Dear Sirs,

Your web page for signing up to newsletters
<http://register.transportscotland.gov.uk/> includes a number of
questions, including Date of Birth.

Although putting anything into this box is not necessary to submit
the form, I wish to know how you think attempting to collect this
information complies with the Data Protection Principles
<http://www.ico.gov.uk/Home/what_we_cover...>
in particular the second, third and seventh principles. How is
attempting to collect this information relevant to sending out
newsletters?

What is the privacy policy regarding the collection of this data?

Where is the fair processing notice and what does it contain?

Note that your reply should be in the same format as these
questions, plain text. Proprietary formats, such as Word, are not
acceptable.

Yours faithfully,

David Hansen

Dear David

Thank you for your e-mail which has been passed to me for a reply as I am responsible for the Transport Scotland website and e-newsletter facility.

When persons subscribe to our electronic newsletter via our website we require only a minimum amount of information from them: their name and e-mail address; an indication of the newsletter(s) they would like to receive and a preferred format. All other information we collect is optional. Our intention in gathering this additional information is to allow us to get a profile of persons who have subscribed to our different newsletters. Some of this can be used to provide persons with a more personalised experience.

We have on our website a privacy policy statement in relation to registering for our e-newsletter please see the Terms and Conditions page of our website http://www.transportscotland.gov.uk/term....

The collection of this information, provided voluntarily, is in keeping with the second and third principles of the Data Protection Act. As regards security, the information is held on a server with appropriate firewall and other security measures in place.

It is worthwhile noting that our use of an e-newsletter and sign-up policy accords with that of the Scottish Government who have a similar facility on their website.

Yours sincerely

Gerard Scullion
Website Manager
Transport Scotland

show quoted sections

Dear Gerard,

Thank you for your response. While it provides some information it
does not get to the heart of the matter.

You state, "our intention in gathering this additional information
is to allow us to get a profile of persons who have subscribed to
our different newsletters. Some of this can be used to provide
persons with a more personalised experience."

Just how personalised an experience do you want to provide? By
collecting dates of birth this could be a very personal experience
indeed, especially when the data leaks. What analysis of the third
data protection principle in relation to this item did you do? You
presumably compared asking for date of birth with asking for age
and asking for an age range, both of which reduce security risks,
deciding that it was justified to ask for date of birth. Please
provide a copy of this analysis.

On the matter of the Scottish Government website, I have not looked
at it recently. However, they are hardly an example of good
practice.

Yours sincerely,

David Hansen

Dear David

Thanks for your e-mail of 30 May.

The main reason for asking persons to provide, optionally, their date of birth is to enable Transport Scotland to gather an age profile of users. Whilst we could ask for age, we would then have to identify when users subscribed to the site to get an up-to-date profile of our subscribers age. As persons sign-up on an ad-hoc basis this would make the task more difficult to do. So it helps us to gather dates of birth.

I hope this reassures you.

Yours sincerely

Gerard Scullion
Website Manager
Transport Scotland

show quoted sections

Dear Gerard,

Thank you for your reply, which did not convince me.

I find it extremely difficult to believe that whatever system you
use is unable to record the date at which someone subscribes to
your updates. I suspect that it records this already, but if it
does not this could be very easily added. A simple query on the
subscription date and the age fields would then give you an
up-to-date profile of your subscribers' ages, accurate to a year.
Do you require anything more accurate and if so why?

Such a query could be written and tested in minutes and the
appropriate changes made to the database and web site in an hour at
most, even with testing. This would include converting the current
database entries into something suitable for the new system. One
query would do this conversion. I don't generally offer free
consultancy, but the difference between the subscription date and
now, added to the age, gives the current age of the subscriber,
accurate to within a year. This is scarcely more complicated than a
query which works out the difference between date of birth and now.

I asked for your analysis of asking for dates of birth. The silence
on this implies that you did not carry out any analysis.

Yours sincerely,

David Hansen

Dear David

I believe that I have done my best to answer the original points you have raised. If you have any other issues separate from this let me know.

Yours sincerely

Gerard Scullion
Website Manager
Transport Scotland

show quoted sections