Enforcement · Data Protection Authority of Ireland EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

MOVE Ireland: Insufficient technical and organisational measures to ensure information security

€1,500 Fine
MOVE Ireland
IRELAND
Art. 5 GDPR Art. 32 GDPR
Data Breaches Security Privacy by Design & Default Personal Data IP Address Processing Agreement Human Resources Processing
Aug 20, 2021 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU

Full text

The Irish DPA (DPC) has fined the organization MOVE (Men Overcoming Violence) EUR 1,500. MOVE is a charity working in the field of domestic violence. The organization aims to support the safety and well-being of women and their children who have experienced violence in relationships. For this purpose, participants (men) come to weekly sessions in order to change their behavior. On February 3, 2021, the organization reported a data breach in accordance with Art. 33 GDPR. The organization stated that eighteen SD cards had been lost, which may have contained recordings of group sessions of the MOVE program, in which participants discuss their behavior and attitudes regarding domestic violence with a group leader. Some of the participants could be seen and heard on the recordings. In addition, the recordings included footage of participants discussing their behaviors and feelings regarding current or former partners, other family members, and friends who may have been named. Approximately 80-120 participants could have been affected by the data breach, as well as at least one group leader per recorded session. The DPC found that MOVE had breached its obligation under Art. 32 (1) GDPR by failing to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing of personal data through the recording of group sessions.

Industry: Individuals and Private Associations

Original document at the source www.dataprotection.ie

Similar Content