Case studies

The Authority has a statutory duty to promote awareness of data protection issues. Detailed below are anonymised and simplified case studies of real cases the Authority have handled, together with what can be learned from them.

Asking permission

An organisation posted photographs of young children on its social media account.

CCTV shared unlawfully

A retailer had installed CCTV to cover the public areas of their premises for security purposes (prevention and detection of crime).

Clarity

A patient asked their legal representative to make a ‘data subject access request’ (DSAR) to their GP on their behalf.

Data protection enabling innovation

An entrepreneur approached the ODPA about a software system he was in the initial stage of developing which involved the use of data about people.

Demonstrating consent

The complainant was approached by a recruitment agency of whom they had previously been a client.

Email breach

An organisation was responsible for managing a number of different client databases all of which related to confidential financial relationships.

Incorrect recipient

An email, intended for the complainant, was sent by an employee of the company.

'Legal privilege'

A member of the public made a ‘data subject access request’ to an organisation she believed had some information about her.

Meeting minutes

A member of the public (the complainant) attended a meeting at an organisation.

Mis-trace

A legal firm were helping a client with debt recovery proceedings regarding outstanding school fees.

Mix-up

An individual received an email in error from an organisation.

Social media admin

An employee was responsible for the administration of a public social media account for the company they worked for and used their personal login to access the page.

Unjustified extension

The complainant made a Subject Access Request to a healthcare provider to obtain information relating to the provision of medical care.