GDPR and Swipe/ID cards

[bobsmith]

Is losing it a data breach? If an individual lost their own Photo ID ... it would be debatable (I've had 4 different opinions on this so far).

 

So if I lose my driving licence then the DVLA has a breach on their hands?

 

I know GDPR and DP isn't totally sane - but surely it should be possible to actually see the world of sanity from over there?

[enjay]

So if I lose my driving licence then the DVLA has a breach on their hands?

 

I don't think so because the DVLA didn't cause the breach, you did.

[bobsmith]

I would agree with you, but GrumbleDook posted that he had 4 different opinions on it - i'm just wondering what the other opinions are....

[GrumbleDook]

1 - the ID card is not compulsory to have outside of the school so if they took it outside and lost it, it would be the equivalent of losing a personal item which holds data - so not a breach (I’m dubious about this ... this sounds a bit too much like trying to shift all responsibility to the owner of the ID card ...)

2 - if the ID is that if a child then have you checked to see if they are competent enough to look after personal data in the first place. (Interesting one but, again ... is this trying to put the risk into the child by saying they are old enough to know better? If that is the case, then they could be old enough to make their own decisions on data and even try to over-rule parental responsibilities)

3 - it depends on what is on the ID card. Does it show data that could cause harm or damage their rights and freedoms? Does the card also contain other data (RFID, mag-strip) that holds data or provides access to other data? (This is more promising and it makes the school think about the purpose and data minimisation)

4 - use common sense. Is it any different to losing a school book that has a list of classmates in who are all in a project? (Common sense is not that common and not always right ... but it is a good starting point)

 

The simple answer is ... it is what the school feels it is and they just need to be able to justify it. Either in the DPIA undertaken around ID cards or in the way they record any losses of cards.