The payment of import duty that is payable under Irish tax law, following the delivery of goods, is not one that gives rise to any protection issues. It is a legitimate debt that falls due to be paid. Where it is not paid, parcel delivery services may endeavour to use debt collection agencies to collect the monies due.

Under Article 6 of the General Data Protection Regulation (GDPR), a data controller must have a legal basis for processing a data subject’s personal data (including using this personal data to recover an unpaid debt). The GDPR provides that a data controller may engage the services of a sub-contractor/agent to process personal data on its behalf for various purposes.

Occasionally, data controllers will engage a third-party agent to recover a debt on their behalf, which is permissible under the GDPR. Such an agent is called a ‘processor’ for the purposes of data protection law. In order to engage a third party to assist with the debt recovery, it will be necessary for the data controller to pass certain personal data to the debt recovery agent.

The engagement of that agent does not require the consent of the data subject. However, the data controller must be able to identify its legal basis under Article 6 of the GDPR for the sharing of the debtor’s personal data and must be able to demonstrate that the disclosure of this personal data was in line with the original purpose for which the data was processed.