Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

GDPR/Data Protection?

Options
  • 15-03-2019 2:59am
    #1
    Runaude
    Registered Users Posts: 13 ✭


    I had work done on my car recently, the mechanic arrived and carried out the work with no problems. He took a photo of my car registration plate and of my driving license. Is this a breach of data protection laws?

    The mechanic now has my photo id on his phone with so much personal data that can be used for identity fraud. Should I take this further or am I being paranoid? I paid in full and have no issues, I don't understand the need to have my ID on his phone?


Comments

  • Options
    #2
    fritzelly
    Registered Users Posts: 17,285 ✭✭✭✭fritzelly


    Would take this to the highest court in the land, with a pic of your reg he could get a mortgage, credit card and god knows what in your name

    Mod
    Take it easy fritzelly.







    Ps troll alert


  • Options
    #3
    Runaude
    Registered Users Posts: 13 ✭Runaude


    fritzelly wrote: »
    Would take this to the highest court in the land, with a pic of your reg he could get a mortgage, credit card and god knows what in your name

    Ps troll alert
    What the hell are you talking about? It is a legitimate question? Some of us care about data protection, I assure you my question is in good faith. Your sarcasm doesn't help my situation. If I was sitting on your personal data how would you feel?


  • Options
    #4
    Del2005
    Registered Users Posts: 18,915 ✭✭✭✭Del2005


    Runaude wrote: »
    What the hell are you talking about? It is a legitimate question? Some of us care about data protection, I assure you my question is in good faith. Your sarcasm doesn't help my situation. If I was sitting on your personal data how would you feel?

    If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

    You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.


  • Options
    #5
    Runaude
    Registered Users Posts: 13 ✭Runaude


    Del2005 wrote: »
    If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

    You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.
    Normally I wouldn't but when your in a bind and tired and just want to go home you oblige. It seems to be a legit company but I doubt there data protection regulations are up to par when a mechanic takes a photo with his I assume personal mobile phone. I've contacted the data protection commissioners and await their reply.


  • Options
    #6
    Del2005
    Registered Users Posts: 18,915 ✭✭✭✭Del2005


    Runaude wrote: »
    Normally I wouldn't but when your in a bind and tired and just want to go home you oblige. It seems to be a legit company but I doubt there data protection regulations are up to par when a mechanic takes a photo with his I assume personal mobile phone. I've contacted the data protection commissioners and await their reply.

    Where did the mechanic do the work on the car? Your OP had the mechanic arrive and do some work, in this post you are looking to go home after the mechanic did some work?

    Did you call out a mechanic to work on your car? If you did then he's most likely covering his behind by having a record of who he worked on the car for proof.

    BTW having your personal data isn't a problem, loads of cameras have it already, it what they do with your data which is the important bit.


  • Advertisement
  • Options
    #7
    Cookie_Monster
    Registered Users Posts: 24,475 ✭✭✭✭Cookie_Monster


    i presume you would have done a walkaround of the vehicle with the mechanic and signed paperwork before any work carried out?, this paperwork will have t&c giving permission to use data, share with suppliers / manufacturers, see your licence etc. It's pretty standard in the industry


  • Options
    #8
    the_pen_turner
    Registered Users Posts: 7,506 ✭✭✭the_pen_turner


    Surely he has this so he can carry out his job. That's the purpose of having customer data.

    You can't just demand he delete it


  • Options
    #9
    Robbo
    Moderators, Social & Fun Moderators, Society & Culture Moderators Posts: 10,559 Mod ✭✭✭✭Robbo


    the_pen_turner wrote: »
    Surely he has this so he can carry out his job. That's the purpose of having customer data.

    You can't just demand he delete it
    I'd regard this as being excessive. There's no earthly reason a mechanic would need to retain a copy of the customers driving licence for ordinary business purposes.

    I can understand the need to verify a new customers ID/address but this is just asking for trouble. And then you have the method by which it was collected, by way of a phone's camera. Issues with the physical security of the data, whether any non-EU cloud services may be at play and who has access all present themselves.


  • Options
    #10
    Odyssey 2005
    Registered Users Posts: 21,065 ✭✭✭✭Odyssey 2005


    He may need the reg # in order to ensure he gets the correct parts Etc. As for a pic of my driving licence....
    Harvey Smith to that idea.


