GDPR and a Request for a Debtor's File by a Third Party
A bailiff's office receives an email from a man claiming to be the brother of a debtor against whom the bailiff has an enforcement file. He asks for a copy of the entire file, including the debtor's bank details, wage-garnishment records, and correspondence with the creditor. He says the debtor is ill and has authorised him orally. The same day, the creditor's lawyer asks the bailiff to confirm the debtor's current employer and account balances. The bailiff's assistant has already drafted a reply attaching the file. The office processes personal data, keeps files for statutory periods, and has a register of processing activities. No written power of attorney has been provided.
1. Should the bailiff release the file to the brother, and on what basis?
Read the worked answer
No. An oral claim of authorisation is not sufficient to release a file containing bank details, wage-garnishment records, and creditor correspondence. The bailiff is a controller of personal data and must have a lawful basis and adequate verification. The brother is a third party. If the debtor has genuinely authorised him, the bailiff should request written, signed authorisation, verify the brother's identity, and confirm the scope of the authorisation. Even then, the bailiff should disclose only what is necessary for the stated purpose, not the entire file by default.
The assistant's drafted reply must not be sent. The bailiff should record the request, the verification steps taken, and the refusal or deferral. The debtor's illness may justify urgency but does not remove the need for verification. If the debtor is incapacitated, a legal representative's authority should be established. The judgement is proportionality: data minimisation and verification before any disclosure, with a written trail.
2. What should the bailiff tell the creditor's lawyer who asks for the debtor's employer and account balances?
Read the worked answer
The creditor is the party on whose behalf enforcement is conducted, and the bailiff may communicate information necessary for the enforcement. However, the request should be assessed against the purpose. Confirming the employer may be legitimate if it relates to a wage garnishment already instructed or to be instructed. Disclosing account balances is more sensitive and should be limited to what is needed for the enforcement, not provided as a general data dump.
The bailiff should reply in writing, confirming only the information relevant to the instructed enforcement, and should not forward the debtor's full file. The bailiff should check that the creditor's lawyer is authorised for this file. The response should be recorded in the file. If the lawyer asks for information beyond the enforcement purpose, the bailiff should decline and explain the data-minimisation principle. The professional judgement is to serve the creditor's legitimate enforcement interest without turning the bailiff into a source of unrestricted personal data.