The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission


Direct mailing to children – complaint by parent – issues of fair obtaining and keeping data longer than necessary


A father complained to me that his children had received direct mail from a company making a product used mainly by children. This complainant took the view that children were more vulnerable than adults to manipulation by marketing and should not be targeted in such a way.

I took the matter up with the company concerned and was referred to the agency which carried out its marketing activities. This agency informed me that as a result of the complaint it had deleted the data relating to the children in question, but in its response it produced material to show that they had responded some time previously to another promotional campaign.

The earlier promotional campaign had been a "once-off". I told the agency that in these circumstances its actions raised two issues:

First of all, the earlier campaign had been concluded for some time. Section 2(1)(c)(iv) provides that data "shall not be kept for longer than is necessary" for the purpose for which they were obtained in the first place. Consequently I asked the agency to consid whether it should still have the respondents' data at all. The agency explained that when people responded to promotional campaigns their data were generally kept for about a year, because it was quite common for people who had taken part in campaigns, or thought or pretended they had, to contact the promoters again subsequently. I accepted this argument as reasonable in the particular circumstances of the case.

Secondly, the children's data had been obtained for a single purpose - the conduct of the earlier campaign. I questioned whether it was open to the agency to use the data for another purpose without first of all seeking the individuals' positive consent to do so. The agency undertook to keep this point in mind in future.