Decisions
Decisions
Explore summaries and full text of Decisions published by the Data Protection Commission.
Fines Explained
In addition to imposing corrective measures, over €4 billion in fines have been levied against organisations as a result of DPC inquiries. To date, approximately €20 million in fines has been collected.
The law provides that fines imposed by the DPC do not become payable until they are confirmed in Court. If no appeal is made against the DPC’s decision, the DPC must apply to the Circuit Court to confirm the fine under the Data Protection Act 2018.
If an appeal is made against the DPC’s decision, the fine cannot be collected pending that appeal. Such appeals are brought either in the Circuit Court or in the High Court, depending on the monetary value of the fine.
Inquiry into City of Dublin Education and Training Board (CDETB)
This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related to a personal data breach notified by City of Dublin Education and Training Board …
See More InformationInquiry concerning the Department of Social Protection
The Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection’s (DSP) processing of biometric facial templates and the use of associated facial…
See More InformationInquiry into TikTok Technology Limited
On 30 April 2025, the Irish Data Protection Commission (the ‘DPC’) adopted a final decision in an own-volition statutory inquiry, concerning TikTok Technology Limited’s (‘TikTok’) transfers…
See More InformationInquiries into Meta Platforms Ireland Limited (Token Breach)
On 12 December 2024, the Irish Data Protection Commission (‘DPC’) adopted final decisions in two own-volition statutory inquiries reprimanding Meta Platforms Ireland Limited (‘MPIL’) and…
See More InformationInquiry into Sligo County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The inquiry sought to assess…
Article(s): S 79
Inquiry into LinkedIn Ireland Unlimited Company
This Decision concerns an Inquiry by the Data Protection Commission (the DPC) into LinkedIn Ireland Unlimited Company (LinkedIn), a data controller with its main establishment in Ireland…
See More InformationInquiry into Maynooth University
This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related a personal data breach notified by Maynooth University in November 2018. The…
See More InformationInquiry into Meta Platforms Ireland Limited
On 26 September 2024, the Irish Data Protection Commission (DPC) adopted a final decision in an own-volition statutory inquiry, concerning the processing of user passwords on the Facebook…
See More InformationInquiry concerning Mediahuis Ireland Group Limited
The decision in this inquiry relates to a balancing between the fundamental right to data protection and the fundamental right to freedom of expression and information. Summary of Inquiry…
Groupon Ireland Operations Limited
On 8 March 2024, the Data Protection Commission (DPC) adopted a decision following its examination of a complaint received against Groupon Ireland Operations Limited (Groupon). The…
See More InformationInquiry into Apple Distribution International Limited
On 7 March 2024, following an inquiry in relation to a complaint received against Apple Distribution International Limited (Apple), the Data Protection Commission (DPC) adopted a decision…
See More InformationInquiry into Airbnb Ireland UC
On 31 January 2024, following an inquiry concerning a complaint received against Airbnb Ireland UC (Airbnb), the Data Protection Commission (the DPC) adopted a decision. The DPC had…
See More InformationInquiry into Microsoft Ireland Operations Limited
On 15 November 2023, following an inquiry concerning a complaint received against Microsoft Ireland Operations Limited (Microsoft), the Data Protection Commission (DPC) adopted a decision…
See More InformationInquiry into Airbnb Ireland UC - 28 September 2023 (2)
On 28 September 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (“Airbnb”), the Data Protection Commission (“the DPC”) adopted a decision. The DPC had…
See More InformationInquiry into Airbnb Ireland UC - 28 September 2023
On 28 September 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (“Airbnb”), the Data Protection Commission (“the DPC”) adopted a decision. The DPC had…
Article(s): 17
Inquiry into Airbnb Ireland UC
On 14 September 2023, the Data Protection Commission (DPC) adopted a decision in relation to a complaint against Airbnb Ireland UC (Airbnb), which was submitted to the Cypriot DPA, in its…
Article(s): 12
Inquiry into TikTok Technology Limited
The Data Protection Commission (DPC) adopted its final decision regarding its inquiry into TikTok Technology Limited (TTL) on 1 September 2023. This own-volition inquiry sought to examine…
See More InformationInquiry into Galway County Council
This inquiry sought to assess whether Galway County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the…
Article(s): 24
Inquiry into Airbnb Ireland UC
