If third parties are commissioned to conduct voluntary surveys, the passing on of information for carrying out the surveys must comply with the principle of reasonableness, i.e. only such data may be passed on as is actually necessary for the conduct of the survey. The person commissioning the survey must first establish who precisely wishes to take part. The passing on of an entire address list is unreasonable.
It is increasingly common in practice for external research institutes to be called in to carry out surveys. Accordingly, one insurance company last year commissioned an institute to conduct a survey of its policy holders. To do so, it gave the institute the address of a large number of its policy holders as well as the names of the doctors treating them.
Many of the policyholders who were contacted were highly surprised to receive mail from an institute that was unknown to them and that contained sensitive information, and in particular the name of their doctor. As a consequence, they made complaints to us.
The general principles on the handing over of data contained in the Data Protection Act - such as the principle of good faith, the principle of reasonableness, and the requirement that there is a specific objective in mind - always apply even when a third party is legally authorised to make use of the data. The participation in surveys is normally voluntary. The selected policy holders must also - before their data is handed over - have the opportunity to refuse to take part and thus to have their data passed on. The insurance company should therefore have asked the policy holders it had selected whether they actually wanted to take part in the survey and whether they we agreeable to having the data required for the survey passed on to the institute. In this particular case, the data not only included the addresses that were involved, but a particularly sensitive piece of information, namely the identity of the doctors who were treating the policy holders, knowledge of which could allow certain conclusions to be drawn, for example, if a person was undergoing treatment from a specialist (psychiatrist, oncologist, etc.). The voluntary nature of the survey must of course be made clear in express terms when obtaining consent and also on the questionnaire itself. If the insurance company had done this, the institute would have received only the data relating to those policyholders who were prepared to participate in the survey. Thereafter only those consenting policyholders would have been written to.
A simple method of obtaining the consent of those affected by such surveys and of complying with the principle of reasonableness is for the insurance companies themselves to send out the questionnaire, at the same time providing the policyholders with detailed information on the survey objectives and procedures and instructing them to return the complete questionnaires directly to the institute, where the data can be evaluated with the safeguard of anonymity.
[July 2005]