Employee obtains data from customer file for personal use [30/05/2011]

In March 2010 we received a complaint regarding an alleged inappropriate access to customer personal information by an employee of Company X (an insurance company).  The complainant informed us that, in March 2010, he was telephoned by an individual who accused him of scratching his car on the previous evening while parking in the grounds of a University.  As the complainant knew nothing of this incident, he asked the caller how he had obtained his phone number.  He was informed by the caller that he had noticed that the car was insured with Company X and, as he worked for that company, he had sourced the phone number from the company system.  The caller stated that he had left a business card on the car windscreen.  When the data subject checked, he found the business card with the name of the individual concerned and his job title.

We commenced our investigation of this complaint by writing to Company X, drawing their attention to the obligation to keep personal data for specified, explicit and lawful purposes and use it only in ways compatible with these purposes.  On this basis, we asked the company to outline the circumstances in which the complainant's personal data was processed in the manner outlined in his complaint.  In its response Company X assured us that it has very stringent procedures in place regarding the safeguarding of customers' personal data from unauthorised access and the protection of this data from processing for purposes other than for which it was collected.  In relation to the specifics of this complaint, Company X investigated the matter and raised it with the employee concerned.  The employee confirmed that he accessed the policyholder's data for the purpose of contacting him to discuss the incident and to see if he wished to settle the matter directly with him.  The company acknowledged that the incident should have been pursued in the normal manner through its claims procedure.  If the correct procedure had been followed, the complainant's personal information would have been accessed by claims personnel and used to alert him of the allegation.  Company X informed us that the staff member in question had been made aware in no uncertain terms of the seriousness of the incident.  In addition, the issues raised by this complaint were used to draw the attention of other staff members to the importance of complying with data protection obligations.

In an effort to amicably resolve this complaint, Company X issued a letter to the complainant explaining what had occurred and apologising for the distress and inconvenience caused.  The company also offered the complainant a voucher for €100 towards his next renewal premium.  The complainant accepted this amicable resolution.

This complaint raised a serious data protection issue.  Organisations are entrusted with a huge amount of personal data which they have a responsibility to keep safe and secure.  The message that customer personal information can only be accessed on a "need to know" basis must be continually reinforced.  While safeguards are required to protect customer data from disclosure to third parties outside the organisation, similar protection must be afforded to protect the data from internal misuse.  This theme is raised in the 2010 edition of our annual report in relation to insurance companies.  We must also acknowledge that we received full co-operation from Company X in this matter and the company takes its data protection responsibilities seriously.