  • Options
    #11
    Mrs OBumble
    Registered Users Posts: 25,722 ✭✭✭✭Mrs OBumble


    Del2005 wrote: »
    If you were so worried about data protection why did you let someone, who you hired to work for you, see never mind take a picture of your ID?

    You can request that they delete all data they have relating to you. After that there's not much else you can do as it's a private individual so chasing them in this country is next to useless.

    You can request anything you want.

    But if they have a legitimate reason for knowing who they worked for, they will just say "no" to your request.

    I wonder what requirements Revenue place on mechanics.


  • Advertisement
  • Options
    #12
    brian_t
    Registered Users Posts: 6,664 ✭✭✭brian_t


    Odyssey 2005 wrote: »
    He may need the reg # in order to ensure he gets the correct parts Etc. As for a pic of my driving licence....
    Harvey Smith to that idea.
    Any decent mechanic will order parts based on car/engine serial number.


  • Options
    #13
    rd1izb7lvpuksx
    Closed Accounts Posts: 260 ✭✭rd1izb7lvpuksx


    Cookie_Monster wrote: »
    i presume you would have done a walkaround of the vehicle with the mechanic and signed paperwork before any work carried out?, this paperwork will have t&c giving permission to use data, share with suppliers / manufacturers, see your licence etc. It's pretty standard in the industry

    You can't collect or process customer data without a statutory basis. If relying on consent, it must be informed consent - it can't be a condition hidden in terms & conditions. I work in this field (data protection) and a lot of industries are now waking up to the fact that their standard practices are no longer lawful.
    the_pen_turner wrote: »
    Surely he has this so he can carry out his job. That's the purpose of having customer data.

    You can't just demand he delete it

    Unless there's a very good reason why they need to keep the personal data, that's exactly what GDPR allows users to do.


  • Options
    #14
    Runaude
    Registered Users Posts: 13 ✭Runaude


    Just to clarify, the work was done at the side of the road. It was a 30 minute job. I paid by credit card over the phone and when the guy arrived he asked for ID. I was surprised he took a photo of it. I have raised the issue with the data protection commission and I'm waiting for there response. I cannot see any reason why they need this and I highly doubt it is kept in a secure manner.


  • Options
    #15
    L1011
    Moderators, Business & Finance Moderators, Motoring & Transport Moderators, Society & Culture Moderators Posts: 67,845 Mod ✭✭✭✭L1011


    Verification of membership or other eligibility (insurer) for the roadside work? Still a clumsy way to do it.


  • Options
    #16
    wiggle16
    Moderators, Society & Culture Moderators Posts: 3,022 Mod ✭✭✭✭wiggle16


    Mrs OBumble wrote: »
    I wonder what requirements Revenue place on mechanics.

    None. Why would they?


  • Options
    #17
    Del2005
    Registered Users Posts: 18,915 ✭✭✭✭Del2005


    Runaude wrote: »
    Just to clarify, the work was done at the side of the road. It was a 30 minute job. I paid by credit card over the phone and when the guy arrived he asked for ID. I was surprised he took a photo of it. I have raised the issue with the data protection commission and I'm waiting for there response. I cannot see any reason why they need this and I highly doubt it is kept in a secure manner.

    IMO the mechanic did nothing wrong. They were called to a job at the side of the road and they took picture of your ID to so that if they are ever faced with a criminal charge they are covered. If I was the mechanic I wouldn't be deleting the image till you turned up with a VLC to prove that you owned the car, but then they with VLC's being so easily faked they would need to keep a copy of the VLC you showed them!!

    You are worried about data while the mechanic is worried about a criminal conviction, I think they have a valid reason to keep your data.


  • Options
    #18
    wiggle16
    Moderators, Society & Culture Moderators Posts: 3,022 Mod ✭✭✭✭wiggle16


    What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

    And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

    As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

    I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.


  • Options
    #19
    rd1izb7lvpuksx
    Closed Accounts Posts: 260 ✭✭rd1izb7lvpuksx


    wiggle16 wrote: »
    What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

    And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

    As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

    I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.

    Nah, you're way off here. If the data is of no value/use, then there's no rationale for the company storing it.

    It's up to the company to declare how the store and process your data, and how it's secured. End users don't have to trust them - failure to declare why it's recorded/stored/processed alone is grounds to show that they aren't processing it lawfully. There's no reason to expect them to be following the law in other respects.

