Insurance companies admit breaking data protection laws

They faced possible fines of €3,000 per charge, however, Judge Ann Ryan held that they would be spared criminal convictions and the monetary penalties if they each gave €20,000 to a charity for homeless people.

The three insurance companies were prosecuted following a probe by the Office of the Data Protection Commissioner.

It had been learned that a private detective agency was given personal information in relation to people's employment, earnings and welfare claims, from a source in the Department of Social Protection, Judge Ryan heard.

A separate Garda investigation has been launched in connection with the leaking of the data.

Tony Delaney, Assistant Data Protection Commissioner, said the case against the three insurance companies today focussed on personal data obtained from the computer system of the Department of Social Protection.

He described the breach of the data protection legislation as “very, very serious”. Data was transmitted from the government department's computer system to a detective agency, “and that information made its way to insurance companies.”

A phone number contacted by an official in the government department led to Reliance Investigation Services, a private detective agency, in Calverstown, Co Kildare.

Reliance Investigation Services' office was searched in December 2010 and files, including their “active client list”, were examined. The three insurance companies were identified as clients from VAT numbers on invoices for services provided by the detective agency.

Mr Delaney said insurance companies were “well aware” that any data they handle or use must be publicly available.

The typical information Reliance Investigation Services provided to the three insurance companies included: people's PPS numbers, dates of birth, addresses, details of employment and earnings as well as social welfare claims.

Mr Delaney agreed with Mr Remy Farrell SC, prosecuting, that “details in relation to the spouse as well” were also passed on to Travelers Insurance Company Ltd. “In one case at least the spouse,” Mr Delaney also said regarding the data given to FBD Insurance Plc .

The Department of Social Protection confirmed that this information was not publicly available and had been stored securely on their computer system.

Mr Delaney agreed with lawyers for the defendants that they had co-operated with the investigation and have taken steps in relation to hiring of private investigators to ensure that there will be no further data protection breaches.

He also agreed that they did not have any previous convictions for this type of offence and that they had undertaken to pay the commissioner’s legal costs, which were undisclosed.

Lawyers for the defendants asked the court to note that they had pleaded guilty at the earliest opportunity and they asked the judge to consider applying the Probation Offender's Act, which would spare the three insurance companies criminal convictions.

Judge Ryan heard that the companies were offering to donate €20,000 to a charity.

“Obviously these are extremely serious matters, that people's private detail should be dealt with in such a manner,” said Judge Ryan.

She noted that the three insurance companies had agreed to pay the Data Protection Commissioner’s legal costs.

She said she would apply the Probation Act if they each donated €20,000 to the Capuchin Day Centre, for homeless people, which is located in Bow Street, in Dublin city-centre.

The case was adjourned until March 5 next.