Disclosure of personal data due to inappropriate security measures [08/04/2010]
In August 2008, I received a complaint regarding the alleged disclosure of personal information by an airline. The complainant to my Office stated that in June 2008, in response to a phone call, the airline disclosed by email a travel itinerary for herself and her husband to her husband's employer and on foot of this disclosure, her husband was dismissed from his employment. The complainant stated that her husband's employer had made a written statement to the effect that the email in question was disclosed by the airline on the provision of a surname only. A copy of this statement was provided to my Office.

In the course of this investigation, the airline informed my Office that security questions were asked prior to the email in question being issued to the third party. It did not dispute that it sent the email. However, as the airline did not record the telephone call requesting the information, nor were its security questions system prompted and logged, it was not able to provide any evidence to prove that the appropriate security questions were asked in this instance. My Office also took into consideration that the booking was made from the complainant's own computer using a personal email address rather than from an email address at her husband's workplace.

On the basis of the information presented, together with the fact that the airline could not provide evidence that its own security measures were in fact used on this occasion, I arrived at the decision, following the investigation of this complaint, that the airline had contravened Section 2(1)(c)(ii) by further processing the complainant's personal data and that of her husband when it disclosed to her husband's employer their travel itinerary in an email. It also contravened Section 2(1)(d) by failing to have in place appropriate security measures to prevent the unauthorised disclosure of her  personal information and that of her husband.

The security related issues highlighted by this complainant have been the subject of extensive engagement by this Office with the airline who, following this complaint, examined ways to enhance its security in relation to the handling of enquiries such as this.

This complaint clearly demonstrates the need for data controllers to have controls in place to prevent the disclosure of personal data. It is not sufficient to rely solely on the word of staff that they will ask the appropriate security questions in all instances, particularly in circumstances such as this where an individual deliberately seeks to obtain personal data which they are clearly not entitled to receive.