The complainant borrowed money from a finance company but then defaulted on her repayments. She subsequently received a letter from a debt collection agency assigned by the finance company and found that a photocopy of her identity card was pasted on the envelope. The complainant alleged that the debt collection agency disclosed her personal details to others by putting the copy of her identity card on the envelope.
The Commissioner's views on the matter
The PCPD concluded that the finance company had acted in contravention of the requirements of DPP3 because it had passed a copy of the complainant's identity card to the debt collection agency without the consent of the complainant. The use of a debtor's personal data for a purpose of recovering payments on which the debtor had defaulted would be a directly related purpose to the purpose of providing the loan. However, the finance company should confine its disclosure to those data that are sufficient to fulfil the purpose, e.g. the debtor's name, address and identity card number would be sufficient to identify the debtor. On the advice of the PCPD, the finance company apologised to the complainant for the act done and undertook to cease using copies of debtor's identity cards for the purpose of debt recovery. A warning notice was issued to the finance company.
DPP3 provides that personal data shall not, without the prescribed consent of the individual, be used for any purpose other than the purpose for which the data were to be used at the time of the collection of the data or a directly related purpose. For the purpose of recovery of defaulted payment, personal data disclosed to a debt collector should be limited to those data which are sufficient to fulfill the purpose. The collection of a copy of an identity card is generally not considered necessary for the purpose of debt collection. Hence, it should not be transferred to a debt collector for this purpose.