British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
Case Study 10: Customer Data Transfer for Waste Collection Service in Dublin [2012] IEDPC 10 (2012)
URL: http://www.bailii.org/ie/cases/IEDPC/2012/[2012]IEDPC10.html
Cite as:
[2012] IEDPC 10
[
New search]
[
Help]
In January 2012 the Office received several complaints and enquiries from citizens of the Dublin City Council area after they received a letter notifying them that Dublin City Council and Greyhound Recycling and Recovery had reached agreement on the sale of the Council's commercial and domestic waste collection business to Greyhound Recycling and Recovery. The letter indicated that Greyhound Recycling and Recovery would take over control of bin collections for the Council's 140,000 customers on 16 January, 2012 and that from that date the Council would officially transfer its waste collection business to Greyhound Recycling and Recovery.
It went on to outline the annual service charge and lift fees which would apply to the service. It also gave details of the methods of payment and it included a customer payment card with a customer account number for the new Greyhound account. The letter also stated that the final City Council bill for the period ending on 13 January, 2012 would be issued and the revenue collected on behalf of the City Council by Greyhound Recycling and Recovery which would also collect any outstanding arrears on behalf of the City Council. Complainants to this Office expressed concerns in particular about the transfer of their personal data by Dublin City Council to a private company without their knowledge or consent.
We conducted a comprehensive investigation which focussed on both the transfer of customer data from Dublin City Council to Greyhound and the collection of Dublin City Council customer debts by Greyhound.
The transfer of customer data from Dublin City Council to Greyhound.
Our investigation concluded that the core elements of the sale of the business did not breach the Data Protection Acts. We established that the customer data transfer from Dublin City Council took place between 22 and 23 December, 2011. We noted that a notification letter regarding the new service provider was sent to customers of Dublin City Council in the first half of January 2012. The notification letter to customers should have taken place at a much earlier stage.
By notifying customers of their new service provider simultaneous to the completion of the sale but after the data transfer had occurred, it was not possible for the Office to come to the view that the “fair processing” requirements of the Data Protection Acts, 1988 & 2003 were fully met by Dublin City Council in this instance.
Dublin City Council agreed, in light of this experience, that in the event that any similar situation arises in the future, it will seek to comply with all relevant published Office of the Data Protection Commissioner guidance in relation to such matters in being at that time unless it obtains confirmation from this Office that compliance does not arise in a particular circumstance.
The collection of Dublin City Council customer debts by Greyhound.
Our investigation found that no transfer of personal data from Dublin City Council to Greyhound in respect of the collection of Dublin City Council customer debts had taken place. This was confirmed by the Office by way of an unannounced inspection at the premises of Greyhound and its agents on 26 January 2012. This inspection confirmed that only name, address and whether a household was entitled to a waiver were transferred to Greyhound.
We agreed with Dublin City Council and Greyhound that the customers of Dublin City Council and the customers of Greyhound must be assured that robust controls are in place at Greyhound to guard against any possibility of the cross pollination of debt collection information handled on behalf of Dublin City Council with personal data handled by Greyhound in the normal course of its waste collection activities. Accordingly, the following undertakings were agreed before any debt collection data was transferred from DCC:
Staff at Greyhound or its agents who handle personal data in the context of debt collection for Dublin City Council will not have access to any personal data held in the context of Greyhound’s waste collection business, and vice versa.
The debt collection database held on behalf of Dublin City Council by Greyhound and/or its agent to be separate and distinct from all other aspects of Greyhound’s waste collection business. All access and use of the personal data held on behalf of Dublin City Council to be auditable and verifiable via specific usernames and passwords.
An audit procedure to be put in place by Dublin City Council to ensure that Greyhound, as a data processor on behalf of Dublin City Council, is fully compliant with all aspects of its data protection responsibilities as a data processor. An initial audit will take place within six months of the commencement of the debt collection function.
The terms of the audit to be agreed with this Office. This audit will be conducted by a competent third party auditor to be agreed with this Office. Further audits will be scheduled on an annual basis (for so long as Greyhound are acting as a data processor on behalf of Dublin City Council in relation to customer debt collection in respect of outstanding waste collection charges). This Office will be supplied with a copy of each audit report.
This case serves to highlight the steps which must be followed and the considerations which must be given to the procedures which need to be put in place when customer data transfers are envisaged in the context of the sale or transfer of a business. A guidance note on "Transfer of ownership of a Business" is published on our website and we recommend that data controllers pay close attention to it in such circumstances.