CRT privacy issues

In December 2020, while the terms and conditions consultation was in progress, we reviewed the privacy documents and made a submission on our concerns. They were numerous, but three stood out: the first was readability; the second was that the documents were obviously written at different times, so they did not link up; and, thirdly, we did not agree with the legal consents. We felt that many of the matters were not compliant with the law. We heard nothing for six months, no request for clarification, no phone call, just the usual legal blanking that we have become used to from the CRT in-house legal department. They don’t do customer relations.

We did finally get a written response at the same time that the new terms and conditions were produced in May 2021. The privacy documents were also republished, like a rabbit out of the hat. Thankfully, many simple issues have been addressed, so we are making progress. Are we happy now? No, we are not. We have offered to help CRT, but they have not responded.

CRT says that these documents are not part of our licence agreement. NABO does not agree. They are the legally-binding promise by CRT as to how it handles our data. They go together with the terms and conditions document and, because they are part of the offering to boaters at time of purchase when they buy a licence, they are therefore part of the contract.

The privacy laws require documents to be readable and understandable, but the current versions are not well composed and don’t meet the accepted standards. CRT understands this because it rewrote the terms document to comply. So why not the privacy documents as well?

For data handling, CRT has to identify each parcel of data, say what it is going to do with it and why, and then identify the legal basis of the agreement to hold the data. This is the ‘legal consent’. For our boat licence, the consent is ‘public task’ because the activity is a legal duty of CRT governed by the Acts. Although CRT has wide powers under the ’62 Transport Act, in our view these do not extend to changing the scope of the ’95 Act.

CRT has assumed your agreement to holding and using, say, your email address for activities other than licensing, for example consultations, marketing, advertising etc. It says this is a legitimate interest. Legitimate interest is in itself a valid legal consent, but there are limits and it places a high duty of care on CRT. There can be no transfer of data from one parcel of data to another. For example, your email address should not be transferred from your licence application, to be used for marketing, customer research or self-promotion. In general, public bodies are not allowed to use legitimate interest as a consent. They need to ask.

CRT says it uses legitimate interest as the consent to cover boat insurance details, but any request for data other than specifically required in the Act exceeds CRT powers. They’ve tried to get around this by putting a clause in the terms document. Is this legal? We don’t think so.

So what have we done about all this? Fortunately, the Information Commissioner’s Office is responsible for enforcement of UK privacy law, so we have made a formal complaint. We await their response. In the meantime, if you are in any doubt about the customer friendliness of CRT legal, have a look at this statement in the Privacy Policy: ‘We may change this Privacy Policy (or the individual Privacy Schedules below) from time to time to ensure it reflects current legislation without notice to you,’ so please do check it regularly. So, one day, when you are moored up and unable to move because of an unscheduled stoppage, do go and check the CRT privacy documents. They might have been changed yet again, to reflect their own self-serving view of the law. And according to them, they don’t even have to tell you! I doubt a judge would agree.