Do Citylink have the right to request your PPS number?

0byme75341jo28 · 04-05-2018 12:43AM #1

I was reserving a seat for a relative of mine with a travel pass, and noticed they have a new policy of requesting the PPSN of the pass holder along with the pass number (which they had always requested). Are they allowed do this? We have no issue with the principle of the idea and understand that they need to minimise abuse of the system. However, a person's PPSN is a very important piece of private information and I'm concerned about the storage of it and who has access to it.

I thought there were some regulations on who can request your PPSN. Do they have the right to do this?

L1011 · 04-05-2018 07:49AM

Almost certainly not. Contact the DSP and Data Protection

thomasj · 04-05-2018 08:26AM

Almost certainly not , id say contact the data protection commission.

The new gdpr laws are coming in on April 25th. With this current practice , citylink could be in a spot of bother.

magicbastarder · 04-05-2018 08:35AM

as far as i can remember, GDPR means requests to access and hold data must be proportionate; so they could only request your PPS if they had a damn good reason for it that's not served by other identifying info you could give them.

listermint · 04-05-2018 08:37AM

magicbastarder wrote: »

as far as i can remember, GDPR means requests to access and hold data must be proportionate; so they could only request your PPS if they had a damn good reason for it that's not served by other identifying info you could give them.

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

L1011 · 04-05-2018 09:44AM

listermint wrote: »

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

The PPS number has pre-existing legal restrictions on who can ask for it; and "transport operator" isn't one of them.

It was very specific that the PPS number was not to become a catch-all identifier like the US SSN.

Glass fused light · 04-05-2018 10:09AM

listermint wrote: »

Exactly if the company has a legitimate case for pps number let's say for example veryifing you are eligible for free travel then they can request it. They are obligated to treat that data with respect and dispose of it as t regular intervals as it's no longer required to store it.

How is the bus company getting access to use the PPS number to verify eligibility for a free travel pass?

L1011 wrote: »

The PPS number has pre-existing legal restrictions on who can ask for it; and "transport operator" isn't one of them.

Per above If the passenger is entitled to the travel pass its up to the passenger to do the legwork.

Under the current legistation they have a problem as they already collect the free pass number, so even if they could collect the number collecting both would be excessive data collection.

L1011 wrote: »

It was very specific that the PPS number was not to become a catch-all identifier like the US SSN.

Freudian slip.

goingnowhere · 04-05-2018 01:22PM

Transport operators have a right to inspect the travel pass ID

It was routine in Irish Rail to enter the last 6 digits of the pass number into the ticket machine and this would print on the ticket, this is legally acceptable as to link the ticket to the pass in use. Aircoach again do similar

The transport operators are fully entitled to contact the DSP and validate details of any pass provided and have been provided with a dedicated phone number for same.

There has been an ongoing issue as to how to regulate the mess that is the free travel scheme, in simple terms it would be permissible to

send to DSP, first name, last name, card number
and get back
Valid for FTP,
Not valid

The card readers do this and leave the inspector to visually confirm photo matches.

The question is, is this a reasonable and justified request? Validation that the card holder is entitled to avail of the free travel scheme seems perfectly legitimate

0byme75341jo28 · 04-05-2018 01:51PM

goingnowhere wrote: »

Transport operators have a right to inspect the travel pass ID

It was routine in Irish Rail to enter the last 6 digits of the pass number into the ticket machine and this would print on the ticket, this is legally acceptable as to link the ticket to the pass in use. Aircoach again do similar

The transport operators are fully entitled to contact the DSP and validate details of any pass provided and have been provided with a dedicated phone number for same.

There has been an ongoing issue as to how to regulate the mess that is the free travel scheme, in simple terms it would be permissible to

send to DSP, first name, last name, card number
and get back
Valid for FTP,
Not valid

The card readers do this and leave the inspector to visually confirm photo matches.

