Hi

One of our tenants is a self employed driving instructor who has made a claim for Housing Benefits. To complete the claim the authority has asked him to give names and addresses of clients. I am a little taken aback why they would need this; also there is the question of data protection to be considered.

What are your thoughts on this?

Thanks

I would first of all suggest that you ask them why they want to know. It seems highly dubious to me, and would very likely put your client in breach of the DPA. I cannot see to what possible use the LA could put this information - assuming they don't imagine they can start contacting these people.....they can't think that....can they??

Under normal circumstances, I'd agree that asking for such info is over the top.

However, strictly exceptionally, further detailed info can be requested if the LA has doubts about the evidence / info being given by the clmt. In these circumstances only, I don't think the DPA is breached (exercising legal rights etc). But, I stress, this would be the exception.

Regards

I'm still dubious. Remember that it is the claimant who is potentially in breach of the DPA here, and I am not sure how good an argument the LA can put up for apparently encouraging him to commit this breach.

I am guessing that the LA wants this info because of some issue regarding the claimant's credibility about whether he is actually trading which they think could be resolved by the production of some clients names and addresses (?) Probably OK(ish) if that is as far as it goes, but the LA surely cannot go contacting these people without the claimant's permission, and it is arguably unreasonable to expect him to give that permission. In his position, I am not sure I would want my precious clients being hassled by the local council about my HB claim!

I’m inclined to agree with Kevin on this one although I’m desperately trying to come up with a counter argument. However, and its a big however, the LA would only, in my view, be entitled to this under the following circumstances.

Pursuant to his claim he has provided the LA with a record of his trading accounts (or some other records which evidence his trading – i.e. invoices) for the relevant period, which enable his entitlement to be assessed. The LA have some concrete evidence which suggests that there is a discrepancy between his trading activities and his trading accounts or there are internal inconsistencies in his trading accounts for which he has been unable to offer a satisfactory explanation or which point to an intention to deceive or mislead.

I’m not even sure that the DPA has any application as the right of access under section 7 only applies to individuals’ right to access and I don’t think that this stretches to body corporate (although I may be wrong on that).

Even if it did the data controller can pass on data in certain circumstances. For instance, the detection or prevention of crime. And the data supplied to the individual which contains data relating to a third person cannot be passed on to a fourth person. In other words, if the LA were supplied with information they could not pass that on to anyone else although (I think, I’m not sure) that it may be possible to pass it on to the police for purposes of prosecution

imo the request is outrageous. apart from procuring a possible breach of the DPA, the authority is asking the claimant to breach implicit trust with his clients, which, if the LA _does_ contact and question them, could harm his reputation and damage his livelihood.
driving instructors more often than not rely heavily on word of mouth recommendations, and learner drivers want to learn to drive, not answer question about their driving instructor, which may be upsetting and inconvenient.

in fact, the LA couldn't contact them without breaching your client's right to confidentiality. they would be questionning them 'in connection with a claim to HB/CTB, giving away that the driving instructor is claiming benefit, right? unless the authority is in the practice of demanding answers to questions without explanation of the reason for asking - in which case, i suggest it is evidence that we live in a police state.

his statement of profit and loss should be accepted unless they have good reason to doubt it. if they do, they should tell you what doubt arises, and i betcha it can be resolved other than by your client providing them with this information.

JJ puts it perhaps a bit more strongly than me but I think he is substantially correct. The LA is effectively asking this guy to breach the DPA. I do not think there is any question that he is a data controller within the meaning of the DPA. I do not see how he can provide this information to the LA without first obtaining the consent of his clients, and that, as JJ says, compromises HIS right to confidentiality regarding his claim.

I know that there are "get-outs" which can enable a LA to do this sort of thing (prevention/detection of crime, etc), but if this is just a bit of inconsistency that needs clearing up (as opposed to major suspicions which are the subject of an investigation), I do not think the Information Commissioner would be impressed by any attempt to use that as justification.

Some of the latter posts have assumed the LA intends to contact the clmt's clients. Just an observation that the original post doesn't state this.

In terms of contact with the clmt's clients, I'd agree that the LA should not do so except in all but the most extreme cases. And, such cases do occur. Picture this (REAL case).....

Clmt (Driving Instructor) submits claim to LA - very low income. Clmt pleads "business is slow" etc. LA know from other claims from Driving Instructors that business is nothing like as slow. LA ask for details of clients.... Clmt provides it. LA notices that one of their own staff is a client. LA speaks (nicely!!) to staff member and it transpires that she has had lessons in weeks where clmt says "no business". Also transpires that the Instructor has variously arrived late (due to overrun with prev client) and expressed a wish to get to his next client promptly....! All in the same weeks for which there was allegedly no business. No prizes for what happened next.... And yes, this did happen - I saw the file.

Regards

an ends justifies the means argument on the basis of an exceptional case, kevin? : )

apart from the obvious question - did she pass her driving test? - what would the LA have done if it didn't recognize any names? if it does nothing with the information, it is hardly 'necessary proof', and i'm struggling to see how a self-employed person's list of clients can ever be necessary proof.

the general knowledge about driving instructor's earnings generally, doesn't constitute reasonable grounds to suspect fraud in a particular case - and even in the case you highlighted, the request was a fishing expedition. i would expect an request for explanation of the low earnings to precede the request for client details - eg the claimant might just be starting up in business, might be limiting his hours due to disability or care committments - as in another )appeal) case under discussion recently, or a recent client of mine - a disabled taxi- driver, who declared everything to the disability adviser, who had actually given him a start-up grant - didn't stop him being called for an interview under caution, and guess what, they had no evidence of any offence and no further action.

i expect, as usual, we disagree. : ) i only wish LA's would stir themselves as diligently to help disadvantaged claimants to obtain their benefit as they do to disallow claims. it seems sort of...imbalanced.

regards

jan

Perhaps he could submit the information the way LAs supply IUC info to Tribunal, with swathes blacked out. The information is there just censored to protect the innocent

Section 7 of the DPA states

7. - (1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled-

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

Although the claimant may be a data controller and even if the LA were an individual then the LA is not the data subject about which the personal data pertains to.

Therefore the LA’s request for the info is not a DPA request so I do not see how the Act has application here.

Don’t get me wrong I am not defending the LA’s actions here. I do not know enough about the case to comment. But I do think that they may not be acting unlawfully in the limited circumstances I have outlined above.

my thinking was his client's are data subjects - he is the data controller - he would be breaching DPA by providing data to a third party...and the LA shouldn't be asking him to do so...

as to whether the LA has committed a section 56 offence, i wouldn't like to speculate... : )

Yes that was my thinking too - that the LA was effectively procuring a breach of the DPA by the claimant. But I think this has run its course now!