Cybersecurity Policy Report, Record Storage Practices Lead to Fine for Irish Health Agency, (Sep 2, 2026)
The Irish Data Protection Commission (DPC) has announced a final decision concerning the Irish Health Service Executive’s (HSE) processing of personal data contained in paper records following two personal data breaches in October 2023 and November 2023.
The DPC’s inquiry commenced on May 24, 2024, following notification of the two data breaches at HSE, it noted in a news release. The first breach occurred when individuals gained unauthorized access to paper records stored at St. Loman’s Hospital, a disused psychiatric hospital contaminated with asbestos. The second breach occurred when individuals gained unauthorized access to paper records stored in St. Conal’s Hospital, also a disused psychiatric hospital contaminated with mold.
Once the inquiry began, the DPC carried out 12 site inspections nationwide to “ascertain whether the issues identified in the breach notifications were isolated incidents, or whether the issues were systemic, regarding the retention and storage of personal data contained in paper records, held by the HSE, in its external facilities,” it said.
The DPC found that HSE failed to adequately protect its document storage facilities and the documents within, which were found to have been damaged or destroyed. The DPC explained that the retention of records by HSE in an insecure manner and beyond their retention period gave “rise to an ongoing significant risk of unauthorized access to and disclosure of sensitive medical information by third parties.”
The DPC’s decision found multiple violations of the European Union’s General Data Protection Regulation (GDPR), and HSE was fined 645,000 euros ($747,600). In addition, the DPC imposed a reprimand and issued a number of corrective orders.
News: InternationalLegislation DataBreach DataPrivacy GDPR LitigationEnforcement