BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
Irish Data Protection Commission Case Studies |
||
|
You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> Q: Forced to delete database [2006] IEDPC 5 URL: http://www.bailii.org/ie/cases/IEDPC/2006/5.html Cite as: [2006] IEDPC 5 |
||
[New search] [Printable RTF version] [Help]
Q: Forced to delete database [2006] IEDPC 5 (31 December 2006)
I received a complaint from an individual regarding the receipt of an unsolicited text message in November 2005. The message, sent by Q, was a promotional message for a subscription service.
When my Office investigated the matter it was discovered that the complainant had attended a major music concert in June 2005. During the concert, those attending were encouraged to text support for a campaign. The complainant did so. The information collected from these texts was stored in a database held by Q and was subsequently used by the company for the purpose of sending unsolicited direct marketing SMS messages.
In October 2005 Q sent a direct marketing text message to the complainant. Regulation 13 of Statutory Instrument 535 of 2003 refers to unsolicited communications, making it an offence in certain circumstances to send direct marketing messages. The message the complainant received was contrary to this Regulation. It also contravened Section 2 of the Data Protection Acts as the personal data in question had not been obtained and processed fairly and was further processed in a manner which was incompatible with the purpose for which it was originally collected.
During our investigation, my Office discovered that 16,000 concert goers had used their mobile phones to text support for the Campaign. My Office recognised the potential risk of all of these people being subjected to direct marketing in the same way as the complainant had been. Conscious of this risk, I initially requested in a letter to Q that they delete the related Database. When it did not comply with this request, I used my powers under Section 10 of the Data Protection Act and issued an Enforcement Notice. An Enforcement Notice is a legal document and it is an offence not to comply with this. Q complied with the Enforcement Notice and deleted the database.
This case demonstrates clearly that information collected for one purpose must not be used for another purpose unless the data subject was informed at the time of collection of such an intended use and given an opportunity to object.
