Resources

Inquiry into the Teaching Council

(IN-20-04-01)

Date of Decision: 2 December 2021

This inquiry was commenced in respect of a personal data breach that the Teaching Council (the Council) notified to the DPC on 9 March 2020. The Council is the professional standards body for the teaching profession and its purpose is to promote and regulate professional standards in teaching.

The personal data breach occurred when a phishing email was accessed by two staff members of the Council, allowing then for the creation of an auto-forward rule from their email accounts to a malicious email account. As a result, between 17 February 2020 and 6 March 2020 when the auto-forward rule was discovered, 323 emails were forwarded to the unauthorised external email address. The emails contained the personal data of 9,735 data subjects and the sensitive personal data of one data subject.

  • The decision found that the Council infringed Article 5(1) and Article 32(1) of the GDPR between 25 May 2018, when the GDPR came into application, and the dates of the personal data breaches, by failing to process personal data in a manner that ensured the appropriate security of the personal data using appropriate technical and organisational measures.
  • The decision found that the Council infringed Article 33(1) of the GDPR by failing to notify the DPC of the personal data breach(es) when it ought to have been aware of them.

The corrective powers exercised:

  • The decision imposed an administrative fine on the Council in the amount of €60,000 in respect of the infringements.
  • The decision issued the Council with a reprimand in respect of the infringements.
  • With due regard to the measures already implemented by the Council since the personal data breach and during the inquiry, a date of 2 June 2022 was given to the Council to bring its processing operations into compliance with Articles 5(1) & 32(1) of the GDPR.

For more information, you can download a copy of the full decision at this link: Inquiry into the Teaching Council December 2021 (PDF, 1,124 KB).