Two recent cases will give lawyers pause for thought prior to instructing private investigators.
In the first case, a private investigator (Mr Ryan) was fined €7,500 for illegally obtaining personal information from the Department of Social Protection (the "Department") when he was employed by a firm solicitors in Dublin in relation to debt collection proceedings for two banks. The Office of the Data Protection Commissioner (ODPC), gave evidence that Mr Ryan had obtained the personal details of 68 people from his sister-in-law who worked for the Department. The District Court heard that Mr Ryan was not registered with the ODPC and had no authorisation to process personal information on databases. The District Court also heard whilst it is not against the law for solicitors and banks to hire private investigators, it remains a serious breach of the Data Protection Acts 1988 and 2003 to obtain personal information unlawfully. It was the tactics and methodology used that were of serious concern in the case. Judge Conal Gibbons also expressed concern that the banks did not take greater care to ensure that the people they were hiring to help recover debt were fully compliant with applicable rules and regulations. Following the case, the ODPC said that private investigators acting unlawfully would continue to be vigorously pursued.
In the second case, a former secondary school teacher (Ms Daly) sought an injunction against an insurance company directing the insurer to pay her disability benefit under her salary protection scheme. She also sought orders restraining the insurance company from carrying out any further surveillance of her and requiring any images of her already obtained to be handed over. Ms Daly claimed that she was placed under surveillance by a private investigator after she challenged the insurer's decision to cease paying her disability allowance. She was of the view that the action was designed to intimidate her and she feared that the surveillance would resume, although the insurance company had confirmed that it would not. Ms Daly had been deemed medically unable to work as a teacher by the Department of Education on the grounds that she suffered from ME or chronic fatigue syndrome for many years and it was asserted before the High Court that there were 6 medical reports supporting this. Ms Daly was granted permission to serve short notice of the proceedings on the insurer and the outcome of the substantive proceedings is awaited.
The Data Protection Acts 1988 and 2003 regulate how data controllers collect, store and use personal data held by them about data subjects. The ODPC is responsible for upholding the privacy rights of individuals in relation to the processing of their personal data and has focussed on the area of private investigators and tracing agents to ensure that they do not seek to access personal data held by other data controllers which is not in the public domain without the consent of the data subject or unless otherwise permitted by law. The ODPC welcomed the decision in the first case above saying "these prosecutions send a strong message to private investigators and tracing agents to comply fully with data protection legislation in the conduct of their business and that if they fail to do so, they will be pursued and prosecuted for offending behaviour".
It appears likely that this is an area that the ODPC will continue to focus on and at the very least, if a lawyer is instructing a private investigator, it would be prudent to ensure that the investigator is registered with the ODPC.