Two recent cases will give lawyerspause for thought prior to instructing private investigators.
In the first case, a privateinvestigator (Mr Ryan) was fined €7,500 for illegally obtaining personalinformation from the Department of Social Protection (the “Department”) when hewas employed by a firm of solicitors in Dublin in relation to debt collectionproceedings for two banks. The Office of the Data Protection Commissioner(ODPC), gave evidence that Mr Ryan had obtained the personal details of 68people from his sister-in-law who worked for the Department. The District Courtheard that Mr Ryan was not registered with the ODPC and had no authorisation toprocess personal information on databases. The District Court also heard whilstit is not against the law for solicitors and banks to hire privateinvestigators, it remains a serious breach of the Data Protection Acts 1988 and2003 to obtain personal information unlawfully. It was the tactics andmethodology used that were of serious concern in the case. Judge Conal Gibbonsalso expressed concern that the banks did not take greater care to ensure thatthe people they were hiring to help recover debt were fully compliant withapplicable rules and regulations. Following the case, the ODPC said thatprivate investigators acting unlawfully would continue to be vigorouslypursued.
In the second case, a formersecondary school teacher (Ms Daly) sought an injunction against an insurancecompany directing the insurer to pay her disability benefit under her salaryprotection scheme. She also sought orders restraining the insurance companyfrom carrying out any further surveillance of her and requiring any images ofher already obtained to be handed over. Ms Daly claimed that she was placedunder surveillance by a private investigator after she challenged the insurer’sdecision to cease paying her disability allowance. She was of the view that theaction was designed to intimidate her and she feared that the surveillancewould resume, although the insurance company had confirmed that it would not.Ms Daly had been deemed medically unable to work as a teacher by the Departmentof Education on the grounds that she suffered from ME or chronic fatiguesyndrome for many years and it was asserted before the High Court that therewere 6 medical reports supporting this. Ms Daly was granted permission to serveshort notice of the proceedings on the insurer and the outcome of thesubstantive proceedings is awaited.
The Data Protection Acts 1988 and2003 regulate how data controllers collect, store and use personal data held bythem about data subjects. The ODPC is responsible for upholding the privacyrights of individuals in relation to the processing of their personal data andhas focussed on the area of private investigators and tracing agents to ensurethat they do not seek to access personal data held by other data controllerswhich is not in the public domain without the consent of the data subject orunless otherwise permitted by law. The ODPC welcomed the decision in the firstcase above saying “these prosecutions send a strong message to privateinvestigators and tracing agents to comply fully with data protectionlegislation in the conduct of their business and that if they fail to do so,they will be pursued and prosecuted for offendingbehaviour“.
It appears likely that this is anarea that the ODPC will continue to focus on and at the very least, if a lawyeris instructing a private investigator, it would be prudent to ensure that theinvestigator is registered with the ODPC.
Contributedby FionaBarryand PaulFisher
