Case Study 7

Eircom – Procedures for ensuring Barring Orders are respected

I received a complaint about Eircom not respecting a Barring Order that had been granted against her husband. Though she had changed the telephone account details from his name to her name, he had still been able to contact Eircom and had the access codes for voicemail reset so that he could access her voicemail. Furthermore, on closing the account the final account had been sent to him at his address rather than hers.

Eircom investigated this complaint thoroughly from a data protection perspective. They were not able to establish definitively how the matters complained of arose but accepted that either the estranged husband had the account number himself or perhaps had "spun a plausible story" to Eircom. They acknowledged that if it was the latter then their Data Protection procedures were not adequate in this instance.

Eircom said that cases involving separation can often pose problems as the person leaving the address may be the named telephone account holder. However, they stressed that the procedures are in place for protecting confidential information and that staff are aware of the company’s Data Protection obligations.

Following my staff’s meeting with Eircom on this matter, the company commenced a review of security procedures in their customer – facing call centres. I am advised that this review identified a weakness with regard to transfer of service on foot of a barring order. I am pleased to note that they have adopted a new Procedures Document for dealing with transfer of telephone service particularly in cases of Barring Orders which I am satisfied addresses fully the issues which arose in this complaint. I am grateful for Eircom’s considerate response to this complaint, which was a distressing experience for the complainant, and the manner in which they have revised their procedures which should avoid similar occurrence in the future.

On a general level I reiterate that service-providers operating call-centres need to make sure that they have procedures in place for ensuring that personal data of third parties is not discussed with or disclosed to callers inadvertently.

Though she had changed the telephone account details from his name to her name, he had still been able to contact Eircom and have the access codes for voicemail reset so that he could access her voicemail - Service-providers operating call-centres need to make sure that they have procedures in place for ensuring that personal data of third parties is not discussed with or disclosed to callers inadvertently.