The question is, is this a reasonable and justified request? Validation that the card holder is entitled to avail of the free travel scheme seems perfectly legitimate

It's perfectly okay for them to request the pass number, I don't think any reasonable person would think otherwise. The issue we have is specifically with the requirement to give up your PPS number in order to book in advance, which in my opinion is an entirely different kettle of fish and comes with some very obvious data protection concerns. Of course they have the right to inspect any free travel passes and perform any checks with the DSP to ensure it is valid. However, a private company should have no access to anyone's actual PPS numbers.

testicles · 04-05-2018 02:00PM

This post has been deleted.

Wheety · 04-05-2018 02:03PM

They're not on the list of authorised users of PPSN.

http://www.welfare.ie/en/Pages/Personal-Public-Service-Number-Register-of-Users.aspx

Or what testicles said.

schemingbohemia · 04-05-2018 02:11PM

Are they not looking for the PPSN to verify that the Pass number is correctly corresponding to the right pass? Bit of a double check but I would have thought certainly within the bounds of appropriate.

goingnowhere · 04-05-2018 02:49PM

Just remember the transport operator is under contract to accept the FTP and thus is acting as an agent of the DSP

coylemj · 04-05-2018 03:34PM

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

goingnowhere · 04-05-2018 03:50PM

coylemj wrote: »

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

The operator gets the card number and types and confirms that it is valid (in date and not blacklisted). No real difference than an annual ticket.

0byme75341jo28 · 04-05-2018 04:14PM

coylemj wrote: »

The new system involves the free travel pass being stored on a PSC card so presumably when a passenger swipes their PSC card on a bus, the operator can (1) verify that it's a card containing a FTP and (2) read the PPS number?

In my OP I'm referring to online booking, to reserve a seat in advance.

Citylink don't actually swipe the cards on the bus, I don't think they currently have the ability to do so. The driver just looks at the photo to ensure it is being used by the correct person and gives the pass holder an "FTP" paper ticket.

testicles · 04-05-2018 04:56PM

This post has been deleted.

Glass fused light · 04-05-2018 05:41PM

testicles wrote: »

This post has been deleted.

It does have to do with data protection, per their webpage
https://www.citylink.ie/useful-info/free-travel-pass

Please note when boarding the coach you must present your valid FTP card.
In line with Department of Employment Affairs and Social Protection requirements details of your pass and PPS number will be recorded by the driver.

The company is collecting personal data both on their web page and by the driver of the bus. They are processing and storing it in an unspecified way and are and claiming that it is in line with departmental requirements.

If the company has not been instructed by the department to collect the data the Data Protection Commissioner should be informed so that the process and procedure for data collection and storage of data and security related to the same are examined.

What they are collecting :
Name First and last
PPS no
PPS card number
Phone no
Email address
Bank Card no
Expiry date
Security number
And the name on the card used

This data is mainly from non computer savvy people.

Missing data for full ID theft : Home address and Birth date and sex.

If the company have been instructed the Data Protection Commissioner needs to contact both the company and the department.

Glass fused light · 04-05-2018 08:12PM

Power Stance Inspector Paul wrote: »

they are probably selling your information to crooks to commit fraud.

Don't have to sell it, just have to have a target rich enviroment and poor IT security and a tech savvy crook will collect it for free from the website or lift it from the bus.

quin4105 · 29-06-2018 05:27PM

L1011 wrote: »

Almost certainly not. Contact the DSP and Data Protection

Citylink do have the right to right to ask for the PPS as they are acting on the behalf of social protection for the FTP. Just ring up the the department of social protection and ask them at 071-911-3673.

L1011 · 29-06-2018 05:37PM

I'd far prefer the DPCs opinion on that. DSP can't just decide to hand out access rights to it themselves and feature creep is specifically legislated against

Fred Swanson · 29-06-2018 07:49PM

This post has been deleted.

AlekSmart · 30-06-2018 11:46PM

quin4105 wrote: »

Citylink do have the right to right to ask for the PPS as they are acting on the behalf of social protection for the FTP. Just ring up the the department of social protection and ask them at 071-911-3673.

