The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Case Study 6

Women's Mini- Marathon-unauthorised and incompatible disclosure-Internet photographs-informed consent.

I received a complaint from a mother who took part in the Women's Mini-Marathon in June 2002 with her fourteen year old daughter. Her daughter subsequently received a letter in July 2002 from a UK company offering her photos of herself taken on the day of the marathon. The photos also appeared on the company's website. The mother complained that she had not given permission to the organisers of the mini-marathon to supply her daughter's name, address and race number to another company or to take photos of her daughter and she had requested that the photo be removed from the website immediately. The photos were subsequently removed from the web site at the request of my Office. The Data Protection issue here involved the disclosure of personal data in a manner incompatible with the purpose for which it had originally been obtained.

My Office contacted the organisers of the mini-marathon who agreed that they had supplied the information to the company to take photos on the day and that the participants would not have been aware of this when they signed up for the event. The organisers hoped if this proved popular that they would engage the company to take photos the next year. The organisers made facilities available to the company to take photos at the start and finish of the race. They gave them access to their database of participants and the company offered photos to these participants for sale.

While acknowledging the view of the race organisers that this service was of added value to participants and was part of the race experience, I considered that a contravention of Data Protection Law had occurred in this instance in that the entry form did not indicate the further use to which the database of entrants would be put and it should have provided for prior consent to be given or withheld.

My Office arranged a meeting with the organisers of the event at which the data protection requirements for events of this nature were discussed in detail and in particular, the obligation regarding transparency as to the uses to which information would be put. This involved a minimum requirement that a facility to opt out of additional uses be provided. The organisers agreed to revise their procedures for future events, and to give participants an option regarding photos.

I was satisfied with the response of the organisers of the Women's Mini Marathon to the complaint, and I note that they revised their entry forms to reflect Data Protection requirements for the forthcoming 2003 event.