Use of postcards to communicate with customers regarding overdue account [08/04/2010]
In July 2009 I received a complaint from a data subject concerning a company communicating with him via postcard to inform him that his account was overdue. The company communicated with him twice via a pre-printed postcard marked Urgent Overdue Account in white print on a red background. The postcards were delivered to the customer's address through the normal postal system.

The data subject pointed out to my Office that these postcards had come through the postal system and they had potentially been seen by the staff in the sorting office, the staff in the local general post office, by staff in the local post office which is in a small rural area and the postman. He also pointed out that the bright red design of the cards and the large print on them made it very easy for postal staff handling them to see and read their contents. The data subject also told my Office of the embarrassment caused to him and his wife as a result of the sending of the postcards through the postal system as the postman who delivered them was a neighbour of his.

My Office contacted the company and informed it that the sending of information on a postcard to the data subject regarding his overdue account constituted a disclosure of his personal information and that such a practice was in breach of the Data Protection Acts, 1988 and 2003. We requested that the company confirm to us that they would immediately and voluntarily cease this practice.

The company responded to my Office promptly and informed us that it had taken verbal legal advice before sending the postcards and that it was not aware that it was in breach of the Acts. It confirmed that it would immediately and voluntarily cease sending such postcards to customers whose accounts are overdue. My Office received full cooperation from the company throughout our investigation of this matter.

We attempted to arrange an amicable resolution of this complaint, as the law obliges us to do in the first instance, but our efforts in that regard did not succeed.  The data subject then requested a formal decision of the Data Protection Commissioner on his complaint.

In November 2009 I issued my decision on this complaint. I informed the data subject that following my Office's investigation of his complaint I was of the opinion that the company twice contravened Section 2(1)(d) of the Data Protection Acts, 1988 and 2003 by failing to take appropriate security measures against disclosure of his personal data. These contraventions occurred when it issued two postcards to him in the postal system, each of which contained personal data.

This case demonstrates the need for data controllers to exercise great care in their handling of personal data and to refrain from actions which might compromise that data from a security perspective. While I appreciate that businesses need to pursue their customers for overdue accounts, they are obliged to comply with the law in doing so.  Disclosing the fact of an overdue account on a postcard sent to a customer is a clear infringement of the Data Protection Acts and it should not happen. 

On a more general level, data controllers who use postcards for whatever purpose should ensure that the message conveyed on them does not involve the processing of personal data. Convenience must not be put before security of personal data in such cases. I would strongly encourage any data controller whose practice it is to use post cards to re-examine such practices from the perspective of their legal obligations regarding security measures for the processing of personal data. The key message to be taken from this case study is 'think data security before convenience.'