Case studies

An organisation posted photographs of young children on its social media account.

A retailer had installed CCTV to cover the public areas of their premises for security purposes (prevention and detection of crime).

A patient asked their legal representative to make a ‘data subject access request’ (DSAR) to their GP on their behalf.

The complainant was approached by a recruitment agency of whom they had previously been a client.

An individual was concerned that a healthcare provider was confirming patient contact details loudly in front of other patients at the reception desk.

A member of the public made a ‘data subject access request’ to an organisation she believed had some information about her.

A member of the public (the complainant) attended a meeting at an organisation.

A legal firm were helping a client with debt recovery proceedings regarding outstanding school fees.

A complaint was made that an individual’s former employer was still using photos of them in their marketing materials.

A health organisation emailed sensitive information relating to several patients to an incorrect and unintended recipient.

A Data Protection Officer (DPO) at a local finance company who was new in their job approached the ODPA for guidance on how to raise their colleagues’ awareness of data protection.

An employee sent work data to their personal email addresses so they could work from home.

The complainant made a Subject Access Request to a healthcare provider to obtain information relating to the provision of medical care.