The sharing of personal information is a day to day occurrence in many Irish businesses. There is a requirement for all Irish businesses to understand that the movement of such information is protected by legislation, namely, the Data Protection Act 1988 which was subsequently amended by the Data Protection (Amendment) Act 2003 (the Acts). The office of the Data Protection Commissioner is charged with monitoring data protection and enforcing compliance.
An interesting case that came before the office of the Data Protection Commissioner is that of the exchange of a person’s Curriculum Vitae (CV) between two companies. (Case Study 7:2009)
The person in question lodged a complaint with the office of the Data Protection Commissioner regarding an alleged disclosure of his CV from one company to another.
The background to the case was that the employee had submitted his CV to the original company (a recruitment company, company A), he later received a call from a separate recruitment company (company B) who confirmed that they had a copy of his CV in their possession. Company B wanted to progress to use the person’s details to aid in placing him in a new role. The person in question was not satisfied that a second company had received his personal information and did not want them to be involved in his placement.
The person lodged a complaint with the office of the Data Protection Commissioner. A vital element to the validity of information sharing is that personal data should only be used with the consent of the data subject and it is also important that information is only processed in keeping with the manner with which it was obtained. Accordingly, the Data Protection Commissioners office asked the recruitment company to demonstrate the consent it considered it had from the person to disclose his personal information to the second recruitment company (company B).
The argument put forward by company B was that they effectively ran as the same trading entity as company A. They both shared IT systems, databases and management systems amongst other things. The fact was that the complainant’s CV was handed from one recruitment consultant to another without his knowledge. The question at hand was whether this was seen as reasonable based on the fact that they two consultants did work for separate commercial entities.
The Data Protection Commissioners office confirmed that, “individuals using the service of either company should be made fully aware that their information may be shared between the two companies.” The companies’ privacy policy on the website did not disclose the aforementioned fact and the Data Protection Commissioner’s office undertook to inform the companies that this was not compliant with the appropriate Data Protection legislation.
As a result of the investigation into the matter, both companies gave assurances to the Data Protection Commissioner that they would make it expressly clear to all candidates that there would be a sharing of information between the two companies. The companies would ensure that the message of “shared information” would be put on their website and in fact they had intended to trade as the one entity in the future.
What Are the Risks?
It is imperative that a data controller makes individuals and employees aware how their personal information will be processed and by whom it may be disclosed to. Generally, personal data may not be shared between two legal entities without consent of the individual.
Conclusion
In summary, it is important for employers to be able to justify why exactly they are gathering information on an employee and why there may be a need to share that same information. It is not appropriate to gather information and then pass this to a third party unless they fall into a category of legal advisory capacity for example.
Employers should seek advice from Peninsula Business Services when faced with a Data Protection question. Please phone the 24 Hour Advice Service on 01 8555050 and one of our experienced advisors will be happy to assist.
