CalMac and personal data…

[Buzby]

In the absence RailSail, I found myself in Oban and having to purchase a return ticket to Achnacroish (the only port on the Isle of Lismore).

CalMac had a fairly slick website for supplying barcode tickets, but in addition to the usual stuff, they wanted a full DoB as well, this is after you select Child/Adult/Concession etc. Do they think I’ll buy a discounted ticket then put a conflicting date they can jump on?

It’s none of their darn business and I doubt they’ll send a birthday card. Anyone remember the ‘Over 18/21’ tick boxes? We’re being taken for fools - your CC company won’t disclose it, why must CalMac require it? I asked, via their website but they never replied!

 

[GLC]

They explain the reason why on their website https://www.calmac.co.uk/faqs/tickets-and-reservations/passenger-registration

For voyages longer than 20 miles out to sea, we're required to collect passenger details (name, gender, date of birth), to comply with maritime law - specifically, Merchant Shipping (Counting and Registration of Persons on board Passenger Ships) Regulations 1999. If you're travelling on these routes, detailed below, we need to record your details in both directions. Your details can be recorded online, when you make your booking, or when making your booking with our Customer Engagement Centre or Port teams.

• Ardrossan - Campbeltown
• Campbeltown - Brodick
• Coll - Tiree
• Lochboisdale - Castlebay
• Lochmaddy - Tarbert
• Mallaig - Lochboisdale
• Oban - Castlebay
• Oban - Coll
• Oban - Colonsay
• Oban - Lochboisdale
• Oban - Tiree
• Tiree - Castlebay
• Uig - Lochmaddy
• Uig - Tarbert
• Ullapool - Stornoway

We are aware that at present, personal data required by maritime law for longer sailings is being requested for all sailings on our online booking and ticketing platform. We are aware of this error in our system, and we are working with our supplier to resolve it.

 

[Buzby]

Oban to Lismore is about 8Km, the DoB is taken for ALL crossings, even those under 20m and most certainly within inland waters (and not ‘out to sea’). Further no information is given on what happens to such data, who has access, how long it is retained and if it is ever deleted following the journey?

it still doesn’t hold water (excuse the pun).

 

[transportphoto]

Please see their Privacy Policy: https://www.calmac.co.uk/privacy-and-cookie-policy.

 

[Bletchleyite]

Oban to Lismore is about 8Km, the DoB is taken for ALL crossings, even those under 20m and most certainly within inland waters (and not ‘out to sea’). Further no information is given on what happens to such data, who has access, how long it is retained and if it is ever deleted following the journey?

it still doesn’t hold water (excuse the pun).

I'd suggest you read it again, they have explicitly explained why it's collected for all crossings - basically it's a bug and they're working on it.

I suspect other ferry companies (which almost all operate international routes from the UK) just get it when checking passports.

As to what they do with it, one assumes it's deleted after the crossing as there's no need for them to retain it, they're just required to have it while the ship is under sail. Presumably in that context its purpose is to allow the identification of casualties.

 

[Buzby]

Why would anyone ‘assume’ what is done with the data? Without a stated policy the only thing you can safely assume is that it will be disposed of within 6 years (which is a requirement of the DPA). This ‘bug’ whereby it is erroneously collected for all crossings somewhat invalidates the earlier suggestion that it is a requirement of Merchant Shipping Regulations (1999). The bulk of CalMac crossings are short and therefore exempt, with just The Minch being the exception. The rest are within Firths or local waters - but we’re talking about personal data here which in most cases can compromise an individual if misused.

I’m expected to accept that simply because CalMac know my DoB, I will somehow be ‘safer’ on my crossing than if I was an adult/child or concession? You really couldn’t make it up - which of course anyone can do because no passports are required as it is still none of their business. As for casualty identification - sorry, that made me laugh longest as a DoB doesn’t really help with corpse identification. Just another piece of personal info that can be needlessly and unjustifiably captured, lost and misused by third parties.

 

[Bletchleyite]

Dob does help with identification as it gives age.

 

[transportphoto]

Please raise your concerns to CalMac and, if needed, the Information Commissioner. I really don’t understand the value of this thread other than to vent frustration.

 

[Noddy]

Why would anyone ‘assume’ what is done with the data? Without a stated policy the only thing you can safely assume is that it will be disposed of within 6 years (which is a requirement of the DPA). This ‘bug’ whereby it is erroneously collected for all crossings somewhat invalidates the earlier suggestion that it is a requirement of Merchant Shipping Regulations (1999). The bulk of CalMac crossings are short and therefore exempt, with just The Minch being the exception. The rest are within Firths or local waters - but we’re talking about personal data here which in most cases can compromise an individual if misused.

