Enforcement · Data Protection Authority of Ireland EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Irish Departement of Health: Non-compliance with general data processing principles

€22,500 Fine
Irish Departement of Health
IRELAND
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR
Healthcare IP Address Personal Data Processing Agreement Education Processing Law Enforcement Supervisory Authorities
Jun 16, 2023 Source

How it connects

Related across sources

News Hervorming van de privacywetgeving in het Verenigd Koninkrijk: Hoe de GDPR van het VK mogelijk zal veranderen. Hogan Lovells News UK data protection reform: How the UK's GDPR may change Hogan Lovells Guidance Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review

Full text

The Irish DPA (DPC) has fined the Irish Department of Health EUR 22,500. The DPA launched an investigation into the department following public allegations that the department unlawfully processed personal data from claimants and their families in the context of litigation over special educational needs. The DPC found that the departement had obtained information from the Health Service Executive (HSE) about services that the plaintiffs and their families had received. They had also been asked broad questions that led to the disclosure of sensitive private information. The data was collected to determine whether a settlement could be pursued with the plaintiff. The DPC concluded that the collection of information about the social services provided was lawful. However, the questions that led to the disclosure of the sensitive information were excessive and, according to the DPC, not necessary for the purposes of the litigation. According to the DPC, this violated the principle of data minimization.

Industry: Health Care

Original document at the source www.dataprotection.ie

Similar Content