Moneybookers: potential breach of UK law

Tuesday, July 22, 2008

Moneybookers: potential breach of UK law

Moneybookers, according to the about us page, is "...a leading international online payment system and electronic money issuer authorised under UK and EU law and regulated by the Financial Services Authority (FSA) in the UK."

The location in a credible jurisdiction and regulation by an accountable governmental body is important as it gives vital protection to its customers under UK law; amongst other things, this includes the protection of personal data under the 1998 Data Protection Act.

In the PKR rovoking bonus discussion at Casinomeister a customer claims to have had his Moneybooker's account closed, the only explanation forthcoming from Moneybookers being that they "...received a complaint from an unnamed merchant".

In the "Rights of data subjects and others" section of the Data Protection Act, the following is stated:

7 Right of access to personal data

(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled -

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b) if that is the case, to be given by the data controller a description of -

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

(c) to have communicated to him in an intelligible form -

(i) the information constituting any personal data of which that individual is the data subject, and

(ii) any information available to the data controller as to the source of those data

This tells us that a consumer must be informed when and why his personal data is being processed, and from whom any data of which he is subject may have been received.

Moneybookers has failed to do any of this.

i) They have not disclosed the data they received "from an unnamed merchant".

ii) They have not disclosed the purpose of the data.

iii) They have not disclosed the source of the data, the merchant in question.

Assuming that the situation has been correctly reported, Moneybookers appears to be in breach of UK law.

The Information Commissioner's Office promotes both access to official information and the protection of personal information on behalf of the customers of UK-based companies. If a customer's rights under the Data Protection Act have been breached, they can file a complaint using the online enquiry form.

This seems to be the best course of action for the customer in question.

The security of personal data is of paramount importance in all things, both gambling-related and otherwise. Last year I reported on the CAP database sale issue, the proferred sale of the personal data of ten thousand UK online casino customers. The matter was hotly denied and its discussion was ultimately stifled, which is not entirely surprising considering the sensitivity of the issue and its possible ramifications.

Moneybookers is a regulated UK institution with many UK customers for whom large sums of money are processed. If they have breached UK law in not revealing to a customer details of personal data received from a third party, data upon which which they subsequently acted, they should be required to answer for it.

Your personal data is just that: yours. It is not available for hawking to the highest bidder, no more than it is available for use or disclosure to third parties without your knowledge or agreement.

Permalink | Reply (2) |

2 Previous Comments

Actually slightly incorrect

If you phone any organisation up and ask them for information, they are not abliged to tell you.

However, you have shown section 7 of the DPA which allows for a Subject Access Request where ALL information held on relevant filing systems must me disclosed. A maximum fee of £10 is chargable

By Anonymous, at 10:50 pm

The DPA requires that all relevant personal data be revealed to the data subject themselves. I said nothing about casual phone calls.

Which part of my article is incorrect?

By 100% Gambler, at 2:13 pm

Post a Comment