Irish Data Protection Commission Case Studies

In June 2012 we received a complaint from a data subject who stated that, while in the employment of a beauty salon, she made a telephone enquiry to a beauty products supply company as she was considering starting her own business and carrying that company's products. The supply company also supplied products to the beauty salon where the complainant worked. The complainant informed us that, following this phone call, she returned to work some days later and was told by her employer that she was being laid off as her employer had received a telephone call from the beauty product's supply company which revealed that she was considering setting up her own business.

 

We commenced our investigation by writing to the beauty products supply company asking it to outline the basis for allegedly disclosing the contents of the telephone conversation concerned. In reply the company said that it felt obliged to notify the owner of the beauty salon of the phone call. It said that it was concerned that this information would be in the beauty salon's interest as it thought that the setting up of a new business would be business competition for the beauty salon, the complainant’s employer.

 

Our approach to complaints, as provided under the Acts, is to try to reach an amicable resolution to the matter which is the subject of the complaint. In this regard the beauty products supply company offered the complainant €1,000 in an effort to amicably resolve her complaint. However, the complainant refused this offer and she sought a formal decision on her complaint. 

 

The issue that arose for consideration in the decision was whether the Data Protection Acts were breached when the beauty product's supply company disclosed the contents of a telephone conversation about the complainant to her then employer, the beauty salon. 

 

One of the conditions under which the processing of personal data may be carried out is where the processing is necessary for the legitimate interests of the data controller (in this case the beauty products supply company) except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject. 

 

In his decision, the Commissioner considered that, when the beauty products supply company contacted the complainant’s then employer and informed it that the complainant had been in contact with it in relation to setting up her own beauty salon and carrying their products, it was reasonable for the beauty products supply company to consider that the disclosure of that information was in its legitimate interests of maintaining an ongoing commercial relationship with the beauty salon. As the complainant had indicated to the beauty products supply company that the reason for the enquiry about its products was that she was considering setting up her own business in a different location, which would have involved her leaving the beauty salon, the Commissioner did not consider that the disclosure was unwarranted by reason of prejudice to her fundamental rights and freedoms or legitimate interests. In the circumstances, the Commissioner was unable to form the opinion that the Data Protection Acts were breached in this case.