    Finally, on your last point, the opposite is true. While people like you may not value their privacy or understand the implications of the data they hand over, that does not mean that the rest of us should accept this kind of behaviour. Driver's license images are classed are sensitive data under GDPR, and there are extremely strong controls around this class of data. The OP has every right to question why it was recorded and require it's deletion. There isn't a court or authority in the land that would deem it as legitimate or proportional.


  • Options
    #20
    Runaude
    Registered Users Posts: 13 ✭Runaude


    wiggle16 wrote: »
    What is the mechanic going to do with a phone-picture of your ID and a picture of your reg plate? Honestly.

    And even if he was going to do something untoward or even illegal with them, you saw him take the pictures, and you know who he works for, and he knows you know this. He'd be caught in an instant.

    As for data storage, you have no idea where or in what format they keep their customers' data or if they retain it at all so you can't "highly" doubt how secure it is.

    I think people in general expect too much from data protection and different people have wildly different definitions of what "data" is.
    I'm not worried about what this mechanic is going to do. I'm concerned about why he has taken this sensitive data when it was not needed at all. How this data is stored, as I assume it was taken with his personal mobile phone. Who will this data be transmitted to? The information contained on a driving license is enough to make identity theft simple.


    This was not a big company, I'm assuming a copy of my driving license is now just sitting in his picture gallery, unencrypted. Placed onto their work computer, unencrypted. Sent to however many people, copied however many times... can you not see why I would have an issue with this? I've worked for many organizations where their data protection protocol was laughable and out rightly dangerous in my view.



    Maybe I am overthinking things, maybe not. I'm going to wait to see what the data protection commissioner has to say on this matter and then I'll act accordingly.


  • Options
    #21
    wiggle16
    Moderators, Society & Culture Moderators Posts: 3,022 Mod ✭✭✭✭wiggle16


    Bristol Spicy Springtime wrote: »
    Nah, you're way off here. If the data is of no value/use, then there's no rationale for the company storing it.

    Not what I meant. I meant there is no reason to suspect the mechanic of doing anything wrong or that he was up to something, which is what was implied when the OP referred to the mechanic having information of his which could be used in identity fraud. I can see the OP has since clarified that, apologies OP.

    The photos are obviously of some value to the company in verifying that the car the mechanic fixed belonged to the person who was driving it, as pointed out earlier. Whether this is a general practice amongst roadside mechanics, I don't know, and whether or not it is permissible, I don't know either, but I suspect it is.
    It's up to the company to declare how the store and process your data, and how it's secured. End users don't have to trust them - failure to declare why it's recorded/stored/processed alone is grounds to show that they aren't processing it lawfully. There's no reason to expect them to be following the law in other respects.

    No disagreement with this, obviously.
    Finally, on your last point, the opposite is true. While people like you may not value their privacy or understand the implications of the data they hand over, that does not mean that the rest of us should accept this kind of behaviour.

    "people like you..." :rolleyes: you know nothing about me or my understanding of data protection. You are free not to "accept this kind of behaviour" if you wish, however, the fact that the behaviour in question takes the form of actions the mechanic is clearly required to take in order to do his job makes me hope you don't break down on a motorway any time soon. And I mean that sincerely.

    Anyway I'm dragging this off topic so I'm bowing out. Have a nice weekend.


  • Advertisement
  • Options
    #22
    CIARAN_BOYLE
    Moderators, Sports Moderators Posts: 14,599 Mod ✭✭✭✭CIARAN_BOYLE


    Runaude wrote: »
    I'm not worried about what this mechanic is going to do. I'm concerned about why he has taken this sensitive data when it was not needed at all. How this data is stored, as I assume it was taken with his personal mobile phone. Who will this data be transmitted to? The information contained on a driving license is enough to make identity theft simple.


    This was not a big company, I'm assuming a copy of my driving license is now just sitting in his picture gallery, unencrypted. Placed onto their work computer, unencrypted. Sent to however many people, copied however many times... can you not see why I would have an issue with this? I've worked for many organizations where their data protection protocol was laughable and out rightly dangerous in my view.



    Maybe I am overthinking things, maybe not. I'm going to wait to see what the data protection commissioner has to say on this matter and then I'll act accordingly.

    First off for them to take and store personal data they should have gotten you to consent. Did they? You mention that you let him take the pictures so I would presume this is consent.

    Secondly I can see legitimate business reasons for them to take copies of your personal data.

    For example have you paid. If the job will be claimed from insurance the insurer may demand evidence that the policy holder got the job done and not a 3rd party.


Advertisement