Many appear to forget that the Free Travel Scheme is not a compulsory element of Irish Public Transport.
Obviously,the State Operators are fully engaged with the scheme,with Bus Atha Cliath electronically recording ALL DSP Customers details for each journey made.
Private operators,however,enter the scheme on an individual basis,with each company negotiating with the DSP regarding the extent of their concession.
Equally,each of the Private Operators agree a financial package with the DSP,which may be substantially different from another operator on the same corridor.
If Citylink's contract with the DSP specifies the recording of individual numbers to ensure payment,then so be it.
If a DSP customer is sufficently concerned,I suggest they refuse to provide their PPS Number,pay the requested fare,and subsequently request repayment from the DSP.
It will be interesting to see the outcome ?

30-06-2018 11:53PM

You can always just file a GDPR request with Citylink to see what they are doing with your data

monument · 01-07-2018 03:55PM

testicles wrote: »

This post has been deleted.

Your post makes me think that you don't fully understand:

(1) GDPR
(2) The function of oversight of the Data Protection Commissioner.

testicles · 02-07-2018 10:19AM

This post has been deleted.

XPS_Zero · 02-07-2018 11:54AM

You are all confusing the travel pass number with the pps number

The bus company can ABSOLUTELY demand the former (ffsake it's detected on their machines when you place your card on them!), you have to give it to Translink every time you get a bus or a train to the north! BUT I've seen them frequently write down the pps number instead, confused. It's a frequently confused thing it seems.

The pps number can access secure info (if you had access to a govt computer anyway....it's not much use without that I'm not aware of any services where you can access them JUST with a pps number)

The FT scheme is funded by a block grant they are not paid fare by fare BUT some companies (like Swords Express used to) keep a record of FT pass usage on their services (and the method is recording the card number) because during the recession years DSP underpaid both CIE and private sector companies leading to both giving a DE FACTO subsidy to the FT system with their other fares, something only corrected in the last two budgets.

So it's perfectly ok to give them the travel card number. I do it every single time I go up north.

On the back of the card the PPS is on the left and the card number is on the right. That's the number they are supposed to record.

0byme75341jo28 · 02-07-2018 12:44PM

XPS_Zero wrote: »

You are all confusing the travel pass number with the pps number

The bus company can ABSOLUTELY demand the former (ffsake it's detected on their machines when you place your card on them!), you have to give it to Translink every time you get a bus or a train to the north! BUT I've seen them frequently write down the pps number instead, confused. It's a frequently confused thing it seems.

The pps number can access secure info (if you had access to a govt computer anyway....it's not much use without that I'm not aware of any services where you can access them JUST with a pps number)

The FT scheme is funded by a block grant they are not paid fare by fare BUT some companies (like Swords Express used to) keep a record of FT pass usage on their services (and the method is recording the card number) because during the recession years DSP underpaid both CIE and private sector companies leading to both giving a DE FACTO subsidy to the FT system with their other fares, something only corrected in the last two budgets.

So it's perfectly ok to give them the travel card number. I do it every single time I go up north.

On the back of the card the PPS is on the left and the card number is on the right. That's the number they are supposed to record.

But Citylink require you to enter the PPS number on their online form to reserve a seat. That's the issue here, whether they should be allowed request for such important personal information.

monument · 02-07-2018 02:29PM

testicles wrote: »

Unfortunately for you, I understand both intimately. Also, it's the Data Protection Commission these days.

It really doesn’t matter what they’re called after the rebrand, the point the authority is the one the public can complain to when there is a data protection issue and there is no requirement to go to the department first.

As ever, I’m open to correction.

AlekSmart · 02-07-2018 10:01PM

Coleman Agreeable Winter wrote: »

But Citylink require you to enter the PPS number on their online form to reserve a seat. That's the issue here, whether they should be allowed request for such important personal information.

There is a workaround for those who see the request as oppressive......One Can pay the appropriate fare and remain totally anonymous ?

Fred Swanson · 02-07-2018 10:08PM

This post has been deleted.

Do Citylink have the right to request your PPS number?

Comments