On 20 July 2023, following an inquiry the Data Protection Commission (DPC) adopted a decision to exercise corrective powers on Airbnb Ireland UC (Airbnb). The DPC commenced this inquiry on…
See More InformationInquiry concerning Airbnb Ireland UC
On 21 June 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (Airbnb), the Data Protection Commission (the DPC) adopted a decision. The DPC commenced this…
Article(s): 5
Inquiry concerning the Department of Health
The Data Protection Commission (DPC) has completed an inquiry into certain aspects of the Department of Health’s processing of personal data in 29 litigation files. The inquiry was…
See More InformationInquiry concerning data transfers from the EU/EEA to the US by Meta Platforms Ireland Limited for its Facebook service
This inquiry examined the basis upon which Meta Platforms Ireland Limited (“Meta Ireland”) transfers personal data from the EU/EEA to the US in connection with the delivery of its Facebook…
Article(s): 58
Inquiry into Bank of Ireland 365
The inquiry was commenced after BOI notified the DPC of a series of 10 data breaches relating to the BOI365 banking app. The data breach notifications concerned individuals gaining…
See More InformationInquiry into processing of Church Records by the Archbishop of Dublin
The DPC commenced the Inquiry following receipt of a number of complaints from data subjects who wished to obtain erasure in relation to their personal data processed in church registers…
Article(s): 15
Inquiry into Centric Health Ltd
The DPC commenced the Inquiry following a ransomware attack affecting patient data held on Centric’s patient administration system which was notified to the DPC on 5 December 2019. As a…
See More InformationInquiry into Kildare County Council
This inquiry sought to assess whether Kildare County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the…
See More InformationInquiry into WhatsApp Ireland Ltd
This inquiry relates to the processing carried out by WhatsApp Ireland Limited (“WhatsApp Ireland”) in connection with the delivery of its WhatsApp service, in which the DPC has fined…
See More InformationInquiry into Meta Platforms Ireland Limited
These two inquiries relate to the data processing operations of Meta Platforms Ireland Limited (“Meta Ireland”) in connection with the delivery of its Facebook and Instagram services. (Meta…
See More InformationInquiry into A&G Couriers Limited T/A Fastway Couriers (Ireland)
This inquiry was commenced in respect of a personal data breach that A&G Couriers Limited T/A Fastway Couriers, Ireland (Fastway) notified to the DPC on 4 March 2021. Fastway is a…
Article(s): 32
Inquiry into Virtue Integrated Elder Care Ltd (VIEC)
The inquiry was commenced after VIEC notified a personal data breach to the DPC on 19 August 2020. VIEC operates and manages five nursing homes on the Southside of Dublin and in County…
See More InformationInquiry into An Garda Síochána
This inquiry, conducted under Part 5 of the Data Protection Act 2018, concerned a report by An Garda Síochána to the DPC of a personal data breach, following a data breach at a Garda…
Article(s): S 127
Inquiry concerning Meta Dataset
On 25 November 2022, the Data Protection Commission (the DPC) adopted a decision to impose a fine of €265 million and to exercise other corrective powers on Meta Platforms Ireland Limited …
Article(s): 25
Inquiry into Ark Life Assurance Company dac
This decision arose from an own-volition inquiry commenced by the DPC pursuant to section 110 of the Data Protection Act 2018 to consider whether Ark Life had complied with the GDPR in…
Article(s): 32
Inquiry into Airbnb Ireland UC
On 14 September 2022, following an inquiry the Data Protection Commission (the DPC) adopted a decision to exercise corrective powers on Airbnb Ireland UC (Airbnb). The DPC commenced this…
See More InformationInquiry concerning the processing of personal data relating to child users of the Instagram social networking service
The DPC commenced this own-volition inquiry on 21 September 2020, based both on information provided by a third party, and in connection with processing identified by the DPC itself. The…
See More InformationInquiry into Allianz plc
This decision arose from an own-volition inquiry commenced by the DPC pursuant to section 110 of the Data Protection Act 2018 to consider whether Allianz had complied with the GDPR in…
Article(s): 32
Inquiry into the Pre-Hospital Emergency Care Council
The Data Protection Commission (DPC) commenced this own-volition Inquiry as a result of a monitoring and enforcement exercise carried out pursuant to the tasks of a supervisory authority…
See More InformationDecision concerning Twitter International Company
A complaint was lodged directly with the DPC on 02 July 2019 against Twitter International Company (“Twitter”), and accordingly was handled by the DPC in its role as lead supervisory…
See More InformationInquiry concerning 12 Facebook personal data breaches
The DPC has adopted a decision, imposing a fine of €17 million on Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) (“Meta Platforms”). The decision followed an inquiry by…
