Data Protection Commissioner concludes Investigation on illegal access to CVs on the recruitment website Jobs.ie

The Data Protection Commissioner has today, 22 May 2008 concluded his investigation in relation to the illegal access and download of CVs by persons unknown on the website of the online recruitment company - Jobs.ie.

Since this issue was brought to its attention on 31st March last, the Office of the Data Protection Commissioner has been engaged in a detailed investigation of all the circumstances giving rise to the incident in question.  Throughout the process Jobs.ie co-operated completely with the conduct of this investigation and has supplied all relevant information and records sought to this Office.  This expedited the investigation.

This investigation only dealt with the considerations arising from the requirements of the Data Protection Acts 1988 & 2003 as they apply to Jobs.ie and did not address any issues which are within the jurisdiction of An Garda Síochána regarding any criminal investigations it may be conducting in relation to those persons who carried out the illegal access.

The Investigation has concluded that Jobs.ie did not meet the requirements of Section 2(1)(d) of the Data Protection Acts as elaborated upon in Section 2C of the Acts by not having in place a level of security on part of its system appropriate to the harm that could have resulted from the unauthorised and unlawful access to and downloading of the personal data in its possession.  This was accepted by Jobs.ie

The investigation also concluded, in relation to a proportion of the complaints received, that Jobs.ie did not meet the requirements of Section 2(1)(c)(iv) of the Data Protection Acts by continuing to hold personal data for longer than was necessary for the purpose for which it was given.

The Office of the Data Protection Commissioner feels that it is important to make clear that Jobs.ie has responded to the illegal access to the personal data that took place in an exemplary fashion.  There is no doubting that it now takes its data protection responsibilities very seriously.  It moved to put in place additional security measures immediately to minimise the potential for any repetition of the incident and has taken on board all of this Office’s recommendations.

In addition, Jobs.ie behaved in an appropriate manner following the illegal access and is to be commended for its actions, on its own initiative, in making immediate contact with all persons affected by the illegal access that took place. 

Ends