> Mr X has a warranty policy on his washing machine. The washing
> machine breaks down and Mrs X calls up to log the fault and
> arrange for an engineer to visit. Can not speak to Mr X as he is
> at work. Strictly speaking we should only speak to the policyholder (Mr X).
I cannot see any reason under the DPA why you cannot talk to Mrs
X. The Act does not say who can or cannot be spoken to - it
describes how personal data should be handled.
Mrs X is presumably processing data under section 36 of the Act
(Domestic purposes). She should only be giving you personal data
which can be checked against the policy details - eg. does she
say the machine is of the type and at the address stated on the
policy? Does the policy number match? Is she giving the right
name?
You will then be processing data under the policyholders original
instructions. What do your policy documents say about other
family members or people using the insured equipment at the
policy address?
You can ask her if she is acting on the policyholder's behalf.
As you say, there is no need to divulge anything and I see no
reason why you cannot arrange the service under the terms of the
policy.
What would you do if she said Mr X was serving with the army in
the mountains of Aghanistan and she did not want to use the 20
minutes of telephone conversation allowed each week for him to
contact you to arrange the washing machine repair? With three (or
more) kids, and umpteen dozen nappies per day it is an emergency
and she needs service now and her next call will be to the press
if you are not going to provide it?
I suppose a broken washing machine is just about within the
definition of personal data but it does worry me if every
equipment warranty policy is going to have to be in the joint
names of husband, wife, au pair, lover(s), all the kids, resident
grandmother/father(s), uncles, aunts, the next door neighbours
and the family dog/cat/ hamster just in case one of them happens
to need to call for the service on behalf of the policyholder
(acting with his/her permission).
It is not the same as taking out or renewing a policy or making
amendments to it. Nor is it personal in the same way as life
assurance, investments etc..
This sort of story hit the press just as the Act came into force -
I seem to remember a car breakdown organisation saying it could
not attend someone in a supermarket car park because the spouse
called them from home rather than the stranded motorist member
calling direct. If I remember rightly it got fairly short shrift
from the IC.
Life must have been so much easier before washing machines,
insurance companies ......... not to mention the DPA!
John F Hitches
General Administrative Manager
Kingston University
River House
53 / 57 High Street
Kingston Upon Thames
Surrey KT1 1LQ
Telephone 020 8547 7768
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|