Information Commissioner's Office
When is a breach not a breach?
The ICO has ruled that Virgin Trains East Coast did not break data protection law when it published CCTV footage of Jeremy Corbyn looking for a seat on a service from London.
But the company did breach the law when it published images of other passengers on the same service. The ICO found that Virgin should have taken better care to obscure the faces of other people on the train. Publication of their images was unfair and a breach of the first principle of the Data Protection Act.
Why was it okay to publish pictures of Mr Corbyn?
All organisations are bound to publish details of how they’ll handle personal data. If they don’t process it in the way people would expect, they could be breaking the law.
But there are exceptions.
The Data Protection Act allows an organisation to process personal data outside its published conditions as long as it has a “legitimate interest” to do so.
In this case, the ICO’s view was that Virgin had a legitimate interest, namely correcting what it deemed to be misleading news reports that were potentially damaging to its reputation and commercial interests.
It would not have been possible to achieve Virgin’s legitimate interests without publishing Mr Corbyn’s image. Virgin could only show that there were empty seats on Mr Corbyn’s journey if they showed Mr Corbyn on that journey.
In addition, the ICO believed that Mr Corbyn would have had different expectations than other passengers as to his privacy whilst on this journey because:
- he had already made a video which showed him making that journey, and
- it would be reasonable for him to expect that once he had raised issues about his train journey in a video released to the media, Virgin would respond in kind.
What about the other passengers?
In order to give its side of the story, Virgin had no reason to publish pictures of anyone else on the train.
By doing so, it infringed on the privacy of passengers who were simply minding their own business and would not reasonably have expected their pictures to be published.
What happens next?
We’ve stopped short of formal regulatory action to reflect the exceptional circumstances of the breach. In particular that this was a one-off incident, and the people identified were unlikely to suffer serious distress or detriment.
Only three people were recognisable in the footage – most were pixelated – and while some people complained to us about how CCTV had been used, none of the affected passengers contacted us.
But Virgin has not been let off the hook. Our investigation was rigorous and compelled the company to provide us with details of its practices, policies and procedures. The company was under no illusion of the seriousness of our involvement.
Virgin will strengthen its data protection training for everyone from new starters to the top tier executives. It will amend its CCTV policy to take account of exceptional circumstances and ensure it has easy access to pixelation services should the need arise again.
We did not deem it proportionate to use our regulatory stick on this occasion. But, as always, we will use our enforcement powers to protect the information and privacy rights of UK citizens when necessary.
Latest News from
Information Commissioner's Office
North London council fined after parking ticket system flaw leaves personal information at risk18/08/2017 11:10:00
Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website.
Consent is not the ‘silver bullet’ for GDPR compliance17/08/2017 16:05:00
Blog posted by: Elizabeth Denham, Information Commissioner, 16 August 2017.
ICO warns NHS employees that unlawfully accessing patient records is an offence14/08/2017 13:10:00
The Information Commissioner’s Office (ICO) has reminded NHS staff about the potentially serious consequences of prying into patients’ medical records without a valid reason.
Personal data belonging to up to 21,000 TalkTalk customers could have been used for scams and fraud11/08/2017 09:20:00
The Information Commissioner’s Office has fined TalkTalk Telecom Group PLC £100,000 after it failed to look after its customers’ data and risked it falling into the hands of scammers and fraudsters.