Budget Travel customers’ data stolen
In a letter sent to all individuals affected in recent days Simon Coyle, the liquidator of the now-closed business, confirmed that a series of personal information relating to members of the public has been stolen.
The information, which does not include credit card details, was taken from Budget Travel’s main office in Dublin on February 3 after it had been compiled in the single database.
While the two individuals involved in the incident have been identified by gardaí, the USB stick containing the information has yet to be located.
Among the details contained on the device are the names, addresses, contact details, gender, age and travel record of customers who have used the company in recent years.
The single database had been compiled on the USB stick in order to given to Club Travel Limited, which is the likely purchaser of the information list.
Budget Travel’s appointed liquidator, Simon Coyle of Mazars, said the information on the USB stick was “entirely benign” and posed no threat to personal security.
“The database does not contain any credit card, debit card, bank details, financial information or any sensitive data about any former customers,” he added.
However, while accepting there is unlikely to be a serious threat to the privacy of those on the database, a spokesman for the Data Protection Commissioner said the incident highlighted the need for strict measures over how information is compiled.
“In this case the information was a mailing list, and some additional information. But there is a concern about the information that could have been there.
“We would obviously have preferred if this didn’t happen at all, and once it happened the company did respond in a responsible manner.
“However, the issue for us is that we are informed of about 90 to 100 incidents like this with Irish companies every year and there is a danger there in terms of information about private citizens,” he said.
The stolen Budget Travel information mirrors a number of similar incidents in recent years. In September, 2008 a laptop containing personal details of 1,000 HSE workers was stolen from a senior medical officer, while last June a computer with the personal details of 75,000 Bord Gáis customers was stolen.
At present, private companies are not legally obliged to automatically inform the Data Protection Commissioner if any information is lost or stolen.
However, a working party within the Department of Justice is examining the possibility of making this a mandatory requirement.
* www.dataprotection.ie
