Irish Data Protection Commission Case Studies

Paternity test result sent to the wrong address [8/04/2010]

My Office received a complaint in April 2009 from an individual concerning the disclosure of sensitive personal information by a data controller who provides paternity testing services.

 

The background to the complaint is that a DNA kit was ordered from the data controller, which duly arrived at the correct address, swabs were taken and the kit was returned to the data controller the next day. However, after a period of time had elapsed and as the test result was not forthcoming, the individual concerned phoned the data controller on 30th March 2009, to be informed that the test result had been posted on Friday 27th March. When the result had still not arrived the following day, the individual concerned again phoned the data controller and at that stage asked that it trace where the test result had been posted to. The data controller stated that the result had been posted to number 83 of a particular housing estate. However, the address of the individual concerned was number 82. When contact was made with  the occupants of number 82 on this matter, they dropped the already opened envelope through the letter box of number 83.

 

My Office commenced the investigation of this complaint by informing the data controller that Section 2 of the Data Protection Acts 1988 and 2003 imposes responsibilities and obligations on data controllers regarding the collection, processing, keeping, use, disclosure and security of personal data. We also pointed out that medical data constitutes sensitive personal data under the Acts and we asked for an explanation as to how this sensitive personal information was issued to the incorrect address, despite the original DNA kit being posted to the correct address.

 

In its response the data controller stated that in normal circumstances addresses are printed from its system on to labels which are then placed on the envelope. On the said day, its system was not functioning properly and because of that it entered addresses manually. Due to human error, the person writing the address put the number 83 on the envelope instead of 82, despite the fact that the records held the accurate address.  It said that it was confident that the error was a one-off occurrence. The data controller also conveyed its apologies to the individual concerned for any inconvenience caused and it offered to provide a full refund of the fee involved in order to amicably resolve the matter. This offer was accepted by the individual concerned and the complaint was resolved on this basis.

 

This complaint illustrates the need for data controllers to be vigilant at all times with regard to the processing of personal data. While the data controller may have had an appropriate electronic system in place to ensure that letters were properly addressed to its clients, the fall-back manual processes which came into play when the electronic system was out of commission failed in this case, leading to the disclosure of sensitive personal data. While the data controller put the incident down to human error, the consequence of not having any double checking in the manual process was a disclosure of sensitive personal information and a breach of the Data Protection Acts. This breach understandably caused great upset to the affected individual whose test result was disclosed to a neighbour.