Decisions
Decisions
Explore summaries and full text of Decisions published by the Data Protection Commission.
Fines Explained
In addition to imposing corrective measures, over €4 billion in fines have been levied against organisations as a result of DPC inquiries. To date, approximately €20 million in fines has been collected.
The law provides that fines imposed by the DPC do not become payable until they are confirmed in Court. If no appeal is made against the DPC’s decision, the DPC must apply to the Circuit Court to confirm the fine under the Data Protection Act 2018.
If an appeal is made against the DPC’s decision, the fine cannot be collected pending that appeal. Such appeals are brought either in the Circuit Court or in the High Court, depending on the monetary value of the fine.
Inquiry into City of Dublin Education and Training Board (CDETB)
This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related to a personal data breach notified by City of Dublin Education and Training Board …
See More InformationInquiry concerning the Department of Social Protection
The Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection’s (DSP) processing of biometric facial templates and the use of associated facial…
See More InformationInquiry into Sligo County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The inquiry sought to assess…
Article(s): S 79
Inquiry into Galway County Council
This inquiry sought to assess whether Galway County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the…
Article(s): 24
Inquiry concerning the Department of Health
The Data Protection Commission (DPC) has completed an inquiry into certain aspects of the Department of Health’s processing of personal data in 29 litigation files. The inquiry was…
See More InformationInquiry into Kildare County Council
This inquiry sought to assess whether Kildare County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the…
See More InformationInquiry into the Personal Injuries Assessment Board
This inquiry was commenced in respect of a personal data breach that the Personal Injuries Assessment Board (‘PIAB’) notified to the DPC on 10 December 2019. PIAB is an independent…
Inquiry into Limerick City and County Council
This inquiry sought to assess whether Limerick City and County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a…
See More InformationInquiry into the Teaching Council
This inquiry was commenced in respect of a personal data breach that the Teaching Council (the Council) notified to the DPC on 9 March 2020. The Council is the professional standards body…
See More InformationInquiry into the Department of Employment Affairs and Social Protection
The Data Protection Commission (DPC) commenced this own-volition inquiry after it received a complaint from Digital Rights Ireland alleging a “serious interference with the independence of…
See More InformationInquiry into Waterford City and County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The findings made in the…
Article(s): S 79
Inquiries concerning the Health Service Executive
Date of Decisions: 18 August 2020 & 29 September 2020 The DPC commenced inquiry IN-19-9-1 in respect of one personal data breach notified by the HSE to the DPC. The personal data breach…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of 71 personal data breaches notified by Tusla to the DPC. The decision considered a broad range of Tusla’s processing operations and the findings…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of one personal data breach notified by Tusla to the DPC. The personal data breach occurred when a social worker for Tusla wrote a safeguarding letter…
See More InformationInquiry into Tusla Child and Family Agency
This inquiry was commenced in respect of three personal data breaches notified by Tusla to the DPC. All three personal data breaches occurred in circumstances where Tusla failed to redact…
Article(s): 32
Inquiry into Kerry County Council
This inquiry is one of a number of own-volition inquiries into a broad range of issues pertaining to surveillance technologies deployed by State authorities. The findings made in the…