GDPR question

[Canute]

I was toying whether this belongs in the finance forum or this one.

Can a website publish, without the general permission of the individuals specified, their full names, date of births, home address and mobile numbers without breaking GDPR regulations?

Context.... I have come across a website doing just this in another EU country and I'm curious as it would seem to be against the EU GDPR laws and I'm pretty sure any businesses in the UK attempting to do this would be set on fire, I should also add the website in question also lists the equivalent of the individuals National Insurance number or Passport number, none of this information needs a sign-up and is all indexed by Google.

Thoughts please pannel...?

[BaldOldMan]

Well, unless it's a directory service that the individual has signed up for, the answer is clearly no......

[Tyre Smoke]

I'm not an expert, but I'd guess illegal.

But who is going to shut it down?

[Simpo Two]

Tyre Smoke said:

I'm not an expert, but I'd guess illegal.

But who is going to shut it down?

Whoever polices GDPR I guess.

Seems to me that the net result of GDPR regs is that every website simply throws up a banner saying "We're going to what the heck we like with your info and if you don't like it you can't come in. Click 'Accept'". And how many billions did that cost to implement?

20-30 years ago everyone's name, address, phone number and postcode was in directories in major post offices. Somehow we coped!

Edited by Simpo Two on Friday 1st November 23:24

[Nickyboy]

Sorry to hijack the thread but on the subject of GDPR, i'm assuming an employer giving out a private mobile number to a random person is also illegal?

I'm a delivery driver, this time of year we get helpers to assist with the volume, met one last week, HR gave him my personal mobile number without even asking, guy was useless and now has my number (i've blocked him however) but the fact they've given out my number without permission has irked me

[BaldOldMan]

Nickyboy said:

Sorry to hijack the thread but on the subject of GDPR, i'm assuming an employer giving out a private mobile number to a random person is also illegal?

I'm a delivery driver, this time of year we get helpers to assist with the volume, met one last week, HR gave him my personal mobile number without even asking, guy was useless and now has my number (i've blocked him however) but the fact they've given out my number without permission has irked me

So it wasn’t a random person, but someone employed by the same company with a reasonable need for it ?

Depends what you signed and agreed to with your employer really......

[Nickyboy]

BaldOldMan said:

So it wasn’t a random person, but someone employed by the same company with a reasonable need for it ?

Depends what you signed and agreed to with your employer really......

No, they weren't employed. It was someone on a job view for a couple of hours to see whether they would want to do the job. They've not been in for an interview yet, just a phone interview i believe.

[Australiam]

Canute said:

I was toying whether this belongs in the finance forum or this one.

Can a website publish, without the general permission of the individuals specified, their full names, date of births, home address and mobile numbers without breaking GDPR regulations?

Context.... I have come across a website doing just this in another EU country and I'm curious as it would seem to be against the EU GDPR laws and I'm pretty sure any businesses in the UK attempting to do this would be set on fire, I should also add the website in question also lists the equivalent of the individuals National Insurance number or Passport number, none of this information needs a sign-up and is all indexed by Google.

Thoughts please pannel...?

Most likely No. However it depends on whether the controller has a lawful basis to publish this information (I can't think of one, but as I don't know the context or country, could there be a regulatory requirement for them to do this, or are they part of a government body that has a legal requirement?). Any of the Data subjects (the individuals listed) could make a Subject Access Request and specifically request the lawful basis for processing this from the controller (website owner). This would then show on what grounds the information is published, or whether the individuals at some point gave consent (knowingly or not). It would also show for how long they will process the data - or as it sounds like your suspect, whether they are just paying no regard to the regulation.

[Australiam]

Nickyboy said:

No, they weren't employed. It was someone on a job view for a couple of hours to see whether they would want to do the job. They've not been in for an interview yet, just a phone interview i believe.

As already said - it depends on the agreement you have in place regarding the use of mobile phones.

[Nickyboy]

Australiam said:

As already said - it depends on the agreement you have in place regarding the use of mobile phones.

No agreement, phones are personal property. Already in union discussion over management harassment via personal phones.

[Australiam]

Nickyboy said:

No agreement, phones are personal property. Already in union discussion over management harassment via personal phones.

Assuming they do not have your consent (which regardless would still be debatable given the employee/employer relationship), they may feel they have an alternative lawful basis. For example, Legitimate Interest, in which case they do not need your consent, however they should be transparent with you about the use of your data. If relying on legitimate interest, they should have undertaken a balancing test, balancing the risk of the processing to the individual, v's the legitimate interest they have. The output of this would determine their conclusion of the legality of processing -but this is subjective, and may not meet the requirements of the ICO)

However you are debating the breach of one piece of information, that was given to one person. The ICO will not be interested (it is a bit like asking the police to investigate the theft of a Mars Bar), unless it makes up part of a bigger picture)

Whilst I appreciate you may right - for the sake of you job and maintaining an ongoing good relationship with your employer, in isolation it seems to me to be a bit petty. If you did want to follow it up with them, you could make a Subject Access Request, to understand what data they hold on you, how it is used, and the lawful basis for processing. But knowing how much effort could be involved, you will not make friends, and what would you hope to gain?

Personally, if it irked me that much, I'd buy a PAYG phone and give that number to the company, or put the effort into finding a new employer.

[Heres Johnny]

Australiam said:

Nickyboy said:

No agreement, phones are personal property. Already in union discussion over management harassment via personal phones.

Assuming they do not have your consent (which regardless would still be debatable given the employee/employer relationship), they may feel they have an alternative lawful basis. For example, Legitimate Interest, in which case they do not need your consent, however they should be transparent with you about the use of your data. If relying on legitimate interest, they should have undertaken a balancing test, balancing the risk of the processing to the individual, v's the legitimate interest they have. The output of this would determine their conclusion of the legality of processing -but this is subjective, and may not meet the requirements of the ICO)

However you are debating the breach of one piece of information, that was given to one person. The ICO will not be interested (it is a bit like asking the police to investigate the theft of a Mars Bar), unless it makes up part of a bigger picture)

Whilst I appreciate you may right - for the sake of you job and maintaining an ongoing good relationship with your employer, in isolation it seems to me to be a bit petty. If you did want to follow it up with them, you could make a Subject Access Request, to understand what data they hold on you, how it is used, and the lawful basis for processing. But knowing how much effort could be involved, you will not make friends, and what would you hope to gain?

Personally, if it irked me that much, I'd buy a PAYG phone and give that number to the company, or put the effort into finding a new employer.

Common sense above

Couple of other points -
Why does the employer have your mobile number at all?
Consent can be through accepting the employment and agreeing to adhere to the terms an conditions of employment which may include the use of mobile phones for comunication?

As soon as people start saying "unions are involved" you do wonder the nature of the employees as much as the employer but then I grew up near birmingham and remember the 1970s and how the unions did what they could to kill the car making industry. They make Corbyn look like a capitalist