Decisions
Decisions
Explore summaries and full text of Decisions published by the Data Protection Commission.
Fines Explained
In addition to imposing corrective measures, over €4 billion in fines have been levied against organisations as a result of DPC inquiries. To date, approximately €20 million in fines has been collected.
The law provides that fines imposed by the DPC do not become payable until they are confirmed in Court. If no appeal is made against the DPC’s decision, the DPC must apply to the Circuit Court to confirm the fine under the Data Protection Act 2018.
If an appeal is made against the DPC’s decision, the fine cannot be collected pending that appeal. Such appeals are brought either in the Circuit Court or in the High Court, depending on the monetary value of the fine.
Inquiry into City of Dublin Education and Training Board (CDETB)
This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related to a personal data breach notified by City of Dublin Education and Training Board …
See More InformationInquiry concerning the Department of Social Protection
The Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection’s (DSP) processing of biometric facial templates and the use of associated facial…
See More InformationInquiry into Maynooth University
This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related a personal data breach notified by Maynooth University in November 2018. The…
See More InformationInquiry into LinkedIn Ireland Unlimited Company
This Decision concerns an Inquiry by the Data Protection Commission (the DPC) into LinkedIn Ireland Unlimited Company (LinkedIn), a data controller with its main establishment in Ireland…
See More InformationInquiry into Meta Platforms Ireland Limited
On 26 September 2024, the Irish Data Protection Commission (DPC) adopted a final decision in an own-volition statutory inquiry, concerning the processing of user passwords on the Facebook…
See More InformationGroupon Ireland Operations Limited
On 8 March 2024, the Data Protection Commission (DPC) adopted a decision following its examination of a complaint received against Groupon Ireland Operations Limited (Groupon). The…
See More InformationInquiry into Airbnb Ireland UC
On 31 January 2024, following an inquiry concerning a complaint received against Airbnb Ireland UC (Airbnb), the Data Protection Commission (the DPC) adopted a decision. The DPC had…
See More InformationInquiry into Airbnb Ireland UC - 28 September 2023 (2)
On 28 September 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (“Airbnb”), the Data Protection Commission (“the DPC”) adopted a decision. The DPC had…
See More InformationInquiry into TikTok Technology Limited
The Data Protection Commission (DPC) adopted its final decision regarding its inquiry into TikTok Technology Limited (TTL) on 1 September 2023. This own-volition inquiry sought to examine…
See More InformationInquiry into Airbnb Ireland UC
On 20 July 2023, following an inquiry the Data Protection Commission (DPC) adopted a decision to exercise corrective powers on Airbnb Ireland UC (Airbnb). The DPC commenced this inquiry on…
See More InformationInquiry concerning Airbnb Ireland UC
On 21 June 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (Airbnb), the Data Protection Commission (the DPC) adopted a decision. The DPC commenced this…
Article(s): 5
Inquiry into Bank of Ireland 365
The inquiry was commenced after BOI notified the DPC of a series of 10 data breaches relating to the BOI365 banking app. The data breach notifications concerned individuals gaining…
See More InformationInquiry into Kildare County Council
This inquiry sought to assess whether Kildare County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the…
See More InformationInquiry into Meta Platforms Ireland Limited
These two inquiries relate to the data processing operations of Meta Platforms Ireland Limited (“Meta Ireland”) in connection with the delivery of its Facebook and Instagram services. (Meta…
See More InformationInquiry into Virtue Integrated Elder Care Ltd (VIEC)
The inquiry was commenced after VIEC notified a personal data breach to the DPC on 19 August 2020. VIEC operates and manages five nursing homes on the Southside of Dublin and in County…
See More InformationInquiry into Airbnb Ireland UC
On 14 September 2022, following an inquiry the Data Protection Commission (the DPC) adopted a decision to exercise corrective powers on Airbnb Ireland UC (Airbnb). The DPC commenced this…
See More InformationInquiry concerning the processing of personal data relating to child users of the Instagram social networking service
The DPC commenced this own-volition inquiry on 21 September 2020, based both on information provided by a third party, and in connection with processing identified by the DPC itself. The…
See More InformationDecision concerning Twitter International Company
A complaint was lodged directly with the DPC on 02 July 2019 against Twitter International Company (“Twitter”), and accordingly was handled by the DPC in its role as lead supervisory…
See More InformationInquiry concerning 12 Facebook personal data breaches
The DPC has adopted a decision, imposing a fine of €17 million on Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) (“Meta Platforms”). The decision followed an inquiry by…
See More InformationInquiry into Slane Credit Union
This inquiry was commenced in respect of a personal data breach that Slane Credit Union notified to the DPC on 30 November 2018. Slane Credit Union was established on 16 February 1968 as a…
See More InformationInquiry into the Teaching Council
This inquiry was commenced in respect of a personal data breach that the Teaching Council (the Council) notified to the DPC on 9 March 2020. The Council is the professional standards body…
See More InformationInquiry into MOVE (Men Overcoming Violence) Ireland
This inquiry was commenced in respect of a personal data breach that MOVE notified to the DPC on 3 February 2020. MOVE is a registered charity, which works in the area of domestic violence,…
See More InformationDecision concerning WhatsApp Ireland Ltd
This inquiry, which was commenced by the Data Protection Commission (DPC) on 10 December 2018, examined whether WhatsApp Ireland Ltd had discharged its GDPR transparency obligations with…
See More InformationInquiry into the Irish Credit Bureau DAC
This inquiry was commenced in respect of a personal data breach that the Irish Credit Bureau (‘ICB’) notified to the DPC on 31 August 2018. The ICB is a credit reference agency that…
See More InformationInquiry into University College Dublin
This inquiry was commenced in respect of 7 personal data breaches that University College Dublin (‘UCD’) notified to the DPC between 8 August 2018 to 21 January 2019. The personal data…
See More InformationDecision concerning Groupon International Limited
Acting in its capacity as lead supervisory authority, the DPC commenced an examination of a complaint originally received by the Polish Data Protection Authority. The complaint concerned…
See More InformationInquiries concerning the Health Service Executive
Date of Decisions: 18 August 2020 & 29 September 2020 The DPC commenced inquiry IN-19-9-1 in respect of one personal data breach notified by the HSE to the DPC. The personal data breach…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of 71 personal data breaches notified by Tusla to the DPC. The decision considered a broad range of Tusla’s processing operations and the findings…
See More InformationInquiry into University College Dublin
This inquiry was commenced in respect of 7 personal data breaches that University College Dublin (‘UCD’) notified to the DPC between 8 August 2018 to 21 January 2019. The personal data…
See More Information