Inquiry into Slane Credit Union

(IN-19-7-5)

Date of Decision: 26 January 2022

This inquiry was commenced in respect of a personal data breach that Slane Credit Union notified to the DPC on 30 November 2018. Slane Credit Union was established on 16 February 1968 as a member of the Irish League of Credit Unions. It is regulated by the Central Bank of Ireland under section 84 of the Credit Union Act 1997. The personal data breach related to an unauthorised disclosure of personal data in the form of an unintended publication of member data on the internet. Certain board reports relating to membership enquiries stored within the Slane Credit Union website inadvertently became publicly available through search engine results for a period in 2018. According to Slane Credit Union, this incident occurred due to an update to a search engine optimisation tool installed on the website that Slane Credit Union had not anticipated.

The decision found infringements of the following provisions of the GDPR:

• Article 5(1)(f) and 32(1) were infringed by Slane Credit Union by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by its processing of the personal data of its members;
• Article 24 and 30(1) were infringed by Slane Credit Union by failing to implement organisational measures that took account of the nature, scope, context and purposes of its processing, and by failing to include all appropriate information in its record of processing; and
• Article 28(1) and (3) were infringed by Slane Credit Union by failing to conduct due diligence on its processor and by failing to put in place an agreement with its processor that met the requirements of Article 28(3) of the GDPR.

The corrective powers exercised:

• The decision imposed an administrative fine on Slane Credit Union in the amount of €5,000 in respect of the infringement of Article 5(1)(f) of the GDPR (principle of security of processing).
• The decision issued Slane Credit Union with a reprimand in respect of all of the infringements.

For more information, you can download a copy of the full decision at this link: Slane Credit Union January 2022 (PDF, 898 KB).