I’m expected to accept that simply because CalMac know my DoB, I will somehow be ‘safer’ on my crossing than if I was an adult/child or concession? You really couldn’t make it up - which of course anyone can do because no passports are required as it is still none of their business. As for casualty identification - sorry, that made me laugh longest as a DoB doesn’t really help with corpse identification. Just another piece of personal info that can be needlessly and unjustifiably captured, lost and misused by third parties.

GDPR has no specified length that a business can retain data, but states that it should not be held for longer than necessary (it’s not an arbitrary 6 years). As they are collecting it to comply with maritime law, I would suggest that they no longer need it the moment you step ashore. But you’d have to speak to Calmac about that.

Under GDPR you can make what is know as a subject data request and a link to Calmac’s form to do this is here:

Freedom of information | About us | Corporate CalMac

Learn about the Freedom of Information policies at CalMac and how you can access information through this process.

www.calmac.co.uk

They should tell you what information they hold about you, how they are using it, who they are sharing it with etc.

But like others have stated if they have to collect this data to comply with Maritime law they have to do it regardless of what you think about it. The issue is clearly with their booking software, which obviously can’t differentiate between journey type, not something sinister.

 

[Buzby]

What most seem to overlook is that there is no penalty if you choose to provide incorrect data - I have been providing random DoB’s since it replaced the ‘Over 18/21’ tick boxes of the 70’s. I have no concerns of CalMac as I paid them to provide a service nothing more and apart from where I went they know nothing about me, so no need for GDPR - How long before train companies will feel obliged to do the same is anyone’s guess. The fact others feel no resistance to providing what is asked is sad, but remains their prerogative. I think my data is valuable and I treat it so.

How many of us were aware of this ‘Maritime Law’? I used STENA extensively between Stranraer and Larne, then Belfast. No passport, they just wanted to be paid for the service provided. There was tight security during the ‘troubles’ but then and subsequently (until 2005) no DoB! Of course you cannot vote without ID anymore anyone concerned about this trend should be worried, because the reasons for doing so are facile.

 

[NIT100]

How many of us were aware of this ‘Maritime Law’? I used STENA extensively between Stranraer and Larne, then Belfast. No passport, they just wanted to be paid for the service provided. There was tight security during the ‘troubles’ but then and subsequently (until 2005) no DoB! Of course you cannot vote without ID anymore anyone concerned about this trend should be worried, because the reasons for doing so are facile.

Date of Birth has only become a requirement since 2021 under The Merchant Shipping (Counting and Registration of Persons on Board Passenger Ships) (Amendment) Regulations 2021. Before that only an indication of category of age was required. Nationality is now also required as well.

What most seem to overlook is that there is no penalty if you choose to provide incorrect data

I think it might be an offence under the 1999 Regulations to knowingly provide false information.

 

[Buzby]

I think it might be an offence under the 1999 Regulations to knowingly provide false information.

It isn’t. The only concern is the falsification of numbers travelling (which is not within the remit of the lowly passenger).

Merchant Shipping Regulations 1999

 

[Noddy]

Date of Birth has only become a requirement since 2021 under The Merchant Shipping (Counting and Registration of Persons on Board Passenger Ships) (Amendment) Regulations 2021. Before that only an indication of category of age was required. Nationality is now also required as well.


I think it might be an offence under the 1999 Regulations to knowingly provide false information.

The updated 2021 regulations also say this with regards to data protection:

Personal data which is collected in accordance with regulation 6(2) must be kept by the owner of a passenger ship—

(a)for no longer than is necessary for the purpose of these Regulations; and

(b)in any event, no later than the moment the ship’s voyage has been safely completed and the data has been reported in the National Single Window or, as the case may be, to the passenger registrar after which it shall be erased without undue delay.”.

I have no concerns of CalMac as I paid them to provide a service nothing more and apart from where I went they know nothing about me, so no need for GDPR -

If you have no concerns why did you even start this thread?

 

[Buzby]

If you have no concerns why did you even start this thread?

Because I never provided them with any personal information, apart from the cardholder payment details. However, with regard to the Maritime Act they are requiring unneeded details due to failings in their system. No doubt the rest of us were blindsided by Y2K preparations where nothing really happened. As for your faith in any third-party playing by these rules I find touching. It’s all you have to protect (if you wish) what’s next? You cannot vote already, now ferries - will trains be next? It remains a half-assed scheme with marginal (if any) benefit. I’ve lost count of scams that request a DoB, and I hold these in the same contempt.

No point making it easy after-the-fact when it goes wrong.