British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 2 (2013)
URL: http://www.bailii.org/ie/cases/IEDPC/2013/2013IEDPC2.html
Cite as:
[2013] IEDPC 2
[
New search]
[
Contents list]
[
Help]
The Office received a complaint against Westmeath County Council regarding the outsourcing of customer details relating to the Council’s domestic refuse collection service. The complaint alleged that customer details were unlawfully outsourced by Westmeath County Council to a third party for the purpose of notifying householders of the sale of the Council’s waste collection service.
In response to our investigation of the complaint, Westmeath County Council stated that it had tendered for the provision of a refuse collection service in 2009, having decided to outsource this service which was part of the Council's general service provision. The successful bidder was provided with a list of names and addresses of the property owners availing of the service at that time. We asked Westmeath County Council to inform us of the name of the entity to whom the printing and issuing of the letters which notified householders of the sale of the waste collection service had been outsourced. We also requested details of any contract in place between Westmeath County Council and the entity concerned. Westmeath County Council confirmed that a local printing company in Mullingar had successfully tendered for the printing and postage of the letters and that it had been supplied with a copy of the Council's waste collection service database containing approximately 15,000 names. It also informed us that there was no formal contract in place between the Council and the printing company governing the use of the database by the printing company.
The printing company subsequently confirmed to Westmeath County Council that it had received the database and had used it only for the purpose of notifying persons/households of the revised refuse collection arrangements. In addition, the printing company confirmed that this database was never otherwise used or passed to a third party but was destroyed on completion of the printing job.
The complainant in this case sought a formal decision on his complaint.
The Commissioner formed the opinion that Westmeath County Council contravened Section 2C(3) of the Data Protection Acts by failing to have a contract in place with the printing company concerned for the processing of personal information. This contravention occurred when Westmeath County Council outsourced to a third party the printing and distribution of letters and provided it with a copy of its customer database containing the complainant’s personal data for this purpose, without having a contract in place for the processing of the personal data.
The outsourcing of data processing to third parties for the purposes of data processing is frequently a matter of concern to data subjects who contact this Office. The data protection framework makes specific provision for the engagement by data controllers of data processors to carry out data processing functions on their behalf. This provision requires the data controller to put in place a contract in writing or in equivalent form between it and the data processor concerned. This contract legitimises the passing of personal data from the data controller to the data processor for data processing purposes. Obviously, we would expect contracts to contain some clause or clauses which bind the data processor to compliance with the Data Protection Acts in terms of the handling, storage, security and processing of the personal data concerned. The passing of personal data by a data controller to a third party in the absence of such a contract is unlawful as it effectively amounts to a disclosure of personal data to a third party without a legal basis. As can be seen in the above case, it was solely the absence of a contract which led to the breach of the Data Protection Acts which took place.