CASE STUDY 4/97

"Small print" on application forms – inadequate for fair obtaining

The size of the print used by data controllers to inform data subjects how their information might be used was the subject of two cases dealt with in 1997. One concerned a form being used by a financial institution to collect customer information for a new service. The other related to a form issued through a supermarket chain promoting a product. In each case there was a statement explaining that the customer's information might be used for direct marketing, and giving him or her the opportunity to decline such use. However the statements on both forms were printed in very small type whereas the details and purported advantages of the product and the service were presented in a much clearer and more attractive way. My Office cautioned the data controllers in these cases that there was a significant risk of contravening the Act in the course of action they had pursued.

Section 2(1)(a) of the Data Protection Act provides that that "data or, as the case may be, the information constituting the data shall have been obtained ? fairly". In Part 3 of this Report (page 36) I set out in detail the criteria for fair obtaining. It is necessary for the individual to be made aware, clearly and unambiguously, of the purposes for which his or her data are being obtained and the manner in which it is proposed to use and disclose them. I question whether the presentation in "small print" of information which has an important bearing on the information privacy choices of a data subject meets the fair obtaining requirements of the Act. This is especially the case where other information extolling the merits of the product or service on offer uses clear language and striking graphics. I am putting data controllers on notice that such practice, in my view, is unacceptable and in the event of complaints is likely to lead to a finding that the data in question have not been fairly obtained. This in turn may have serious consequences for the data controller concerned, not least being the inability to legally use any personal data obtained in reliance on the small print in question.