Retention of personal data of nearby residents [2007] IEDPC 11

[ Home ] [ Databases ] [ World Law ] [ Multidatabase Search ] [ Help ] [ Feedback ] [ DONATE ] Irish Data Protection Commission Case Studies You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> Retention of personal data of nearby residents [2007] IEDPC 11 URL: https://www.bailii.org/ie/cases/IEDPC/2007/11.html Cite as: [2007] IEDPC 11 [ New search ] [ Printable RTF version ] [ Help ] Retention of personal data of nearby residents [2007] IEDPC 11 (31 December 2007) In July 2006 I received a complaint from a data subject regarding the retention, use and security of personal data collected by G. The complaint came about as a result of a letter which the Director at G. had issued to residents in the area in relation to the setting up of a database through which the residents would be considered for tickets to some of the events held in G.. In this letter, the Director stated that he was very conscious of the fact that G. was situated in a residential area and was part of the local community. He pointed out that G had, in recent years, looked at ways of making some tickets available to the community for different events. It had now decided to introduce a new scheme involving the setting up of a database of people living in the area which would help ensure that tickets, when they were available, went to the right people. In order to be considered for tickets, interested residents were required to complete an application form and submit some form of photo identification, such as a passport or driving licence, as well as a utility bill. The data subject had serious concerns in relation to the type of information which was sought, how it was going to be used and the security surrounding the holding of the data. My Office contacted G. to raise the issues in the complaint and to make it aware of its obligations under section 2 of the Acts which provides, among other things, that data shall be processed fairly, kept for only one or more specified purpose, kept safe and secure and that it shall be adequate, relevant and not excessive. G responded in detail in relation to the data protection issues my Office raised and stated that the information would not be disclosed to any third parties and would not be used for any purpose other than to notify residents when tickets would be made available to them. It also informed my Office of the security measures it had in place to keep the data safe and secure. In relation to the extent of some of the personal information sought, G responded by saying that it had a legitimate concern to ensure that identities and home addresses were verified correctly and it stated that an annual audit would ensure that all out-of-date information was deleted. My Office remained concerned that the residents were not made aware of how their data would be used by G. and we suggested that this could be done through the inclusion of a data protection notice in the renewal letter which issues to all residents annually. We also had concerns regarding the retention of identity documents and we informed G. that data controllers should not retain copies of personal data such as passports, driving licences and utility bills unless they had a statutory basis for doing so. My Office recommended that the residents be allowed to present their identification in person to G. or alternatively, in relation to documents submitted by post, that G. undertake to return the identification documents uncopied to the residents once verified. G took my Office's recommendations on board and agreed to amend all future application forms to include a data protection notice. It also agreed to return all copies of identification and utility bills to those residents who had already submitted application forms to G. I was satisfied that G. took its responsibilities as a data controller seriously and I was encouraged by the prompt manner in which it addressed the issues raised by my Office by revising its procedures to take into account the data protection rights of the individuals involved. Increasingly my Office is being informed of circumstances where data controllers retain copies of personal information used for identification purposes. Without a statutory basis for retaining copies of such documents, a data controller has no entitlement to keep a copy on file. There is no impediment to requesting sight of identification documents in order for a data controller to satisfy itself of a data subject's identity and a system for doing this can be put in place without too much effort. BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII URL: https://www.bailii.org/ie/cases/IEDPC/2007/11.html