Retention of personal data provided online [2008] IEDPC 13

Retention of personal data provided online [2008] IEDPC 13

X. retained personal data, including credit card details, for longer than necessary and failed to provide an Irish-specific privacy policy. The Data Protection Commission found that a twelve-month retention period was more appropriate and required X. to update its privacy policy and opt-in mechanisms for data retention.

Citation
[2008] IEDPC 13
Parties
Complainant: Complainant (Data Subject); Respondent: X.
Jurisdiction
Ireland
Procedural Posture
Data Protection Complaint / Decision After Investigation
Outcome
Complaint upheld with recommendations implemented
Legal Topics
Retention of Personal Data, Privacy Policy Compliance, Data Subject Rights, Credit Card Data Retention
Data Protection Privacy Law Retention of Personal Data Privacy Policy Compliance Data Subject Rights Credit Card Data Retention

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 3 Authorities cited 1 Party arguments 2 Amounts and remedies 2
Sign in to unlock

Parties

Complainant (Data Subject)

Complainant

X.

Respondent

Procedural Posture

Data Protection Complaint / Decision After Investigation

Legal Issues

  1. 1 Whether X. retained personal data longer than necessary
  2. 2 Whether X.'s privacy policy complied with Irish law
  3. 3 Whether X. provided adequate opt-out mechanisms for communications

Ratio Decidendi

X. retained personal data, including credit card details, for longer than necessary and failed to provide an Irish-specific privacy policy. The Data Protection Commission found that a twelve-month retention period was more appropriate and required X. to update its privacy policy and opt-in mechanisms for data retention.

Court Disposition

Complaint upheld with recommendations implemented

Orders

  • X. to delete personal data after twelve months of inactivity
  • X. to update privacy policy to reflect Irish law