Indeed - my local dealership asks for payment up front (over the phone if necessary) for the parts.
Well, yes and no. The data needs to pertain to personal data; or data which relate to a living individual who can be identified. (e.g. a name)
Next, you would need to ensure that when you collected said data, you informed the person of the intended use, so you would have needed to inform them that you will publicly disclose said information about them if they don't show up. (and of course informed your controller, but you have to do that anyhow as you are collecting PI data). So there may be a workaround.
That said, under 2.10 (Right to prevent processing likely to cause damage or distress.) you may fall foul anyhow if said person asks you to remove the public shaming.
So, you may have a solution if when you originally collect the data, the subject is informed of how said data will be used, and how long it will be used for, but someone may still take a dim view.
There's also the reputational fallout - there is bound to be a customer who then goes to the daily mail with a sob story, and next thing you know there's an article about a dealer who publicly named a customer who was in A&E.
Finally, don't forget that pretty soon, the EU DPD should finally be ratified, which all (should/may) further strengthen data privacy.
M.
