From the Information Commissioner’s Office comes news that highly respected British retail chain Marks & Spencer has been reprimented for wrongly blaming the Data Protection Act for a customer relations malfunction. What happened was that a Marks & Spencer employee told the mother of a seven year old child that the store staff could not talk to her about the delivery of her son’s Superman suit because it would infringe his data protection rights. While it is right for any organisation to be careful before releasing personal information, this case demonstrates an absence of common sense. In the circumstances it was obvious that the seven year old child would not have ordered the Superman suit himself. Marks & Spencer was not being asked to release any personal information: it was simply being told that a belt was missing from the order.