A civil liberties group has raised further concerns with the State’s data privacy watchdog, complaining about An Post’s use of delivery staff to collect data on people’s homes for its GeoDirectory address database business.
The Irish Council for Civil Liberties (ICCL) lodged a complaint with the Data Protection Commission (DPC) earlier this month against GeoDirectory, the joint venture between An Post and Ordnance Survey of Ireland, claiming that it was selling personal information to companies and other clients in breach of the EU's sweeping data protection law, the General Data Protection Regulation (GDPR).
The independent rights group claims that the company was selling data covering social class and family financial status from its database of more than two million households to companies such as Aviva and the credit checker Experian for insurance pricing and credit profiling.
In a follow-up letter sent to the data privacy regulator last week, the ICCL pointed to GeoDirectory statements that An Post delivery staff were being used to conduct inspections of homes across Ireland and that An Post was sharing this information with GeoDirectory.
The ICCL referred to the company’s statements about An Post having “5,600 delivery staff on the ground” and “an intimate knowledge of every village, town and city”.
Debriefed
It also pointed to a GeoDirectory statement about the sourcing of information for its database where An Post’s delivery staff are debriefed every three months for “on-the-ground intelligence”.
It cites a GeoDirectory webinar in which an executive says that inspections by An Post delivery staff may entail “standing in front” of a house and “counting the windows”.
The group tells the commission in its follow-up letter that it was “unclear what happens” to information collected by An Post delivery staff and that An Post refused to say whether its delivery staff reported information about people’s homes when it asked the company.
Olga Cronin, the ICCL's tech and human rights officer, said that it was "really worrying and really troubling" that An Post was using delivery staff to capture data on people's homes.
She described the practice as “deeply inappropriate”.
“It is clear that An Post personnel are being used to collect data about our homes and to feed it back to GeoDirectory and they, in turn, are selling it to organisations for profit but also on the premise that they are going to boost the profits of the people they are selling it to,” she said.
Type of building
Responding to queries from The Irish Times, a spokeswoman for An Post said delivery staff confirm that a new building or development exists, its precise location, whether it is a business or residential premises and the type of building such as a bungalow, apartment or detached property.
She said An Post GeoDirectory does not gather or sell any personal data and that An Post and GeoDirectory “absolutely refute the suggestion of wrongdoing or improper practice as alleged”.
She said the companies would “engage with the Data Protection Commission as required”.
The database company provides “publicly available aggregated information from published public sources such as the census in a format that enables businesses and public bodies to plan for the future, improve efficiencies, facilitate marketing and reduce waste,” she said.
* A spokeswoman for Aviva Insurance Ireland said that it, like many other insurers, uses address and location data from GeoDirectory to identify areas at high risk of flooding.
“Aviva does not license, receive, hold or use any of the GeoDirectory social profiling information outlined in ICCL’s press release,” said the spokeswoman.
A spokesman for the DPC said that it was assessing the ICCL’s complaint.
* This article was amended on 12th May, 2022
