help my situation. If I was sitting on your personal data how would you feel?

Del2005

Runaude wrote: »

What the hell are you talking about? It is a legitimate question? Some of us care about data protection, I assure you my question is in good faith. Your sarcasm doesn't help my situation. If I was sitting on your personal data how would you feel?

If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.

Runaude

Del2005 wrote: »

If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.

Normally I wouldn't but when your in a bind and tired and just want to go home you oblige. It seems to be a legit company but I doubt there data protection regulations are up to par when a mechanic takes a photo with his I assume personal mobile phone. I've contacted the data protection commissioners and await their reply.

Del2005

Runaude wrote: »

Normally I wouldn't but when your in a bind and tired and just want to go home you oblige. It seems to be a legit company but I doubt there data protection regulations are up to par when a mechanic takes a photo with his I assume personal mobile phone. I've contacted the data protection commissioners and await their reply.

Where did the mechanic do the work on the car? Your OP had the mechanic arrive and do some work, in this post you are looking to go home after the mechanic did some work?

Did you call out a mechanic to work on your car? If you did then he's most likely covering his behind by having a record of who he worked on the car for proof.

BTW having your personal data isn't a problem, loads of cameras have it already, it what they do with your data which is the important bit.

Cookie_Monster

i presume you would have done a walkaround of the vehicle with the mechanic and signed paperwork before any work carried out?, this paperwork will have t&c giving permission to use data, share with suppliers / manufacturers, see your licence etc. It's pretty standard in the industry

the_pen_turner

Surely he has this so he can carry out his job. That's the purpose of having customer data.

You can't just demand he delete it

Robbo

the_pen_turner wrote: »

Surely he has this so he can carry out his job. That's the purpose of having customer data.

You can't just demand he delete it

I'd regard this as being excessive. There's no earthly reason a mechanic would need to retain a copy of the customers driving licence for ordinary business purposes.

I can understand the need to verify a new customers ID/address but this is just asking for trouble. And then you have the method by which it was collected, by way of a phone's camera. Issues with the physical security of the data, whether any non-EU cloud services may be at play and who has access all present themselves.

Odyssey 2005

He may need the reg # in order to ensure he gets the correct parts Etc. As for a pic of my driving licence....
Harvey Smith to that idea.

Mrs OBumble

Del2005 wrote: »

If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.

You can request anything you want.

But if they have a legitimate reason for knowing who they worked for, they will just say "no" to your request.

I wonder what requirements Revenue place on mechanics.

brian_t

Odyssey 2005 wrote: »

He may need the reg # in order to ensure he gets the correct parts Etc. As for a pic of my driving licence....
Harvey Smith to that idea.

Any decent mechanic will order parts based on car/engine serial number.

rd1izb7lvpuksx

Cookie_Monster wrote: »

i presume you would have done a walkaround of the vehicle with the mechanic and signed paperwork before any work carried out?, this paperwork will have t&c giving permission to use data, share with suppliers / manufacturers, see your licence etc. It's pretty standard in the industry

You can't collect or process customer data without a statutory basis. If relying on consent, it must be informed consent - it can't be a condition hidden in terms & conditions. I work in this field (data protection) and a lot of industries are now waking up to the fact that their standard practices are no longer lawful.

the_pen_turner wrote: »

Surely he has this so he can carry out his job. That's the purpose of having customer data.

You can't just demand he delete it

Unless there's a very good reason why they need to keep the personal data, that's exactly what GDPR allows users to do.

Runaude

Just to clarify, the work was done at the side of the road. It was a 30 minute job. I paid by credit card over the phone and when the guy arrived he asked for ID. I was surprised he took a photo of it. I have raised the issue with the data protection commission and I'm waiting for there response. I cannot see any reason why they need this and I highly doubt it is kept in a secure manner.

L1011

Verification of membership or other eligibility (insurer) for the roadside work? Still a clumsy way to do it.

wiggle16

Mrs OBumble wrote: »

I wonder what requirements Revenue place on mechanics.

None. Why would they?

Del2005

Runaude wrote: »

Just to clarify, the work was done at the side of the road. It was a 30 minute job. I paid by credit card over the phone and when the guy arrived he asked for ID. I was surprised he took a photo of it. I have raised the issue with the data protection commission and I'm waiting for there response. I cannot see any reason why they need this and I highly doubt it is kept in a secure manner.

