Irish Data Protection Commission Case Studies

 

In November 2011 we received a complaint from an individual concerning the alleged disclosure of his daughter’s personal data by a secondary school at which she was a student, St. Joseph's College, Borrisoleigh, Co. Tipperary, to a third party. It was alleged that this disclosure took place by way of a letter issued by the secondary school to a third party without the knowledge or consent of either the complainant or his daughter.

 

By way of background, the complainant informed us that, following a complaint which he and his wife had made to the Board of Management of a local national school, he received correspondence from the Chairperson of that school’s Board of Management in relation to that complaint. Included with that correspondence was a copy of a letter issued by St. Joseph's College which contained references to the complainant’s daughter who was a student of that College. We were further informed that this letter, which was allegedly requested by a separate third party (a parent of a different student at St. Joseph’s College) and addressed "To Whom It May Concern," was subsequently passed by that third party to the Chairperson of the Board of Management of the local national school.

 

My Office commenced the investigation of the complaint by writing to St. Joseph's College. We asked it for an explanation as to what led to the alleged disclosure and what steps were being taken to address the matter. We received a response from St. Joseph's College informing us that it would not be getting involved in our investigation at that juncture. We responded in early December 2011 stating that, as St. Joseph's College was the data controller in this instance, we required a response to our letter. In the absence of any further communication we issued a final warning letter to St. Joseph's College on 12 January, 2012 requiring it to respond to our investigation within fourteen days.On the following day we received a phone call from the school manager of St. Joseph’s College. He informed us that he did not have any knowledge of the issues between the complainant and his school.

 

On the same phone call we then spoke to the administrator of St. Joseph’s College, the signatory of the letter in question. He informed us that when the third party requested the letter he (the administrator) did not know why he wanted it. He said that he was unaware that he breached the Data Protection Acts when he made references to the complainant’s daughter in the letter. Later that day, we received an email from St. Joseph's College outlining the circumstances which led to the issuing of the letter to a parent of a student at the College and which referenced the complainant’s daughter, a different student at the same College. In the email, the administrator indicated that the parent concerned did not state that the letter would be given to the Board of Management of a primary school. The College informed us that it had redrafted its data protection policy to ensure that the Data Protection Acts are fully complied with.

 

Having informed the complainant of the College’s response to our investigation, we asked him if he was interested in seeking an amicable resolution of his complaint. In response, he indicated that he could not accept that there could be any informal resolution to his complaint and he sought a decision of the Commissioner.

 

In making the decision on this complaint, the Commissioner examined and considered all aspects of the case. He formed the opinion that St. Joseph's College contravened Section 2(1)(c)(ii) of the Data Protection Acts by disclosing the personal data of the student concerned to a third party without her knowledge or consent or the knowledge or consent of her parents. This contravention occurred when St. Joseph’s College issued a letter in September 2011 containing personal data of one of its students under the heading “To Whom It May Concern” and gave it to a third party, namely a parent of a different student.