Administrative fine of 645,000 euros imposed by the Irish Data Protection Commission for deficiencies regarding the security of documents containing personal data
18 Views
The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the final decision adopted by the Irish Data Protection Commission (DPC) following an inquiry into the processing of personal data contained in paper records stored and retained in the external storage facilities of Ireland’s Health Service Executive (HSE).
The inquiry was initiated on 24 May 2024 following two personal data breaches notified to the DPC in October and November 2023. In both cases, unauthorised individuals gained access to paper records kept in HSE storage facilities. The unauthorised access and the conditions in which the records were stored were also highlighted in videos published on social media.
Following the inquiry, the DPC identified failings concerning the physical conditions of the facilities used by the HSE to store documents, as well as the measures implemented to ensure the integrity and security of documents containing personal data.
In this context, the DPC imposed administrative fines totalling 645,000 euro on the HSE for infringements of Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) of GDPR. The DPC also issued a reprimand and ordered a series of corrective measures to ensure the HSE’s compliance with personal data protection legislation.
The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of controllers to implement appropriate technical and organisational measures to protect personal data throughout the entire storage period, including when records are archived or stored in external facilities.
