Case Studies Transparency
Sharing personal data with third parties without consent
An individual was owed a debt from the Estate of a deceased person. The individual wrote to the law firm representing the Estate of the deceased to relay that they were no longer interested in pursuing the debt owed to them by the Estate. The law firm subsequently shared this letter with third parties – the executors and other beneficiaries to the Estate. The individual became aware that a copy of their letter was shared and contacted the law firm asking why their letter was shared without their consent. The law firm replied that as the individual had voluntarily written to it to decline any claim on the Estate, it had assumed it had the individual’s consent to share with third parties for the purposes of disclosing the individual’s now defunct claim on the estate. It also advised that the individual had given their consent for their personal data to be shared with third parties, including their name and address as well as the letter itself. The individual was unhappy with this response and therefore contacted the DPC to make a complaint.
See More InformationProcessing of health data
The complainant was a member of an income protection insurance scheme and had taken a leave of absence from work due to illness. The income protection scheme was organised by the complainant’s employer. In order to claim under the scheme, the complainant was required to attend medical appointments organised by an insurance company. Information relating to the complainant’s illness was shared by the complainant with the insurance company only. However, a third-party company (whose involvement in the claim was not known to the complainant) forwarded information to the complainant’s employer regarding medical appointments that the complainant was required to attend. The information included the area of specialism of the doctors in question.
See More InformationProvision of CCTV footage by a bar to an employer
We received a complaint against a city-centre bar, alleging that it had disclosed the complainant’s personal data, contained in CCTV footage, to his employer without his knowledge or consent and that it did not have proper CCTV signage notifying the public that CCTV recording was taking place.
See More InformationReliance on consent in the use of child’s photograph in the form of promotional material by a State Agency
We received a complaint from a parent in respect of their child. The parent had attended a festival organised by a state agency with their child, where a professional photographer took the child’s photograph. The following year the state agency used this photograph in promotional material. The child’s parent, while accepting that they had conversed with the photographer, had understood at the time of the photograph that they would be contacted prior to any use of the image.
See More InformationUse of employee’s swipe-card data for disciplinary purposes
The complainant in this case was an employee who was the subject of disciplinary proceedings by their employer. An aspect of those proceedings concerned the complainant’s time keeping, and the employer sought to rely on swipe-card data derived from the complainant’s entry into and exit from the workplace during the relevant period. As a result of an internal appeal process, the employer subsequently agreed not to use the data for this purpose and removed it from the complainant’s disciplinary record. However, the complainant asked the DPC to continue its investigation of the complaint.
See More Information