See More InformationInquiry into Bank of Ireland Group plc
This inquiry was commenced in respect of 22 personal data breach notifications that Bank of Ireland Group plc (“BOI”) made to the Data Protection Commission (“DPC”) between 9 November 2018…
See More InformationInquiry into Slane Credit Union
This inquiry was commenced in respect of a personal data breach that Slane Credit Union notified to the DPC on 30 November 2018. Slane Credit Union was established on 16 February 1968 as a…
See More InformationInquiry into a Consultancy Provider
This inquiry was commenced in respect of a personal data breach that the Personal Injuries Assessment Board (‘PIAB’) reported to the Data Protection Commission on 10 December 2019. PIAB is…
Article(s): 32
Inquiry into the Personal Injuries Assessment Board
This inquiry was commenced in respect of a personal data breach that the Personal Injuries Assessment Board (‘PIAB’) notified to the DPC on 10 December 2019. PIAB is an independent…
Inquiry into Limerick City and County Council
This inquiry sought to assess whether Limerick City and County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a…
See More InformationInquiry into the Teaching Council
This inquiry was commenced in respect of a personal data breach that the Teaching Council (the Council) notified to the DPC on 9 March 2020. The Council is the professional standards body…
See More InformationInquiry into MOVE (Men Overcoming Violence) Ireland
This inquiry was commenced in respect of a personal data breach that MOVE notified to the DPC on 3 February 2020. MOVE is a registered charity, which works in the area of domestic violence,…
See More InformationDecision concerning WhatsApp Ireland Ltd
This inquiry, which was commenced by the Data Protection Commission (DPC) on 10 December 2018, examined whether WhatsApp Ireland Ltd had discharged its GDPR transparency obligations with…
See More InformationInquiry into the Department of Employment Affairs and Social Protection
The Data Protection Commission (DPC) commenced this own-volition inquiry after it received a complaint from Digital Rights Ireland alleging a “serious interference with the independence of…
See More InformationInquiry into the Irish Credit Bureau DAC
This inquiry was commenced in respect of a personal data breach that the Irish Credit Bureau (‘ICB’) notified to the DPC on 31 August 2018. The ICB is a credit reference agency that…
See More InformationInquiry into University College Dublin
This inquiry was commenced in respect of 7 personal data breaches that University College Dublin (‘UCD’) notified to the DPC between 8 August 2018 to 21 January 2019. The personal data…
See More InformationDecision concerning Groupon International Limited
Acting in its capacity as lead supervisory authority, the DPC commenced an examination of a complaint originally received by the Polish Data Protection Authority. The complaint concerned…
See More InformationInquiry Concerning Twitter International Company (‘TIC’)
This Inquiry, which was commenced by the Data Protection Commission (‘the Commission) on 22 January 2019, examined whether Twitter International Company (‘TIC’) had complied with its…
See More InformationDecision concerning Ryanair DAC
Acting in its capacity as lead supervisory authority, the DPC commenced an examination of a complaint originally received by the U.K. Data Protection Authority. The complaint concerned…
See More InformationInquiry into Waterford City and County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The findings made in the…
Article(s): S 79
Inquiries concerning the Health Service Executive
Date of Decisions: 18 August 2020 & 29 September 2020 The DPC commenced inquiry IN-19-9-1 in respect of one personal data breach notified by the HSE to the DPC. The personal data breach…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of 71 personal data breaches notified by Tusla to the DPC. The decision considered a broad range of Tusla’s processing operations and the findings…
See More InformationInquiry into University College Dublin
This inquiry was commenced in respect of 7 personal data breaches that University College Dublin (‘UCD’) notified to the DPC between 8 August 2018 to 21 January 2019. The personal data…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of one personal data breach notified by Tusla to the DPC. The personal data breach occurred when a social worker for Tusla wrote a safeguarding letter…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of three personal data breaches notified by Tusla to the DPC. All three personal data breaches occurred in circumstances where Tusla failed to redact…
Article(s): 32
Inquiry into Kerry County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The findings made in the…
Inquiry into An Garda Síochána
This inquiry concerned Garda operated CCTV schemes pursuant to Section 38(3)(a) of the Garda Síochána Act 2005. The findings made in the decision include: Findings that An Garda Síochána…
Article(s): S 38