When is a breach not a breach?

By Steve Eckersley, Head of Enforcement.

cctv-blogThe ICO has ruled that Virgin Trains East Coast did not break data protection law when it published CCTV footage of Jeremy Corbyn looking for a seat on a service from London.

But the company did breach the law when it published images of other passengers on the same service. The ICO found that Virgin should have taken better care to obscure the faces of other people on the train. Publication of their images was unfair and a breach of the first principle of the Data Protection Act.

Why was it okay to publish pictures of Mr Corbyn?

All organisations are bound to publish details of how they’ll handle personal data. If they don’t process it in the way people would expect, they could be breaking the law.

But there are exceptions.

The Data Protection Act allows an organisation to process personal data outside its published conditions as long as it has a “legitimate interest” to do so.

In this case, the ICO’s view was that Virgin had a legitimate interest, namely correcting what it deemed to be misleading news reports that were potentially damaging to its reputation and commercial interests.

It would not have been possible to achieve Virgin’s legitimate interests without publishing Mr Corbyn’s image. Virgin could only show that there were empty seats on Mr Corbyn’s journey if they showed Mr Corbyn on that journey.

In addition, the ICO believed that Mr Corbyn would have had different expectations than other passengers as to his privacy whilst on this journey because:

  • he had already made a video which showed him making that journey, and
  • it would be reasonable for him to expect that once he had raised issues about his train journey in a video released to the media, Virgin would respond in kind.

What about the other passengers?

In order to give its side of the story, Virgin had no reason to publish pictures of anyone else on the train.

By doing so, it infringed on the privacy of passengers who were simply minding their own business and would not reasonably have expected their pictures to be published.

What happens next?

We’ve stopped short of formal regulatory action to reflect the exceptional circumstances of the breach. In particular that this was a one-off incident, and the people identified were unlikely to suffer serious distress or detriment.

Only three people were recognisable in the footage – most were pixelated – and while some people complained to us about how CCTV had been used, none of the affected passengers contacted us.

But Virgin has not been let off the hook. Our investigation was rigorous and compelled the company to provide us with details of its practices, policies and procedures. The company was under no illusion of the seriousness of our involvement.

Virgin will strengthen its data protection training for everyone from new starters to the top tier executives. It will amend its CCTV policy to take account of exceptional circumstances and ensure it has easy access to pixelation services should the need arise again.

We did not deem it proportionate to use our regulatory stick on this occasion. But, as always, we will use our enforcement powers to protect the information and privacy rights of UK citizens when necessary.

Steve EckersleySteve Eckersley leads the ICO’s Enforcement Team. Its aim is to take purposeful risk-based regulatory action where obligations are ignored, examples need to be set or issues need to be clarified, based on the ICO’s Regulatory Action Policy.
This entry was posted in Steve Eckersley and tagged , . Bookmark the permalink.

5 Responses to When is a breach not a breach?

  1. Paul |F says:

    On this occasion I think that it was right for the ICO not “to use its stick”, and my impressions is that for Data Protection breaches the ICO does “use its stick” when needed.

    However my experiences with the ICO related to Freedom of Information Act enforcement is quite different. I have had numerous complaints upheld, but the ICO either has no stick or is extremely reluctant to use it in such cases.

    IMO, penalties for breaking the law are an essential deterrent, and for the ICO to let organisations off with a slap on the wrist, particularly those with a history of breaking the law, can only encourage them to do it again since they know there are no real downsides.

  2. Josh Smith says:

    I have to say I’m surprised that no formal action has been taken and I worry that this decision sends a very inappropriate message – ie that it is perfectly acceptable to process and publicly disclose personal data for political or commercial reasons without the subjects’ consent, and the ICO would take no action.

    There were many other ways Virgin could have protected its reputation or commercial interests. Why could Virgin not have released statistics on the number of seats reserved, the number of tickets sold for the service, to prove its point?

  3. Anonymous says:

    Steve – is “we have stopped short of formal regulatory action” your middle name?

  4. Excellent eye opener. can I share with my followers on http://alsec.co.il ?

Leave a Reply