Cybersecurity Policy Report, Irish Privacy Office Fines Financial Firm Over Data Security Lapses, (May 8, 2026)
By Tony Foley
The Irish Data Protection Commission (DPC) has announced its final decision following an inquiry into a series of data breaches suffered by personal financial services provider Permanent TSB (PTSB) in 2022.
In today’s announcement of the decision, DPC said the breaches occurred on three separate occasions when threat actors in possession of certain customer information called PTSB’s “Open24 Contact Centre” and posed as customers to gain access to accounts and amend account details. In each case, PTSB failed to follow appropriate security protocols. As a result, the agency said, account holders were exposed to an increased risk of additional fraud, with some suffering financial losses.
In its investigation, the DPC assessed the appropriateness of PTSB’s technical and organizational measures for ensuring the security of personal data processed through the contact center, as well as whether the company notified DPC within the required timeframe mandated by the European Union’s General Data Protection Regulation (GDPR). In its final decision, notified to PTSB last week, DPC found the company did the following:
Infringed on the principle of integrity and confidentiality under GDPR article 5(1)(f) through its failure to adopt appropriate security measures;
Infringed GDPR article 32(1) by failing to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by its processing of personal data within the contact center; and
Infringed GDPR article 33(1) by failing to notify DPC without delay and within 72 hours of becoming aware of the breaches.
The full decision, which will be published by the DPC in due course, included a reprimand and fines against PTSB of 250,000 euros ($294,000) for the violations of GDPR articles 5(1)(f) and 32(1) and 27,500 euros ($32,400) for the violation of GDPR article 33(1).
News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach GDPR