British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 1 (2013)
URL: http://www.bailii.org/ie/cases/IEDPC/2013/2013IEDPC1.html
Cite as:
[2013] IEDPC 1
[
New search]
[
Contents list]
[
Help]
The Office received a complaint from an individual concerning a visit by an Electric Ireland sales representative to his home. The complainant explained that a sales representative called to his door, displayed his identity card and stated that he was calling with a new offer on behalf of ESB Electric Ireland to addresses of former ESB customers. The sales representative then informed the complainant that he was aware that he was a previous customer of ESB. He proceeded to produce a document which listed the complainant’s house name, his address, the date on which he switched his account from ESB and the MPRN (Meter Point Reference Number) at the house. The sales representative went on to say that, as the complainant had switched from ESB in 2009, he was now on his current electricity supplier’s highest rate and, therefore, he could switch back to avail of new rates with Electric Ireland which would be considerably cheaper than his current rates.
On foot of this complaint, we commenced an investigation by writing to Electric Ireland. We questioned why the sales representative was in possession of information relating to a former customer, in particular the MPRN and the date of leaving ESB, and why Electric Ireland was retaining this data.
In response, Electric Ireland confirmed that the sales representative was in possession of three specific pieces of information: MPRN, MPRN address/location and the date of the last registration of the MPRN against an Electric Ireland account. It said that the sales representative did not have the complainant’s name or any other personal information. In relation to MPRN, Electric Ireland stated that this information is available to all licensed electricity suppliers in the Irish electricity market. It said that it was using this information for the exact purpose of identifying a service delivery point where a customer may have a network connection agreement and where metering may be installed. In relation to data retention, Electric Ireland referred to various legislative requirements in the VAT code and in a statutory instrument (SI 385 of 2008).
In response we informed Electric Ireland that the retention of personal data in those particular contexts were for purposes set down by the Revenue Commissioners and that it did not give data controllers any entitlement to use the retained data for its own other purposes, such as for marketing. We pointed out that there was no legitimate basis under the Data Protection Acts for Electric Ireland's marketing department to access ex-customer personal data for the purposes of win-back campaigns unless the ex-customer consented to marketing contact prior to the termination of their contract. We made it clear that to supply sales representatives with details of the date of the last registration of the MPRN against an Electric Ireland account amounts to unlawful further processing of personal data. We told Electric Ireland that there was no legal basis for it to access MPRN data for the purposes of marketing to non-customers. For that reason, we advised Electric Ireland that MPRN data should not be accessed for marketing purposes or supplied to "Feet-On-The-Street" agents. We asked it to commit to cease using MPRN data for marketing purposes.
In response, Electric Ireland committed to the removal of MPRN data from all “Feet On The Street” marketing lists with immediate effect. It also indicated that it was retracting all marketing lists containing MPRN data forthwith and it undertook to provide immediate re-training to staff. For completeness, within a short period we sent an inspection team to Electric Ireland to examine the implementation of our recommendations. This allowed us to examine the company's marketing campaign procedures at first hand. The inspection team comprised staff of this Office and of the Commission for Energy Regulation. The inspectors were satisfied that Electric Ireland had ceased using MPRN data in marketing campaigns. In addition, the inspectors noted that, if a customer decides to move from Electric Ireland to another service provider, the departing customer’s details are subsequently deleted from the company's marketing database.
This case is of particular importance to all service providers in the electricity and other utility sectors. Win-back campaigns targeted at former customers are common place and the data controllers concerned are often tempted to delve into personal data retained for particular statutory requirements in order to create or enhance their marketing lists. We urge such data controllers to tread carefully in this space as, without the prior marketing consent of the former customers concerned, there is no legal basis to process marketing lists using such retained personal data.