Irish Data Protection Commission Case Studies

Disclosure of fees owed to a company [30/05/2011]

 

During 2010 we received several complaints in relation to the disclosure by property management companies (set up to manage housing estates) of details relating to individuals in arrears with payment of their management fees.  In general these disclosures occurred through the circulation of a list of those in arrears to all members of the property management company.  The list typically contained personal details such as house/apartment number, name and amount of arrears due.  The general view of the property management companies was that an individual, on purchasing a property, becomes a member of the property management company and all members of that company are entitled to receive account details relating to all other members of the management company.  Of course, such lists are often circulated to embarrass the people involved into paying outstanding fees.  In some complaints to our Office, the named individuals had in fact paid the fees in question.

 

In June 2010 we received two complaints against a property management company.  The complaints alleged that the company disclosed the management fees owed by members.  The complainants supplied us with a copy of a letter that issued from the company to its members.  It enclosed a debtors list of members detailing the house number, the individual's first initial, surname and the amount of arrears in each case.

 

We wrote to the property management company asking that it outline the legal basis for sending this correspondence.  The management company asserted that its Memos and Articles of Association provided for its members to have access to the company accounts and, therefore, to have access to creditor and debtor lists.  On examining the text in the Articles of Association under the heading 'Accounts', we informed the company that it did not provide for the disclosure of management fees owed by individual members of the company.  The text only provided the directors of the company with the right to decide on the availability of the accounts for inspection by members.  We informed the company that the right to inspect the accounts was an entirely different matter to the circulation of details of management fee arrears to the company’s members.

 

The company did not provide evidence that property owners consented to the circulation of personal information relating to the status of their management fees.  In the absence of evidence of consent, we informed the company that it had breached the Data Protection Acts.  The company provided us with letters of apology for each of the complainants to amicably resolve the complaints.  In these letters the company acknowledged that it had breached the Data Protection Acts when it sent letters informing members that the complainants were in arrears with their subscriptions and gave an assurance that it would not happen again.

 

We expect property management companies to observe the law when processing the personal information of their members.  In particular, they should note the following:

 

·         Personal information in relation to individual property owners, as members of the management company, should not be circulated to other members of the management company unless the consent of the individuals concerned has been obtained.

 

·         The entitlement of members of a management company to receive information in relation to the overall financial status of the company by means of annual audited financial reports (which is lawful) is an entirely different matter to the circulation by the company of details of management fees owed by individual members who have not consented to the circulation of their personal data (which is unlawful).

 

A Board of Directors or other executive body with legal responsibility for the management company has a legitimate basis for taking appropriate action on foot of an examination of a list of members whose management fees are in arrears.  However, the broader disclosure of such a list to members who have no such legal responsibility breaches the "need to know" principle of the Data Protection Acts.