British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
Irish Data Protection Commission Case Studies
You are here:
BAILII >>
Databases >>
Irish Data Protection Commission Case Studies >>
CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 7 (2013)
URL: http://www.bailii.org/ie/cases/IEDPC/2013/2013IEDPC7.html
Cite as:
[2013] IEDPC 7
[
New search]
[
Contents list]
[
Help]
This Office received a complaint from a solicitor acting on behalf of a data subject alleging a data breach which occurred at the Carphone Warehouse following the theft of the data subject’s mobile phone. It stated that the data subject's mobile phone had been stolen while she was out shopping and that the incident had been immediately notified to An Garda Síochána, who traced the mobile phone to a park in the town where it had been stolen. However, the mobile phone had not been recovered at that time. The complaint stated that, on the following day, two individuals arrived at the data subject's isolated family home with the stolen mobile phone and they sought a reward for finding it. The complaint stated that the data subject handed over €50 and the stolen mobile phone was returned to her albeit damaged in what seemed to be an effort to extract the SIM card.
The complaint further stated that, shortly after this incident, the data subject contacted her local branch of Carphone Warehouse and was informed that two people had called there claiming that they had found the stolen mobile phone and that they were looking for contact details of the owner in order to return it. The complaint alleged that the Carphone Warehouse employee gave these two people the owner’s name and address. The complaint stated that the data subject was in contact with both local and regional management of the Carphone Warehouse but she considered that they failed to grasp the seriousness of the situation. She was offered a new mobile phone plus a written apology from Carphone Warehouse but she declined to accept this offer.
We commenced our investigation into this matter by contacting Carphone Warehouse and outlining the details of the complaint. We asked it to explain how the complainant’s personal data was allegedly disclosed in the manner outlined in the complaint.
We received a reply from Carphone Warehouse which stated that, on the evening concerned, two people presented to one of its stores with a handset which they claimed their daughter had found and which they were seeking to return to the rightful owner. The staff member in the store at the time was a trainee who initially recommended that they present the handset to the local Garda Station. However, the people said that they wanted to be sure that the person received their handset. Carphone Warehouse stated that the staff member then disclosed the owner's address so that the handset could be returned, mistakenly thinking that he was assisting the customer. It acknowledged that this was an obvious and serious breach of its policies and procedures. It stated that it conducted a full investigation, including a formal interview with the staff member and identified that this was very poor judgement but in no way malicious as the staff member had nothing to gain personally from this action. It acknowledged that this in no way took from the severity of the breach but was factored into its internal actions for the staff member in question. Carphone Warehouse stated that it would again like to express its sincerest apologies to the data subject and it also offered to replace the customer's handset and provide an additional payment of €100.
Following on from this correspondence, we wrote to the solicitor for the data subject stating that it was the view of this Office that Carphone Warehouse had contravened the Data Protection Acts in terms of how the data subject's details were disclosed by its employee. We also stated that, as provided for under the Acts, it was our aim to amicably resolve complaints and to this end we stated that Carphone Warehouse had offered its sincere apologies, offered to replace the complainant's mobile phone with a new one at a cost of €500 and offered a gesture of €100.
In response, we were informed that the data subject was not willing to accept the offer of an amicable resolution to her complaint made by Carphone Warehouse and a formal decision was required.
A decision issued on this complaint which stated that the Commissioner was of the opinion that, following the investigation of the complaint, that Carphone Warehouse contravened Section 2(1)(c)(ii) of the Data Protection Acts 1988 & 2003 by disclosing the data's subject personal data to a third party without her knowledge or consent. This contravention occurred when the personal data of the complainant was disclosed by Carphone Warehouse to a third party or parties without her knowledge or consent.
A key principle of data protection is that personal data should be kept safe and secure and not be disclosed to unauthorised third parties. The actions of the Carphone Waterhouse employee in this case in disclosing the data subject's address to strangers resulted in considerable distress for the data subject. Despite initially telling the individuals who were in possession of the mobile phone to present it to An Garda Síochána, which was the correct procedure for such cases, he then proceeded to disclose the data subject's personal information to third parties. Regardless of the fact that the employee concerned was a trainee, this disclosure should not have happened. Data controllers should be vigilant at all times to ensure that appropriate procedures are in place to prevent disclosure of personal data to third parties and that all employees abide by them.