Excessive data gathering for beach weddings - Public Lands Commission (2023-11-09)

Summary

This is an Ombudsman case summary describing the outcome of a Data Protection Act complaint against the Public Lands Commission (PLC) concerning personal data collected from marriage officers, their staff, and clients using public beaches for wedding ceremonies. The Ombudsman found the PLC had a lawful basis to process the data but breached the first data protection principle (no privacy notice) and the third principle (excessive data collection, e.g. copying passports).

• Privacy notice: The PLC was ordered to provide a privacy notice to data subjects at the point their personal data is collected.
• Excessive collection: The PLC must stop collecting excessive personal data, such as copies of passports, from individuals organising or attending wedding ceremonies (or other activities not requiring a permit) on public land.
• Permitted retention: The PLC may continue to collect data strictly necessary to avoid scheduling conflicts and ensure accountability for damage to public land or facilities (e.g. names and contact details), but only for as long as needed, per the fifth data protection principle.

While this decision addresses the Public Lands Commission specifically, it illustrates the Ombudsman's approach to the necessity and notice principles under the Data Protection Act and may be instructive for other public authorities and data controllers handling similar personal data collection practices.

Key obligations

• The Public Lands Commission must provide a privacy notice to data subjects when collecting their personal data.
• The Public Lands Commission must cease collecting excessive personal data (such as copies of passports) from individuals organising or attending activities on public land that do not legally require a permit.
• The Public Lands Commission may only retain personal data that is strictly necessary for scheduling and accountability purposes, and only for as long as required for those purposes.

Applies to

Public Lands Commission, public authorities, data controllers