3

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable.

The purpose is to provide a client terminal inside a point of business that would function as follows:

  1. The customer arrives to the shop,
  2. the customer presses 'Start' button on a touch screen,
  3. enters her phone number,
  4. after this she is to be shown a greeting that includes her given name,
  5. customer selects what services she wants in order to complete the service order,
  6. and customer is called out by her given name when she is to be serviced.

My assumption is that should not be done, and if not illegal, then this would be at least seen rather bad manners. My assumption is based on the fact that the personal data (given name, existence of customership) may be handed to someone that has no legal right to see that data, and it might be impossible to name that person later on if needed.

As far as I can see it, if someone enters her phone number incorrectly, or for some reason enters a phone number that belongs to someone else, then it is possible that the given name belonging to someone else is shown.

Also due to the location (population 5,5 million), some foreign given names can be rare to such extent that they are unique within the country.

Since the phone numbers are recycled, it might be possible that a new customer sees the given name of previous owner of the number if the previous owner has also been a customer.

I doubt there is any other possible harm to customers expect possible loss of privacy that doesn't cause tangible damage, the services provided are not associated to sensitive matters.

So, is giving out customer name and implied existence of customership legal?

Edit 1 The phone number in question is probably expected to be a personal mobile phone number. It should be possible to verify that a phone number is a mobile phone number. I don't know if people sharing a mobile phone has been taken in to consideration.

  • Entering something into an automated system that is long, complicated and I don't have memorized since rotary phones went the way of the dodo, just to be identified by something that is not even remotely unique... apart from law, I think you should ask some serious questions on UX or more technically minded sites, too. – nvoigt May 24 at 6:48
  • Where did you get the given name in the first place? Is the customer aware that it's used for this purpose? Did they agree to have their personal information shouted across the business floor like that? Is the customer able to pick a different name, or is the same name also used on documents like invoices and receipts? – nvoigt May 24 at 6:53
  • In healthcare what I see is that such a system (well, data is not feed directly by the user because they had appointments) just produces a ticket with a number which is what is used to call for the user. Regardless of legality, maybe you could suggest this approach. – SJuan76 May 24 at 15:20
  • @nvoigt if I were designing the system, there would probably be a QR code scanner and plastic cards to be handed for customers, or QR code to be stored in the phone, and absolutely as little typing by the customer as possible. Optional registration would probably be the only case. – JSalasukuinen May 25 at 15:10
3

Art.5(1)(f) contains:

  1. Personal data shall be:

    (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Art. 25 and Art. 32 also contain similar requirements. What is appropriate has to be determined, as the GDPR does not contain an exact definition.

However as processor you don't have to worry about that, as Art.5(2) Contains:

  1. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

But you need to inform the controller if you think an instruction violates the GDPR. But it is up to the controller to decide what to do. Art. 28(3) requires a contract between controller and processor which requires the processor to:

  1. (...) that the processor:

    (c) takes all measures required pursuant to Article 32;

    (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

But again, the controller is responsible for this contract.

1

I agree with wimh's answer. There are some points to add:

  • a phone number is not unique; one number may be shared by several customers in the same household. This is the fundamental problem with the proposal.

  • loss of privacy may cause serious damage. If Mrs X logs on and sees Mr X's transactions, she may wonder where the item that that Mr X bought, as she hasn't seen it round the house or received it as a gift. If the item is lacy ladies' underwear in Mr X's size, Mr X's privacy has been invaded, his marriage may be placed at risk, he may suffer financial loss as a result, and the data controller may be liable

  • even if the item is not lacy underwear, a transaction history may show that Mr X was not where he told Mrs X he had been at a certain time/date

  • a person in possession of a phone number associated with another person (Mr Y) may be able to determine that the telephone number is actually held by an adult in the name of X. Even if the system does not store and display address data, disclosing the name of X may be sufficient to enable Y's home address to be traced. This may be in breach of a court order protecting a person from harm or domestic abuse, especially if Y is a juvenile.

  • Oops, I guess I should have been more specific. The phone number in question is probably to be taken as a personal mobile phone number but I'm not sure how much it affects in this matter. Past purchases are not to be revealed through this client terminal. I think it is not out of question that service selection menu could be personalized later on based on past purchases, so maybe something could leak out indirectly. – JSalasukuinen May 25 at 6:54
  • Even a 'personal' phone number may be used by other people - a child in school will give contact info for parents/guardians. Mrs Teacher phones Jess Little's contact number, finds that Jessica is coming to class next week, and goes into the shop to buy the right number of products for class, one for each attending pupil. She absentmindedly puts in Jess Little's number into the touch screen instead of her own, and is greeted by a "Welcome, Mr Samename As Director of Child Protective Services". You have a data breach. A name and phone number are together personal data and must be kept secure. – Owain May 26 at 10:03
  • In the UK most mobile phones have numbers starting 07. Separate number ranges for mobile do not apply in other countries, especially the USA. Some mobiles have 'gepgraphic' numbers. Some people have work-provided mobiles; some of those may be on call routing so a call to any mobile gets the next available person on duty. The phone number at the store may be registered in the employer's name if the person collects stuff paid for by the business. Revealing that a child's parent is in a sensitive occupation may place child or parent at risk. – Owain May 26 at 10:09
  • Also check the Communications Act or Regulation of Interceptory Powers Act in the UK where reverse look-up of telephone numbers may be specifically prohibited. – Owain May 26 at 10:12
0

Within the company premises/ office/ shop, as long as there is a two-factor authentication (e.g. phone number and email, not only phone number) it is a matter of Service requirements versus Data Subject's Consent versus Risks. Even if there are some rare names, as long as you do all within your power to ensure that the person Logging in is the Data Subject via such two-factor authentication method the only thing you will "enable to the public" who is on-site is to cross-reference a "name" with a face... therefore the risk towards the Data Subject is Low. I wouldn't go as far as saying this scenario represents a non-compliant point.

  • The client (data controller) really wants to have essentially a no-authentication solution i.e. just by entering her phone number the customer is to be greeted by a given name if there is a matching customer record (whether the phone number was typed correctly or not), and the service selection is to be attached to that account if the customer so chooses. – JSalasukuinen May 25 at 15:03
  • using phone number + email to reveal name is still a data protection breach under GDPR in the UK. The name associated with a phone number is personal data and must not be disclosed. The name associated with a customer of the shop is personal data and must not be disclosed. – Owain May 26 at 10:14
  • As is ... no can do :) If the client accepts authentication, and as long as only name is loud spoken, it would mean both documented proof of univocal identification of the Data Subject and the disclosure of Personal Data that on its own does represent a risk towards the Data Subject (the name). Using phone number + email (which remains only known to the Company, that already had it) while conveying only the name over a loud speaker... it's "accepteable" as part of a Service being rendered, provided the Data Subject has accepted it. – Rui Freitas Serrano May 27 at 11:48
  • There are however, "concerns"/ "steps" that your company should take into consideration while developing such features... after all you are involved in the "equation"... – Rui Freitas Serrano May 27 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.