Irish Data Protection Commission Case Studies

Disclosure of personal data from housing association to debt collection agent [30/05/2011]

 

In June 2010, we received two separate complaints alleging that a housing association had inappropriately disclosed personal information.  The complainants alleged that an individual, who was not an employee of the housing association, had personal information relating to them when he called in person to their homes.  The information included contact details and an outline summary of their rent payments to the housing association.  The complainants were concerned that their personal information had been disclosed to an individual who was unknown to them and who appeared to have no affiliation to the housing association.

 

From time to time organisations need to engage the services of an agent to process personal data on their behalf.  Such an agent is termed a ‘data processor’ under the Data Protection Acts.  When a data controller engages the services of a data processor, it must take certain steps to ensure that adequate standards of data protection are maintained by the data processor.  A data controller is permitted to engage a data processor only on the basis of a written contract (or equivalent) which includes appropriate security and other data protection safeguards.  Informal or ad-hoc arrangements do not meet the requirements of the law with regard to the processing of personal data by third parties.

 

On receipt of notification from our Office that we had commenced an investigation into this matter, the solicitors for the housing association responded that the association had engaged a third party to call to various tenants to request that they deal with the issue of rent review and bring any arrears of rent up to date.  They stated that no information was furnished by their client to this third party.  They also questioned the motivation of the complainants on the basis that they owed rent arrears and had done so for some time.  They conceded that no written contract existed between the housing association and the third party.  We responded seeking clarification of how the third party was in a position to visit certain houses on the estate concerning rent arrears without having been supplied in advance with the details of the people who were in arrears.  The solicitor for the data controller responded claiming that we had prejudged the matter and our comments amounted to an assertion made in advance of any determination in relation to the complaints.  They requested that the investigator handling the case stand aside from the investigation and they threatened to issue proceedings against the Office if the investigation proceeded.  

 

I cannot tolerate such behaviour as it amounts to an attempt to restrain the performance of my functions.  We informed the solicitors that we would continue to perform our statutory functions in investigating the complaints and, in the absence of a response to questions posed as part of our investigation, we would use our legal powers to obtain the information required.

 

Following a further exchange of correspondence with the solicitors for the housing association, the complaints were concluded.  The data controller wrote to the complainants acknowledging the breach that occurred when they passed certain information to a third party.  The housing association apologised for this and it assured the complainants that there would be no repeat of the incident.

 

The motivation behind the complaints was a recurring theme in the correspondence from the solicitors for the data controller, on the basis that both complainants were in substantial rent arrears.  We only seek to establish if there is a legitimate data protection complaint; we cannot and do not question the motivation of complainants.  We respect the right of data controllers to collect debts.  However, the processing of personal data in the collection of debts must be carried out in compliance with the Data Protection Acts.  The data protection rights of individuals cannot be disregarded simply because they are in debt.