Disclosure of employee information [2007] IEDPC 7 (31 December 2007)
Early in 2007, my Office received a significant number of complaints from employees of XX regarding an alleged disclosure of their personal information by XX to a third party without their consent. According to the complainants, the Human Resources Division of XX had passed on the names, staff numbers and place of employment of its staff to H without the knowledge or consent of the employees concerned. Staff of XX had become aware of this matter when they received personally addressed promotional literature from Z, a healthcare organisation offering a range of health care plans. In this promotional literature, a copy of which was received in my Office, Z informed the XX employees that XX had agreed to allow it to directly distribute the information to them.
Section 2 of the Data Protection Acts, 1988 and 2003 sets out the position in relation to the collection, processing, keeping, use and disclosure of personal data. It provides that data should be obtained and processed fairly, kept for only one or more specified purposes and it should be used and disclosed only in ways compatible with that purpose or those purposes. It also provides that personal data should not be processed by a data controller unless at least one of a number of conditions is met - one of those conditions being the consent of the data subject to the processing.
In response to initial contact from my Office regarding the alleged disclosure of personal information, XX confirmed that it had passed on the personal data of its staff to Z and it set out the background to how it had occurred. It explained that the company had previously operated and administered a Staff Welfare Fund to assist employees in certain circumstances in relation to personal and family medical expenses. As this fund had closed, XX committed to putting another scheme in place and it negotiated with HSA Ireland to offer a replacement scheme to employees. In order to increase staff awareness of this new scheme, it was decided that it would be in the best interests of staff to write to them directly at their place of employment. Employee names and staff numbers were provided to Z by means of a mail merge file. XX was of the opinion that this disclosure was legitimate in accordance with what it regarded as a bona fide employment purpose. It also confirmed that consent had not been sought or obtained from its employees prior to the forwarding of the employee details to Z.
My Office reminded XX of its obligations under Section 2 of the Data Protection Acts with regard to the processing of personal data and it pointed out that the personal data of its staff should not have been disclosed to a third party without the consent of the employees concerned. In the circumstances, my Office sought and obtained confirmation from XX that it had now destroyed the mail merge file containing the names and staff numbers which it had forwarded to Z. Confirmation was also received from Z that it had not retained records of XX employee names, addresses, payroll or payslip numbers on any database.
My Office was satisfied by the steps taken by XX and Z in terms of corrective action. By way of clarification, we pointed out that the key issue from a data protection perspective was that XX had facilitated contact from a third party to its employees concerning the availability of a staff welfare scheme while the same information could have been promulgated to those employees without raising any data protection concerns had XX sent it directly to its employees instead.
I fully recognise that employers may, from time to time, wish to communicate details of various schemes to their employees. This can easily be achieved without infringing on the data protection rights of employees if the employer supplies the information directly to its employees or by some other means in conformity with the Data Protection Acts. My Office had only in the weeks before these complaints were received conducted an audit of XX which had generally found a high level of compliance with data protection requirements. The occasion of the audit could have been used to seek advice from my Office on this issue.
My Office is always available to give advice to data controllers and the public alike in relation to data protection responsibilities and rights.