Data Protection Commissioner
Data Protection Commissioner



Identification of the data controller where control of database disputed - appeal from Decision of Data Protection Commissioner to Circuit Court

A number of individuals from a voluntary organisation ("V") contacted my Office to complain that another organisation ("S") was using V's database without authorisation. The database included names, addresses and highly sensitive personal information. The complainants, who were all data subjects on the database in question, requested that I immediately stop the allegedly unauthorised use of the data.

Having raised the matter with S, it quickly became apparent that there was a dispute as to which organisation was the lawful data controller of the database in question. Both parties agreed that another organisation ("D"), which was now disbanded, had at one time been the lawful data controller in respect of the database. In view of the complexities of the case, and having regard to the sensitivity of the personal data in question, I informed S that it should refrain from using the data, over which it was in a position to exercise physical control, until the data protection issues were resolved. To address these issues, it was necessary to investigate how D came to be the data controller, and the circumstances in which it discontinued its operations.

A brief outline of the broad sequence of events is as follows. Several years previously, a Government Minister had established an ad-hoc group, "C", to lay the groundwork for the creation of the organisation, D, representative of a certain section of the public. C accepted application forms from people for inclusion on an electoral roll. These application forms provided the information from which the database was created. Persons, when completing the application form, were required to sign a declaration which included the following -

I understand my name will be entered on the electoral roll which will be maintained in the strictest confidence under the provisions of the Data Protection Act, 1988. I further understand and accept the electoral roll will be available to all local candidates for election in my county who might wish to canvass my support.

D's constitution provided that it was established on an interim basis, with a fixed term of existence, during which it would prepare elections to a permanent body, E. It transpired, however, that D's management operations were beset with difficulties, and as the end of its term of existence approached, the objective of preparing elections to E seemed unattainable. The Minister then proposed that, after D's term of existence had expired, the task of arranging elections to E would pass to a new group, S. Some members of D were concerned at this arrangement. However, at its final annual general meeting, D gave qualified backing to the Minister's proposal. Alternative proposals to prolong D's lifespan to enable it to meet its original objectives were put to the annual general meeting and defeated.

S was duly established and carried on the functions of D, which was disbanded. Subsequently, however, some former members of D registered the organisation V as a limited company, using a similar title to that of the former organisation D. These people felt that V was the legitimate successor to D, and was therefore the only body entitled to use the membership database that had previously been controlled by D. These individuals also claimed that the qualifications which D had attached to its support for the establishment of S had not, in fact, been complied with by the Minister in setting up the new group.

From the data protection point of view, the issue was in my view straightforward. D had properly controlled the database, with the consent of the data subjects, for the primary purpose of organising elections. Any legitimate successor organisation, using the database for the same purposes, would in my view be entitled to be the data controller in respect of that database. Accordingly, the substantive issue to be determined was not primarily a data protection issue, but rather a factual and legal question as to the status of V versus that of S. The conclusion I reached, in all the circumstances of the case, was that S had the better claim to be the data controller in respect of the personal data in dispute and accordingly I rejected the complaint and gave a formal Decision to that effect.

Two of the complainants exercised their right to appeal my Decision to the Circuit Court, as provided for in section 26 of the Act. The Court, having reviewed all aspects of the case, upheld my decision.