Administrative fine of €645,000 imposed by the Irish Data Protection Commission for deficiencies in the security of documents containing personal data

The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the final decision adopted by the Irish Data Protection Commission (DPC) following an investigation into the processing of personal data contained in paper documents stored in the external storage facilities of Ireland’s Health Service Executive (HSE). The investigation was launched on 24 May 2024 following two personal data breach incidents notified to the DPC in October and November 2023. As a result of the investigation, the DPC identified deficiencies in the physical conditions of the facilities used by the HSE to store documents, as well as in the measures adopted to ensure the integrity and security of documents containing personal data. In this context, the DPC imposed administrative fines totaling €645,000 on the HSE for infringements of Article 5 (Principles relating to the processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), and Article 34 (Communication of a personal data breach to the data subject) of the GDPR. The DPC also issued an official reprimand and ordered a series of mandatory measures to ensure the HSE’s compliance with personal data protection legislation. The NCPDP, as the national supervisory authority for personal data processing, emphasizes controllers’ responsibility to implement appropriate technical and organizational measures to protect personal data throughout the entire retention period, including when documents are archived or stored in external facilities.