Moneybookers: potential breach of UK law
Tuesday, July 22, 2008
Moneybookers: potential breach of UK law
Moneybookers, according to the about us page, is "...a leading international online payment system and electronic money issuer authorised under UK and EU law and regulated by the Financial Services Authority (FSA) in the UK."
The location in a credible jurisdiction and regulation by an accountable governmental body is important as it gives vital protection to its customers under UK law; amongst other things, this includes the protection of personal data under the 1998 Data Protection Act.
In the PKR rovoking bonus discussion at Casinomeister a customer claims to have had his Moneybooker's account closed, the only explanation forthcoming from Moneybookers being that they "...received a complaint from an unnamed merchant".
In the "Rights of data subjects and others" section of the Data Protection Act, the following is stated:
7 Right of access to personal data
(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled -
(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of -
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form -
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data
(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled -
(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of -
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form -
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data
This tells us that a consumer must be informed when and why his personal data is being processed, and from whom any data of which he is subject may have been received.
Moneybookers has failed to do any of this.
i) They have not disclosed the data they received "from an unnamed merchant".
ii) They have not disclosed the purpose of the data.
iii) They have not disclosed the source of the data, the merchant in question.
Assuming that the situation has been correctly reported, Moneybookers appears to be in breach of UK law.
The Information Commissioner's Office promotes both access to official information and the protection of personal information on behalf of the customers of UK-based companies. If a customer's rights under the Data Protection Act have been breached, they can file a complaint using the online enquiry form.
This seems to be the best course of action for the customer in question.
The security of personal data is of paramount importance in all things, both gambling-related and otherwise. Last year I reported on the CAP database sale issue, the proferred sale of the personal data of ten thousand UK online casino customers. The matter was hotly denied and its discussion was ultimately stifled, which is not entirely surprising considering the sensitivity of the issue and its possible ramifications.
Moneybookers is a regulated UK institution with many UK customers for whom large sums of money are processed. If they have breached UK law in not revealing to a customer details of personal data received from a third party, data upon which which they subsequently acted, they should be required to answer for it.
Your personal data is just that: yours. It is not available for hawking to the highest bidder, no more than it is available for use or disclosure to third parties without your knowledge or agreement.
Permalink
|
Reply (2)
| 
2 Previous Comments
Actually slightly incorrect
If you phone any organisation up and ask them for information, they are not abliged to tell you.
However, you have shown section 7 of the DPA which allows for a Subject Access Request where ALL information held on relevant filing systems must me disclosed. A maximum fee of �10 is chargable
By 
, at
10:50 PM
The DPA requires that all relevant personal data be revealed to the data subject themselves. I said nothing about casual phone calls.
Which part of my article is incorrect?
By 
100% Gambler, at
2:13 PM
May 2005 | June 2005 | July 2005 | September 2005 | October 2005 | November 2005 | December 2005 | January 2006 | February 2006 | March 2006 | April 2006 | May 2006 | August 2006 | October 2006 | January 2007 | February 2007 | March 2007 | May 2007 | June 2007 | July 2007 | January 2008 | February 2008 | March 2008 | April 2008 | June 2008 | July 2008 | September 2008 | October 2008 | December 2008 | January 2009 | February 2009 | March 2009 | May 2009 | June 2009 | July 2009 | August 2009 | September 2009 | October 2009 | November 2009 | December 2009 | January 2010 | February 2010 | March 2010 |
