CASE STUDY 3/96

Compatibility of use of personal data – disclosure – state-sponsored body acting as agent for Government Department

Three people complained that a Government Department disclosed personal data (their names and addresses) to a state-sponsored company to promote a service, which was the responsibility of that Department.

I decided that none of the provisions of the Data Protection Act were contravened because:

the use of data to promote the service was compatible with the purposes for which the Department kept the data as set out in legislation, and

contrary to the complainant’s view, disclosure within the meaning of the Act had not occurred. The company had been appointed by Statutory Instrument as an agent of the Department to run the service on its behalf. Disclosure as defined in section 1 of the Data Protection Act, 1988,

does not include a disclosure made directly or indirectly by a data controller or a data processor to an employee or agent of his for the purpose of enabling the employee or agent to carry out his duties.

The complaint arose because the state-sponsored company had written – on its own headed paper – to the complainants. I was of the opinion that if the company had made it clear in that letter that it was working not on its own behalf but rather as the agent of the Department, these difficulties would not have arisen. I reminded the Department that, under the Data Protection Act, it remained responsible, as data controller, for the actions of its agent in respect of personal data processed on its behalf by the company in question.

» Permanent Link