The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

SKY Ireland: Direct marketing by mail

I received a complaint from a member of the public in May 2006 concerning a direct marketing communication which he had received from Sky encouraging him to renew his subscription which he had cancelled in 2001. This was the second occasion on which this data subject complained to my Office concerning the receipt of direct marketing material from Sky. In 2005, on foot of the first complaint, my Office had been assured by Sky that the mailing had issued to the data subject as a result of an administrative error and that steps taken to remedy the situation would ensure that it would not occur again. My Office and the data subject accepted Sky's assurances in good faith at that time.

One of the key data protection principles is the obligation on data controllers to retain data for no longer than is necessary for the purpose for which it was collected. In this instance, the data subject terminated his business relationship with Sky in 2001. The company was not entitled to retain the personal data of their former customer and to use it for direct marketing in this way several years later once the person had objected to the receipt of such material in 2005. Retention of personal data for longer than is necessary is a breach of Section 2(1)(c)(iv) of the Acts. Furthermore, as the data subject had previously informed the data controller that he did not wish his data to be processed for the purpose of direct marketing, and as his wishes were not complied with by virtue of the issuing of further direct marketing material in 2006, a breach of Section 2(7) of the Acts also took place.

My Office commenced an investigation and was informed by Sky that the data subject's record had slipped through its data processing procedures. Sky confirmed that the data subject's record had now been properly suppressed, it apologised for the inconvenience caused and it stated that it wished to offer the data subject a gesture of goodwill to address its error.

My investigative powers under the Acts oblige me to attempt to arrange, in the first instance, for the amicable resolution by the parties concerned in a complaint. My Office makes every attempt to achieve an amicable resolution between parties. In this case, Sky's offer of a goodwill gesture was a significant factor in achieving an eventual outcome which was acceptable to both parties. Sky wrote to the data subject, acknowledged that it had sent him unsolicited marketing material, apologised for the inconvenience caused, confirmed that his record had been suppressed and provided television advertising spots to the value of €5,000 to a reputable Irish charity free of charge.

Direct marketing is a commonly used tool which, if applied in a manner which fails to respect the expressed wishes of members of the general public, is an unwanted intrusion and a nuisance. I have strong powers to protect the rights of data subjects in this area and I have no hesitation in enforcing those rights on their behalf. However, this case demonstrates that, where breaches of the Act occur, solutions short of my using my powers are entirely possible and I welcome the innovative approach of Sky in addressing the complaint of the data subject. I am also happy that such gestures have a sufficiently strong impact on the profitability of entities to ensure that appropriate procedures are put in place to minimise the possibility of a re-occurrence of the system failure.