Case studies

The Authority has a statutory duty to promote awareness of data protection issues. Detailed below are anonymised and simplified case studies of real cases the Authority have handled, together with what can be learned from them.

Discretion is key

An individual was concerned that a healthcare provider was confirming patient contact details loudly in front of other patients at the reception desk.

Out of date photos

A complaint was made that an individual’s former employer was still using photos of them in their marketing materials.

Password protection

A health organisation emailed sensitive information relating to several patients to an incorrect and unintended recipient.

Sharing stories

A Data Protection Officer (DPO) at a local finance company who was new in their job approached the ODPA for guidance on how to raise their colleagues’ awareness of data protection.

Swift action

A device belonging to a construction company was compromised, which resulted in hackers gaining access to the company’s email mailbox.

Working from home

An employee sent work data to their personal email addresses so they could work from home.

Asking permission

An organisation posted photographs of young children on its social media account.

CCTV shared unlawfully

A retailer had installed CCTV to cover the public areas of their premises for security purposes (prevention and detection of crime).

Clarity

A patient asked their legal representative to make a ‘data subject access request’ (DSAR) to their GP on their behalf.

Data protection enabling innovation

An entrepreneur approached the ODPA about a software system he was in the initial stage of developing which involved the use of data about people.

Demonstrating consent

The complainant was approached by a recruitment agency of whom they had previously been a client.

Email breach

An organisation was responsible for managing a number of different client databases all of which related to confidential financial relationships.

Incorrect recipient

An email, intended for the complainant, was sent by an employee of the company.

'Legal privilege'

A member of the public made a ‘data subject access request’ to an organisation she believed had some information about her.

Meeting minutes

A member of the public (the complainant) attended a meeting at an organisation.

Mis-trace

A legal firm were helping a client with debt recovery proceedings regarding outstanding school fees.

Mix-up

An individual received an email in error from an organisation.

Social media admin

An employee was responsible for the administration of a public social media account for the company they worked for and used their personal login to access the page.

Unjustified extension

The complainant made a Subject Access Request to a healthcare provider to obtain information relating to the provision of medical care.