Forum Topic

Data Protection Law.

Can anyone please help with a possible legal conundrum. If I have a window cleaning round, as I understand it each and every customer would have to give signed written permission for me to keep a record of their  address. However, if I had say 70 customers on the fictitious road Abercwmbucket Street would I be breaking Data Protection Law if I just kept a record of door numbers without recording the name of the street?I.E. 1-5-8-34- etc.

Neil Milkins ● 1052d10 Comments

Are you serious ? Not another legal matter. Ive just noted on my paper the neighbours door numbers,street and names and some knicknames ? Hope the police dont turn up and find this,better code it just incase

Julian Pavey ● 1051d

No, not street names or nicknames just numbers. And yes I am serious.

Neil Milkins ● 1051d

Neil, I would take a ‘common sense’ approach to GDPR, if you are talking about a small numbers of customer. GDPR is about protecting customers against any unlawful activity. If you are only collecting name, address and contact number you will be fine. It’s gets much more complicated if collecting personal, banking data etc. the government is reviewing current rules to make them less complicated. I do have a business and follow GDPR registration and rules but we collect a lot more data for staff.

Jayne Thorburn ● 1051d

Don't look in the telephone directory or online The NCA might see your online activity and pay you a visit

Julian Pavey ● 1051d

Thank you very much Jayne.

Neil Milkins ● 1051d

Good luck don’t stress about GDPR, on another note I am looking for a window cleaner if you know anyone?

Jayne Thorburn ● 1051d

That's not correct.  If you hold customer information, then you are subject to GDPR - full stop.  Name, address and contact number count.  (I'm registered with the Information Commissioner's Office [ICO] for holding just this info).  Whether you will be caught if you don't register with the ICO is another matter - but be aware that you are at risk.  Laws are absolutes and don't allow for "common sense"As to the original question - holding just a string of numbers would not count as personal information and would therefore be Okay - PROVIDED that there is no way of linking them to people.  As a comparison, you would think that a number plate on its own would not be personal information - but it is, since if someone got hold of it, in whatever context it appeared, and then had access to the DVLA database, they would be able to link the number plate and the context to an individual.  So, if there is no way (other than your memory) of linking the numbers to people, you're okay, but if there is, then you're not.I caveat all this by saying that GDPR is complex and I'm not a lawyer!

Andrzej Kowalski ● 1050d

I think you would only require permission from clients to pass on their data to 3rd parties. If all you are doing is maintaining a list of customers' names and addresses, whether the list is stored manually or on a computer, you probably don't need to register with the Information Commissioner's Office. There's a simple self-assessment check-list on the ICO website: https://ico.org.uk/for-organisations/advice-for-small-organisations/checklists/data-protection-self-assessment/

Robert Fish ● 1050d

Thank you Robert.

Neil Milkins ● 1050d

Thank you Andrzej for that information.

Neil Milkins ● 1050d