Transparency, choice and control
What we looked at
3.1 How transparent is the platform about where the information goes and what is done with it? Is information put to any secondary purpose, and if so, how clearly is that purpose spelt out?
3.2 How much choice and control are you given over this?
What good could look like
An approach which...
Provides full transparency, choice and control over who will have access to data and how they will use it.
Offers the option to provide “layered” information, with specific detail for organisations that have a genuine reason to use it for the person’s benefit, or for use in specific situations such as emergencies – with the confidence that different levels of detail will only be available to the organisations/services that need them.
Good practice
Poor practice
The Experian Support Hub allows you to choose the organisations that will receive your data, and makes it clear that information will only ever be used to give you the help and support you need.
Life Ledger is equally transparent, and takes the trouble to explain why you need to provide certain information, e.g. proof of ID /authority to act.
Transparency, choice and control are inherent in the four platforms serving the broad retail, leisure and entertainment sector - JAM card, Sunflower, Nimbus Access Card and Wel-co.me. All four are "Tell once" rather than "Share once" platforms, leaving the person in full control of where and with whom information is shared.
The Vulnerability Services Register sends your information to all subscribing organisations, whether or not they have a business relationship with you (arguably in breach of Article 5 (3) of the GDPR), and offers little clarity or reassurance about how it will be used. There is an equal lack of clarity in at least some receiving organisations’ privacy notices.
This isn’t only about information potentially being used to someone’s disadvantage; it’s also about information reaching (or not reaching) those who ought to have it in the receiving organisation.
3.1
Transparency
Reasonably transparent website and privacy policy, though the latter is a bit clogged up with definitions (e.g. "Services: the Passenger Assistance services made available to Users by Service Providers, the provision of which is facilitated by the Technology Platforms" and "Service Providers: the persons, firms or companies who license any of the Technology Platforms from Transreport from time to time and who provide of the Services", and don't refer to train operating companies.
3.2
Choice and control
Choice and control over how much information is shared, but site states "We share your data with the energy & water industry so your priority needs are fully supported" (though this isn't clearly reflected in the privacy statement), and there's no clear statement that it will only go to energy and water firms that have a relationship with you.