Case Study 14: Client list taken by ex-employee to new Employer [2012] IEDPC 14 (2012)

Case Study 14: Client list taken by ex-employee to new Employer [2012] IEDPC 14 (2012)

Garage B processed personal data of Garage A's customers without their consent, constituting a breach of the Data Protection Acts. Garage A's employee contract lacked clarity on personal data use, contributing to the breach.

Citation
[2012] IEDPC 14
Parties
Complainant: Garage A; Respondent: Garage B; Adjudicator: Irish Data Protection Commission
Jurisdiction
Ireland
Procedural Posture
Data Protection Complaint / Investigation and Determination
Outcome
Breach found
Legal Topics
Personal Data Security Breach, Employee Misuse of Data, Consent for Data Processing, Electronic Marketing
Data Protection Employment Law Personal Data Security Breach Employee Misuse of Data Consent for Data Processing Electronic Marketing

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 2 Authorities cited 1 Party arguments 2
Sign in to unlock

Parties

Garage A

Complainant

Garage B

Respondent

Irish Data Protection Commission

Adjudicator

Procedural Posture

Data Protection Complaint / Investigation and Determination

Legal Issues

  1. 1 Whether Garage A failed to keep personal data secure
  2. 2 Whether Garage B processed personal data without consent

Ratio Decidendi

Garage B processed personal data of Garage A's customers without their consent, constituting a breach of the Data Protection Acts. Garage A's employee contract lacked clarity on personal data use, contributing to the breach.

Court Disposition

Breach found

Orders

  • Garage B destroyed the unlawfully obtained data.
  • Garage A was advised to amend employee contracts to specifically address personal data use.