Data Protection Commission Publishes Final Decision Following Inquiry into the Children’s Health Ireland (‘CHI’)

The Data Protection Commission (DPC) has announced its final decision following an inquiry into Children’s Health Ireland (CHI) relating to the physical safety and security of children’s health records within one specific CHI facility at Tallaght University Hospital (TUH).

The DPC carried out an unannounced site inspection at the CHI facility on 16 July 2025 following the reporting of protected disclosures to the DPC in June and July 2025. The DPC launched an inquiry on 11 August 2025. 

As part of the protected disclosure process, the DPC also became aware that documents containing both sensitive and special category data of children had been over-flowing, and subsequently removed, from a confidential waste bin. This bin was located beside the door to the Non-Consultant Hospital Doctor’s (NCHD) office at CHI. 

Collectively, these issues highlighted security concerns surrounding the confidentiality of children’s personal data which was stored and retained in paper records in the NCHD office at CHI and the proper management and control of those records.  

As part of the Inquiry, the DPC assessed the following:

• Whether CHI complied with its obligations under the General Data Protection Regulation (‘GDPR’) regarding the confidentiality of paper records stored and retained in the NCHD office at CHI at Tallaght. 
• Whether CHI complied with its obligations under the GDPR regarding the proper management and control of paper records stored and retained in the NCHD office at CHI at Tallaght.  

The main findings of the DPC’s decision, which was notified to CHI at Tallaght on 10 September 2026, are that CHI at Tallaght infringed the principle of security and confidentiality of Article 5(1)(f) GDPR and infringed Article 32(1) GDPR by:

1. Failing to ensure that personal data within the NCHD office were processed in a manner which ensured the appropriate security and confidentiality of that data;
2. Failing to ensure that personal data within the NCHD office and, in addition, the personal data placed within confidential waste bins, were processed in a manner which ensured the proper management and control of that data.

In light of the infringements identified above, the DPC has:

1. Reprimanded CHI at Tallaght;
2. Ordered CHI at Tallaght to bring its processing of personal data into compliance with the GDPR, and in particular into compliance with Articles 5(1)(f) and 32(1) GDPR. The orders imposed by the DPC on CHI at Tallaght include orders requiring CHI at Tallaght to:

• Complete and finalise the draft Data Protection Impact Assessment (‘DPIA’) relating to the Processing of Healthcare records in the NCHD office and to take into account the views and findings of the DPC in this inquiry Decision;
  1. Complete and finalise the draft DPIA relating to Confidential Waste Management and to take into account the views and findings of the DPC in this inquiry Decision;
  2. Fully implement the technical and organisational measures identified in the final DPIAs (as referred to in (a) and (b)). This includes the full implementation of the action items identified in the DPIAs and the embedding and implementation of the Standard Operating Procedures identified in the DPIAs.
  3. Provide the DPC with copies of the finalised DPIAs within four weeks of the date of the Decision issued to CHI at Tallaght to facilitate a consultation process with the DPC. The views and observations of the DPC are to be taken into account by CHI at Tallaght during the implementation process.

The DPC will publish the full decision in due course.