IMO the mechanic did nothing wrong. They were called to a job at the side of the road and they took picture of your ID to so that if they are ever faced with a criminal charge they are covered. If I was the mechanic I wouldn't be deleting the image till you turned up with a VLC to prove that you owned the car, but then they with VLC's being so easily faked they would need to keep a copy of the VLC you showed them!!

You are worried about data while the mechanic is worried about a criminal conviction, I think they have a valid reason to keep your data.

wiggle16

What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.

rd1izb7lvpuksx

wiggle16 wrote: »

What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.

Nah, you're way off here. If the data is of no value/use, then there's no rationale for the company storing it.

It's up to the company to declare how the store and process your data, and how it's secured. End users don't have to trust them - failure to declare why it's recorded/stored/processed alone is grounds to show that they aren't processing it lawfully. There's no reason to expect them to be following the law in other respects.

Finally, on your last point, the opposite is true. While people like you may not value their privacy or understand the implications of the data they hand over, that does not mean that the rest of us should accept this kind of behaviour. Driver's license images are classed are sensitive data under GDPR, and there are extremely strong controls around this class of data. The OP has every right to question why it was recorded and require it's deletion. There isn't a court or authority in the land that would deem it as legitimate or proportional.

Runaude

wiggle16 wrote: »

What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.

I'm not worried about what this mechanic is going to do. I'm concerned about why he has taken this sensitive data when it was not needed at all. How this data is stored, as I assume it was taken with his personal mobile phone. Who will this data be transmitted to? The information contained on a driving license is enough to make identity theft simple.


This was not a big company, I'm assuming a copy of my driving license is now just sitting in his picture gallery, unencrypted. Placed onto their work computer, unencrypted. Sent to however many people, copied however many times... can you not see why I would have an issue with this? I've worked for many organizations where their data protection protocol was laughable and out rightly dangerous in my view.



Maybe I am overthinking things, maybe not. I'm going to wait to see what the data protection commissioner has to say on this matter and then I'll act accordingly.

wiggle16

Bristol Spicy Springtime wrote: »

Nah, you're way off here. If the data is of no value/use, then there's no rationale for the company storing it.

Not what I meant. I meant there is no reason to suspect the mechanic of doing anything wrong or that he was up to something, which is what was implied when the OP referred to the mechanic having information of his which could be used in identity fraud. I can see the OP has since clarified that, apologies OP.

The photos are obviously of some value to the company in verifying that the car the mechanic fixed belonged to the person who was driving it, as pointed out earlier. Whether this is a general practice amongst roadside mechanics, I don't know, and whether or not it is permissible, I don't know either, but I suspect it is.

It's up to the company to declare how the store and process your data, and how it's secured. End users don't have to trust them - failure to declare why it's recorded/stored/processed alone is grounds to show that they aren't processing it lawfully. There's no reason to expect them to be following the law in other respects.

No disagreement with this, obviously.

Finally, on your last point, the opposite is true. While people like you may not value their privacy or understand the implications of the data they hand over, that does not mean that the rest of us should accept this kind of behaviour.

"people like you..." :rolleyes: you know nothing about me or my understanding of data protection. You are free not to "accept this kind of behaviour" if you wish, however, the fact that the behaviour in question takes the form of actions the mechanic is clearly required to take in order to do his job makes me hope you don't break down on a motorway any time soon. And I mean that sincerely.

Anyway I'm dragging this off topic so I'm bowing out. Have a nice weekend.

CIARAN_BOYLE

Runaude wrote: »

I'm not worried about what this mechanic is going to do. I'm concerned about why he has taken this sensitive data when it was not needed at all. How this data is stored, as I assume it was taken with his personal mobile phone. Who will this data be transmitted to? The information contained on a driving license is enough to make identity theft simple.


This was not a big company, I'm assuming a copy of my driving license is now just sitting in his picture gallery, unencrypted. Placed onto their work computer, unencrypted. Sent to however many people, copied however many times... can you not see why I would have an issue with this? I've worked for many organizations where their data protection protocol was laughable and out rightly dangerous in my view.



Maybe I am overthinking things, maybe not. I'm going to wait to see what the data protection commissioner has to say on this matter and then I'll act accordingly.

First off for them to take and store personal data they should have gotten you to consent. Did they? You mention that you let him take the pictures so I would presume this is consent.

Secondly I can see legitimate business reasons for them to take copies of your personal data.

For example have you paid. If the job will be claimed from insurance the insurer may demand evidence that the policy holder got the job done and not a 3rd party.