In September 2009 we received a complaint from a state employee alleging that his former employer had disclosed personal information regarding his previous career dating from 1982 to an officer (X) of another agency. X allegedly circulated the information to other parties in a handwritten memo. The complainant supplied us with a copy of the handwritten memo which included comments relating to his previous career. This memo was signed by X.
There were two components to our investigation of this matter as it involved two separate data controllers and allegations of separate breaches of the Data Protection Acts against each of them. The breaches involved the alleged unlawful obtaining and processing by X of information relating to the data subject and the alleged disclosure of the data subject's personal information to X by his former employer.
As the Local Authority is the data controller for personal data processed by X, we contacted it in relation to the allegation that one of its officers unlawfully obtained the data subject's personal data. In our initial communication to the Local Authority, we requested that it clarify the purpose for which X obtained the data subject's personal data from the former employer and provide us with the name of the person who disclosed this information.
The Local Authority informed us that X received an anonymous telephone call and, on foot of that call, he deemed it appropriate to make enquiries as to the data subject's previous record with the employer. We were told that X, remarkably, could not recall the name of the senior officer who actually supplied the information. The Local Authority stated that X subsequently received a return telephone call from another employee (whose name he was equally unable to recall) who supplied him with certain personal information relating to the data subject.
We contacted the data subject’s former employer on the basis of the Local Authority’s response to our investigation. The employer informed us that it had conducted a search of the data subject's personnel file to check for any memo indicating that information had been disclosed to X. We were informed that no such memo was found on the file. Without the name of the senior officer with whom the X communicated, the complainant’s former employer was not in a position to comment on the alleged disclosure.
To progress the investigation an authorised officer visited the former employer’s headquarters to inspect the data subject's personnel file. On comparing the information on the data subject's personnel file with the information on the handwritten memo signed by the officer, our authorised officer was satisfied that the information in the memo was sourced from the former employer’s personnel file. On this basis we concluded that Section 2 of the Acts had been breached by the disclosure of personal information without the data subject's knowledge or consent or other appropriate legal basis.
The Acts provide that our Office must try to reach an amicable resolution to a complaint in the first instance. The former employer confirmed its interest in finding an amicable resolution. The data subject's complaint against his former employer was amicably resolved when a letter of apology was issued to him. His former employer expressed its regret for the release of his personal data in an unauthorised manner to a third party and it apologised unreservedly to him.
In relation to the complaint against the Local Authority, we were satisfied that Section 2 of the Acts had been breached when the officer obtained and processed personal information relating to the data subject without his consent or knowledge. This complaint was amicably resolved when the Authority provided the data subject with a letter of apology in which it described the circumstances in which his information was obtained from his former employer and acknowledged that the information should not have been sought or obtained. The Authority described how the information was subsequently divulged by the officer to others. The letter assured the data subject that he had not suffered any disadvantage as a result of the Local Authority being in possession of the information. The Local Authority confirmed that the hand-written memo and any copies of it in its possession would be shredded.
We view this case as a serious breach of the data protection rights of the individual concerned. We are concerned that a personnel file dating from 1982, which was in the control of the State, was retrieved and thoroughly searched for comments made by superiors. This information was then disclosed by phone to an outside party without any regard for the rights of the individual concerned.