The Office of the Data Protection Commissioner (ODPC) has uncovered wholesale and widespread 'blagging' techniques used by Private Investigators to breach personal data, while also offering a strong rebuke of the Credit Unions involved in the case.

It follows an investigation by the ODPC into several Credit Unions and private investigation firm, MCK Rentals LTD.

Two directors of the company pleaded guilty to five sample charges for offences under section 22 of the Data Protection Acts. These offences amounted to consenting, conniving or neglecting to stop the alleged breach of data protection laws by MCK Rentals in May 2013.

The Data Protection Commissioner (DPC), in a statement released shortly after the ruling was made, criticised the Credit Unions involved for failing to query where the information was coming from, and for sharing PPS numbers of customers with the investigators.

The directors, Ms. Margaret Stuart and Ms. Wendy Martin, were separately charged with twenty three counts of breaches of Section 29 of the Data Protection Acts, 1988 & 2003 for their part in the offences committed by the company.

Bray District Court convicted the company of each of the five charges and imposed a fine of €1500 per offence.

“The investigation of these cases uncovered wholesale and widespread blagging techniques used by the offenders and this is the first completed prosecution by the Data Protection Commissioner of offenders engaged in such practices,” said a statement from the Data Protection Commissioner.

The DPC warned that the ruling “sends a strong message to private investigators and tracing agents to comply fully with data protection legislation in the conduct of their business and that if they fail to do so, they will be pursued and prosecuted for offending behaviour.”

The DPC said that the prosecution of the two is also significant as “these are the first prosecutors to be completed by the Data Protection Commissioner against private investigators for breaches of data protection legislation,” and “this is the first occasion on which company directors have been prosecuted by the Data Protection Commissioner for their part in the commission of data protection offences by their company.”

The Credit Unions involved in the case have come in for harsh criticism from the DPC. With regard to the Credit Unions, the DPC “notes with disappointment a number of failures on the part of Credit Unions in this case.”

The credit unions concerned are Tullamore, Portlaoise, Portarlington, Athy, Caherdavin in Limerick and St Mary's Park in Limerick.

The Credit Unions involved did not establish what methods the private investigators were using to retrieve the information. In some cases this information – new addresses of individuals – was delivered to the Credit Union within hours of a request being made. The commissioner called this “particularly shocking.”

The ODPC investigation found that “Rather than carrying out due diligence prior to hiring M.C.K.Investigations, the Credit Unions asked no questions, they took the unlawfully obtained personal data and used it, and they commended the success rate of M.C.K. Investigations to their colleagues in the sector.

“Further to a failure to question the source of the information, the Credit Unions were sharing PPS numbers with the investigators. The investigation found that this “is a matter of serious concern and it should not have happened.”

The statement finished with a warning to the Credit Unions that “The Data Protection Commissioner intends to pursue all of these issues further with the Credit Unions concerned and with their representative bodies in the immediate future.”