Sharing customer data without permission

[Glasgowrob]

We run a small taxi company up in Scotland

Along with a few other local operators were getting hit with a lot of fraud attempts and time wasters

Is it legal for us to share customer data

Or a mobile no and or a address with other operators to create for all intents and purposes a list of known trouble makers that we do not wish to offer services to

The head says no and we can't give customer details out externally but I'm curious if there's any exemption for fraud avoidance and detection

[rog007]

Unlikely.

GDPR is unfortunately not black & white, but if you abide by its principles in order to comply and remain legal, you’re unlikely to be able to do as you suggest.

Always err on the side of caution unless you can legally justify your actions.

https://ico.org.uk

[Where2Guv]

Hi rob,

I run a cab firm in south east. We had an absolute tidal wave of it from London in recent years and so we switched to Chip & Pin only. The problem disappeared overnight mate.

Feel free to drop me a PM

Long time no post! Must have lurked for 10 odd years! Funny

[grumbledoak]

I think GDPR hinges on "personally identifiable". You might be okay blacklisting just addresses.

[Glasgowrob]

thats the problem we would be more inclined to want to black list phone nos as they are more personably identifiable


thats a pity would be great to be able to crossload others operators problem customers as well as our own so we know who to avoid

[Where2Guv]

Hi rob,

I run a cab firm in south east. We had an absolute tidal wave of it from London in recent years and so we switched to Chip & Pin only. The problem disappeared overnight mate.

Feel free to drop me a PM

Long time no post! Must have lurked for 10 odd years! Funny

[The Moose]

Could you set up a central database that no one has access to other than their own data and your system automatically sends the data to the database and it either says good or no good?

[pokethepope]

Glasgowrob said:

thats the problem we would be more inclined to want to black list phone nos as they are more personably identifiable


thats a pity would be great to be able to crossload others operators problem customers as well as our own so we know who to avoid

'Anonymise' the data by removing the first e.g. six numbers of the phone number and don't upload/share any other identifiable information (e.g. names) with it?

[ExV8]

A phone number would not be pii.

[anonymous-user]

Yes, as it is in your, the third party's and, arguably, wider society's legitimate interest.

https://ico.org.uk/for-organisations/guide-to-data...

I would limit the class of data shared, where relevant, to non-sensitive types and ensure that all parties have a clear understanding of processor/controller obligations and associated, proportionate, processes and controls to ensure adequate compliance. If you print receipts, have a website or other marketing etc. I would reference that you will share data with XYZ (other firms/police etc.) to prevent fraud and protect abovementioned legitimate interests.

IANAL

[48k]

The litmus test is whether the information can be used to to identify or trace an individual, so in the case of a mobile phone number it is PII so falls under GDPR.
All you would need to do is include something in your GDPR statement to say why your store the info, how long you store it for, how someone can get the info corrected/removed, who you share the info with etc. etc.
If your telephone system is a VOIP system it would be very easy to have something pop up on screen to warn when it's a blacklisted number calling.

Online retailers do something similar by logging / sharing data on which house numbers + postcodes have a higher than average number of "goods arrived damaged" issues. When a customer requests replacement items their systems can consult the Retail Intelligence system to see how to handle the request.