Resources

Case Studies Disclosure / Unauthorised Disclosure

 

Disclosure / Unauthorised Disclosure 2021

Financial information erroneously cc’d to a restaurant (Applicable law — Data Protection Acts 1988 and 2003 (the Acts))

We received a complaint concerning the alleged disclosure by a motor dealership of the complainants’ personal data to a third party. The complainants had provided the dealership with copies of their driver’s licences and bank details, including bank statements and full account details, in order to purchase a car through a Personal Contract Plan. They were subsequently copied in on an email from the dealership to a third-party email address, believed to be an address associated with a bank, which contained the complainants’ driver’s licences and bank details. The complainants were concerned that the third-party address was that of a restaurant and contacted the dealership about this, but were assured that the email address in question pertained to a bank and was secure.

The complainants remained concerned over the ownership of the email address, conducted online research into the matter, and were confident the email address was that of a restaurant. In order to confirm their suspicions, a friend of the complainants sent an email to the address in question and the response received confirmed it was that of a restaurant.

In the course of our examination, the dealership accepted that the email had been sent in error to the wrong address. Notwithstanding this acknowledgment, it was clear that no attempt had been subsequently made to contact the restaurant in order to request that the information erroneously sent be deleted by the unintended recipient. Upon instruction from this office, we received confirmation that the dealership had contacted the restaurant and requested that the email, including the documents, be deleted. The dealership put forward a proposal for amicable resolution that was accepted by the complainants.

Key Takeaway

  • This case demonstrates that it is vital for data controllers (and their employees) to implement and ensure a practice of precautionary measures when electronically transmit- ting personal data, particularly financial information. A large proportion of the data-breach notifications that the Data Protection Commission (DPC) receives are of the unauthorised-disclosure variety, with a common cause being emails sent in error to the wrong address. Where a data controller identifies that such an incident occurs, it is not enough to acknowledge it, whether to the data subject or to the DPC. Instead, it is incumbent on the data controller to take all reasonable steps to remedy such a breach. This includes recalling the email from the sender, asking the unintended recipient to confirm they have deleted the email, and thereafter putting in place measures to prevent a recurrence. Human error by staff presents a high risk of data breaches on an ongoing basis and it is critically important that efforts are made to mitigate those risks by driving data protection awareness throughout the organisation, particularly in regard to new staff.