A public utility company disclosed the account information of its customer to a third party without the customer’s consent
The Complaint
The Complainant held two separate service accounts with a public utility company for two premises. The Complainant’s daughter lived in one of the premises.
The Complainant’s daughter made a bill enquiry for her residential address via the public utility company’s hotline. However, the hotline staff disclosed the address of the Complainant’s another premises to her daughter during the telephone conversation. Since the Complainant had not told her daughter about the premises concerned, the Complainant lodged a complaint with the PCPD against the public utility company for disclosing her personal data to her daughter without her consent.
The public utility company provided this Office with the relevant telephone recordings between the hotline staff and the Complainant’s daughter. The recordings revealed that the Complainant’s daughter had told the hotline staff that her enquiry concerned the service account held by the Complainant. The hotline staff then promoted the e-Bill service to the Complainant’s daughter and she accepted the offer. The hotline staff proceeded to ask whether the e-Bill service would be applicable to another service account held by the Complainant and read out the address of that service account.
Outcome
In view of the fact the Complainant’s daughter had explicitly informed the hotline staff that she was not the account holder and that her enquiry concerned her residential address only, the hotline staff should not disclose the address of another service account without the Complainant’s consent, thus such disclosure violated DPP3.
The public utility company explained that it was an isolated incident and it had already gave written guidelines and verbal instructions to its staff members, requiring them not to disclose to the enquirer who was not the account holder any information unrelated to the enquiry.
(Uploaded in March 2019)