The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission



Ex-directory phone number obtained by insurance broker – Information Notice used to establish circumstances

Two people complained to me, separately, that a particular firm of insurance brokers had obtained their ex-directory telephone numbers and used these to contact them to try to sell insurance products. They were surprised to be contacted at home, since they had taken the trouble to opt for ex-directory numbers, and they were indignant at what they saw as an aggressive invasion of their privacy. Both complainants speculated that the brokers had got their phone numbers in some illicit way, though neither offered any evidence for this.

I issued an Information Notice under section 12 of the Act to the brokers. In response to the Information Notice, the brokers stated that in the majority of cases they obtained the telephone numbers of prospective clients from the telephone directory, but in some cases they got them from referrals by existing clients (in other words, existing clients were encouraged to suggest other people who might be interested in the company's products and services). However, the brokers indicated that they did not keep records as to who made such referrals and consequently they were unable to explain how they had come into possession of information relating to the complainants.

My decision was that in all the circumstances the investigation had not established that a contravention of the Act had taken place in these cases. In reaching this decision I took into account the fact that the data controller's account of the events had been given to me by way of response to an Information Notice, and that section 12 provides that -

"A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an information notice or who in purported compliance with such a requirement furnishes information to the Commissioner that the person knows to be false or misleading in a material respect shall be guilty of an offence."

However I told the brokers that they should in future retain a record of how details of prospective clients were obtained. They agreed to do so.