Outcomes - Selected Case Summaries
Categories
Excessive data gathering for beach weddings - Public Lands Commission
Decisions | 09 November 2023
Public Lands Commission
A member of the public made a complaint to the Ombudsman against the Public Lands Commission (PLC). The complainant claimed that the PLC was unnecessarily collecting personal data from marriage officers, their staff, and visiting clients, who used public beaches for wedding ceremonies, and that the frequency with which the personal data was being collected was excessive.
The Ombudsman investigated the matter, but, due to a lack of response, had to issue an Information Order to obtain information needed in the investigation. The Ombudsman found that the PLC had a legal basis for processing personal data, but it contravened the DPA's first and third data protection principles, respectively, by not providing a privacy notice and excessively collecting personal data.
The Ombudsman ordered the PLC to provide a privacy notice to data subjects when their data is being collected, and to cease collecting excessive personal data (e.g. copies of passports) of individuals who are organizing wedding ceremonies on public land or are engaging in other activities for which, by law, no permit is required. The PLC may continue to process personal data that is strictly necessary for avoiding scheduling conflicts and ensuring accountability for potential damage to public lands or facilities, such as names and contact details. Such data should only be retained for as long as required for the purposes for which it was gathered, in accordance with the fifth data protection principle.