Irish Data Protection Commission Case Studies

Prosecution for failure to comply with legal notices [30/05/2011]

In April 2009, we received a large number of complaints against Company X (a broadband provider) concerning the disclosure of personal data as a result of an email it had issued.  The email was entitled 'Disconnection Notice' and was sent to over three hundred customers.  Among other things, the email stated that the customer's account was in arrears and that, unless contact was made within twenty four hours, their service may be cancelled and their account may be passed to its legal department.  Company X included all of the email addresses openly in the 'To' field of the email, thereby disclosing the email addresses (and therein the identity of the recipients in many cases) and the content of the email to every customer to whom it was sent.  Apart from complaining about the disclosure of their personal data, some customers expressed further annoyance that they had been sent the email at all since their accounts were not in arrears.

We began our investigation into this matter by immediately contacting the company.  We instructed the company to issue an email of apology to all affected customers.  On receipt of our request, Company X immediately issued an email of apology to all those affected by the disclosure.  My Office then sought a full report from the company on the cause of the incident.  We asked the company to outline the steps it had taken to ensure that such a disclosure would not recur.  Approximately six weeks later we received an incident report from Company X in which it provided some detail on the cause of the incident and the steps taken to prevent a recurrence.  However, the report contained some information which appeared to conflict with our understanding of the subject matter of the original email.  As a result, we sought clarification on some aspects of the incident report.  We also informed the company of our obligation to attempt to amicably resolve complaints and we asked it to inform us of any proposals it wished to put forward to amicably resolve the complaints we had received.  However, despite a number of reminders, the company failed to respond to our letters.  As a result, in October 2009 an Information Notice was served on it under Section 12 of the Data Protection Acts.  This Notice required the company to provide certain information within twenty one days.  We received an acknowledgement of receipt of the Notice from Company X's Customer Service Manager.  However, the company failed to comply with the requirements of the Information Notice as it did not provide the information sought.

We received a separate complaint in July 2009 from one of the customers affected by the disclosure concerning a request she had made to Company X under Section 3 of the Acts.  A Section 3 request obliges a data controller to inform the requester whether it holds any of their personal data and if so, to provide the requester with a description of that data and the purposes for which it is kept.  The data controller must comply with the Section 3 request within twenty one days.  In this case, Company X failed to respond to the Section 3 request. We commenced a separate investigation of this complaint. We wrote to the company on the matter. However, it again failed to respond to our investigation despite three letters having been issued. Consequently, we served an Enforcement Notice under Section 10 of the Acts requiring compliance with the Section 3 request within twenty one days.  However, the company failed to comply with the requirements of the Enforcement Notice.

As this company had committed offences by failing to comply with the requirements of two separate legal notices served on it, we decided to prosecute.  We served a summons on Company X to appear before the Dublin Metropolitan District Court on two charges.  At the initial court hearing in March 2010, counsel for the company applied for an adjournment.  He gave an undertaking to the court that Company X would comply with the requirements of the Enforcement Notice and that it would provide the information sought in the Information Notice before the next court date.  The court granted the adjournment and it fixed a hearing date for May 2010.  On the same day as the initial court hearing, a liquidator was appointed to Company X.  At the end of April 2010, we received a letter from the company in response to the information sought in the Information Notice.  Around the same time, the company wrote to the customer who had made the Section 3 request and it provided her with the information she had sought.

A full hearing took place in the Dublin Metropolitan District Court in May 2010.  At the end of the hearing, the judge indicated that he believed that Company X had committed a technical breach of the Acts and he found that the facts of the case against it were proven.  In his summing up remarks, the judge said that the company's managing director had buried her head in the sand in relation to the whole issue and he acknowledged that the Data Protection Commissioner 'had broken his back' in his efforts to obtain information from the company for the purposes of his investigations.  In light of the fact that the company was now in liquidation, the judge indicated that he had to be realistic and impose a practical, common sense sentence.  For that reason, he indicated that he would adjourn sentencing until the following day.  He asked the managing director and the CEO of Company X to produce two personal cheques on the following day; one cheque was to cover our legal costs and a further cheque to the value of €1,000 was to be made payable to a charity of the court's choice.  The cheques were handed to the court on the following day and the judge then applied the Probation Act in relation to the offences committed.

This case serves to demonstrate the lack of cooperation which we sometimes experience when investigating complaints.  In truth, the investigation of these complaints should have been straightforward.  A serious breach of the data protection rights of over three hundred people took place.  The company should have responded with an immediate apology to the affected customers, an examination of the causes of the incident, an evaluation of the extent of the incident, remedial action to prevent such an incident from happening again and, finally, a full incident report to our Office.  In this case, all of this could have been completed within 48 hours of the incident.  Instead, the investigation was frustrated by the company to such an extent that we had to serve legal notices (which is something we do very sparingly) and, when the company failed to comply, we had to bring prosecutions.  As a result, a matter which should have been dealt with over a couple of days following the incident took over a year to bring to a conclusion.  The blame for that long process and the consequent consumption of our Office's resources lies solely with Company X.  Had it engaged meaningfully with us on a cooperative basis at the outset, the issuing of two legal notices, one summons and the subsequent court proceedings could all have been avoided.