I have been accused of a DPA breach, and as far as I can tell, this is not the case. I work for a small Mobile Phone Network Operator specialising in international calls. Customers often call up and their SIM cards are NOT registered with their personal details (e.g name address etc). In such cases, we are required to get confirmation of 3 pieces of info relating to the activity on the SIM. For example 3 common pieces of info we go by are:
1. How much was the last top up ? (e.g. £5, £10)
2. When was the last top up made ? (e.g. 7 days ago)
3. Which countries do you call/provide phone number ? (e.g. Spain, Italy, 0012345678910)
Now a lot of the time we would ask 3 questions to get the 3 answers.
However, in my case and the specific call in question, The customer called in and gave me 2 of the above answers himself. That is, he called up and stated without me asking 'My last top up was for £10 and it was made 6 days ago'. I have then asked him where he calls, to which he responded 'Spain'. All of the 3 pieces of information gathered from the customer matched what was on his file, and requests were processed by myself for him.
Management are claiming that I have breached DPA because I only asked 1 security question.
When I put it to them that the customer had already confirmed 2 other pieces of information for me himself, they said that I would still have needed to ask him the 2 questions. That is, ask 2 questions that I already know the answers to/that the customer has already given me the answers to, and that have already been confirmed to be correct as far as what's on the customer's file.
Is this a DPA Breach ?
By this logic, if a customer's SIM is registered, and he calls up and says 'my name is John Smith, I live at XYZ, and my date of birth is 123', I would have to ask him for his name, address, and DOB, for him to confirm all over again ! I suppose to show that I have asked 3 questions.
I'm really sorry for this being long winded.
I would appreciate more than words can describe if anyone with good knowledge of DPA could assist. I will be contacting managment imminently and need to know where i stand.
Many thanks in advance.