BAILII [Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]

Irish Data Protection Commission Case Studies


You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> Resale of an Apple ipod containing a customer's personal data [2008] IEDPC 15
URL: http://www.bailii.org/ie/cases/IEDPC/2008/15.html
Cite as: [2008] IEDPC 15

[New search] [View without highlighting] [Printable RTF version] [Help]


    Resale of an Apple ipod containing a customer's personal data [2008] IEDPC 15 (31 December 2008)

    In March 2008 I received a complaint from a data subject regarding the resale by X. store of an Apple ipod which she had returned to the store after it developed a fault and onto which personal data relating to her had been downloaded.
    The data subject informed my Office that she purchased the ipod at an X. store in May 2007 and that she returned it a few days later when it developed a fault.  After purchasing it, the data subject had successfully downloaded music and photographs from her computer onto the ipod and she had registered it in her name.  On returning the ipod she made a point of informing a member of staff at the X. store that due to the fault she was unable to delete from the ipod her personal photographs and music prior to returning it.  She was given a replacement ipod immediately.
    However, in early January 2008, the data subject became aware through an acquaintance that the ipod she had returned the previous May had subsequently been resold by X. to a different customer.  The data subject contacted this customer who confirmed to her that she had purchased the ipod as a Christmas gift for her daughter at the same X. store some months after the data subject had returned it.  She also informed the data subject that, on purchasing the ipod, she found that she had access to the data subject's music and personal photographs.  When she tried to register the ipod in her daughter's name, it was confirmed that the ipod was still registered in the name of the data subject.  That customer also returned the ipod to the X. store.
    Understandably, the data subject was concerned to find that the faulty ipod that she had returned to X. in May was resold again some time later with her personal data still on it.  My Office contacted X's Head Office regarding this matter.  X. subsequently acknowledged to my Office that the ipod returned by the data subject should not have been put on sale after she had returned it.  It informed my Office that its own internal controls failed to operate on this occasion and that the ipod should have been returned to its supplier.  Instead, it appears to have been repackaged, retained in the store for some time and then inadvertently put on sale again.  X. also informed my Office that when the ipod was returned a second time, its internal processes operated effectively and the ipod was returned to the supplier.
    X. informed my Office that as a result of this incident it instituted a review of the data protection compliance processes in its stores.  This included implementing more robust processes for the storage, return and tracking of any devices that contain personal data.  X. also informed my Office that as part of its review of its data protection compliance processes, it had reiterated to its entire staff the need to be careful about how its customers' personal data is used.
    During my Office's investigation of this complaint, X. expressed regret at the inconvenience and concern caused to the data subject as a result of the manner in which the matter was dealt with by the store.  It also offered a gesture of goodwill to the data subject and expressed a wish to write directly to her to express its apologies for the incident.
    As the Data Protection Acts mandate my Office, in the first instance, to resolve complaints amicably between the parties concerned, my Office informed the data subject of X's interest in reaching an amicable resolution.  The data subject accepted X's goodwill gesture and letter of apology, both of which were forwarded to her via my Office.
    This case perfectly demonstrates circumstances when, through the intervention of my Office, a data controller is made aware that it has breached the Acts and is reminded of its obligations under the Acts.  At the same time, the concerns of a data subject are addressed and the matter is resolved amicably between the parties.  It also highlights the need for retailers to raise awareness among their staff about the capacity of portable devices which they sell in their stores to process and retain personal data.  Robust procedures are necessary in retail outlets to prevent incidents of a nature similar to that outlined in this case.


BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII
URL: http://www.bailii.org/ie/cases/IEDPC/2008/15.html