Irish Data Protection Commission Case Studies

You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 16 (2013)
URL: http://www.bailii.org/ie/cases/IEDPC/2013/2013IEDPC16.html
Cite as: [2013] IEDPC 16

[New search] [Contents list] [Help]

Case Study 16: Loss of photocopies of passports

In November 2013, a voluntary organisation that is involved with young people notified us of a data security breach relating to the loss by one of its local groups of photocopies of passports. The organisation informed us that one of its local groups had reported that a file containing photocopies of individual passports for 44 young people and leaders, and 38 Parental Consent forms, was lost or mislaid on the return journey from a trip abroad the previous August. We were informed that the Volunteer in charge only became aware of the loss of the documentation in November.

The three pronged approach from this Office when dealing with personal data security breaches is that we expect that the Data Controller,

1. Informs the affected individuals (including what information was disclosed)

2. Secures the data in question and,

3. Informs this Office of steps taken to reduce the risk of a similar incident reoccurring.

As the whereabouts of the documentation was unknown this prevented the data controller from securing the data.

The organisation confirmed that it was arranging immediately to contact the parents to advise them of the loss. As per the provision of the Code of Practice, this allows the individuals to consider the consequences for each of them individually and to take appropriate measures.

This Office queried the reason why the organisation considered it necessary to hold photocopies of the passports. We informed the organisation that we did not consider the photocopying of the passports to be best practice. The organisation confirmed that it too was questioning why passports were being photocopied and was investigating the extent of this practice within the organisation. It put forward the suggestion that perhaps the purpose of photocopying the passports was done as a precaution in case the original passports were lost while abroad. We also informed the organisation that, even if it was in a position to provide a legitimate basis for the photocopying of the passports, the documents should have been destroyed once the trip abroad was over. This procedure would have alerted the Volunteer sooner to the loss of the documents.

The Personal Data Security Breach Code of Practice also provides that, in appropriate cases, data controllers should also notify organisations that may be in a position to assist in protecting data subjects. In this regard, this Office, for the benefit of our own understanding of the matter, contacted the Passport Office, Department of Foreign Affairs. The purpose of our communication with the Passport Office was to seek advice on the potential implications of the loss of a photocopy of a passport and whether this was an issue that should be reported to the Passport Office.

The Passport Office advised that there was a possibility that a photocopy of passport details, if it fell into the wrong hands, could be used to create a duplicate as a fraudulent document. The Passport Office advised that the affected passports could be put on the Department of Foreign Affairs "check list". This Office understands that this involves the placing of a computer block that means when an individual reapplies for a passport, a double check is carried out on the application.

Our investigation of the data security breach concluded on receipt of confirmation from the organisation that it had written to all the parents advising them of what had been lost. The organisation also informed us that a parents meeting had been held. The organisation also confirmed that it had taken advice from the Department of Foreign Affairs and was preparing guidelines for its groups on the issue of the handling of passports.

This case demonstrates the basic principles of data protection in relation to data security and the requirements under the Data Protection Acts 1988 & 2003 (the Acts), for a data controller to have a clear purpose in relation to the obtaining and retention of personal data. In this instance it was not clear why the local group had photocopied the passports. The Acts provide that the data should be obtained only for one or more specified, explicit and legitimate purposes. The Acts also provide that the data shall not be kept for longer than is necessary for the purpose for which it was initially obtained.