31 December 2007

Excessive Personal Data on Application Forms 

I received a complaint that an Application Forms, which are issued annually by the YY, contained pre-printed data in respect of the date of birth and PPS number of the persons to whom the forms are issued. A complainant informed my Office that he, and many others, would usually need to get professional assistance from Teagasc or other qualified agents in the completion of these forms. He pointed out that the pre-printing of this personal data on the forms infringed his privacy as he had no means to restrict his professional adviser from viewing his date of birth and PPS number. He also stated that it would be normal for those professional advisers to retain copies of the completed forms in case YY raised queries which might need to be referred back to the advisers at a later stage. 

In contacting YY on this matter, we highlighted that both PPS numbers and dates of birth constitute personal data and are, therefore, subject to the protections set down in the Data Protection Acts, 1988 and 2003. We went on to state that in a situation where YY sends out forms with personal data pre-printed on them and is aware that the recipients may need the assistance of third parties to complete them, the YY must make every effort to ensure that only the very basic personal details - such as name and address - are pre-printed. We pointed out that the problem with pre-printing other personal data is that it gives the recipient only one choice in terms of safeguarding it – that is that he/ she could blacken it out or otherwise delete it prior to showing it to a third party. We expressed some doubt about whether YY would welcome the return of completed application forms which were somewhat defaced. Finally, we drew attention to the potential risks to the privacy of an individual where their personal data, such as a PPS number, fell into the hands of a third party. 

YY examined the matter and it immediately set about taking into account the concerns which my Office had expressed. In the drafting of the Application Form for 2008, the Department commendably removed completely the data fields concerning the applicant’s date of birth and PPS number. 

This case demonstrates how common it is for public bodies or other authorities to fall into the practice of processing categories of personal data even where such data is not needed to administer the scheme or application in question. Greater care must be taken by all concerned to ensure that only the minimum amount of personal data necessary is processed in the administration of schemes run by public bodies. In particular, I strongly advise public bodies which are authorised to use PPS numbers to do so sparingly and with extreme care.