The Irish authority issues a sanction following an investigation into the Health Service Executive regarding data protection breaches
The Irish Data Protection Commission (DPC) has issued its final decision against the Health Service Executive (HSE) following an investigation into breaches related to the security of medical records on paper.
The investigation, initiated on 24 May 2024, followed two data breach notifications from October and November 2023. These concerned unauthorized access to paper medical records stored in two former psychiatric hospitals, St. Loman Hospital and St Conal Hospital, whose presence was revealed by videos shared on social media. The DPC identified breaches of Article 5, Article 32, Article 33 and Article 34 of the GDPR, related to the physical storage conditions of the documents and the integrity of the information they contained. By its decision of 28 August 2026, the authority issued a reprimand, compliance orders, and fines amounting to €645,000.
The investigation, initiated on 24 May 2024, followed two data breach notifications from October and November 2023. These concerned unauthorized access to paper medical records stored in two former psychiatric hospitals, St. Loman Hospital and St Conal Hospital, whose presence was revealed by videos shared on social media. The DPC identified breaches of Article 5, Article 32, Article 33 and Article 34 of the GDPR, related to the physical storage conditions of the documents and the integrity of the information they contained. By its decision of 28 August 2026, the authority issued a reprimand, compliance orders, and fines amounting to €645,000.
Informations complémentaires
L’analyse complète est réservée aux membres
Montant de la sanction, thèmes, secteurs, entités et données concernées : l’essai gratuit de 14 jours ouvre la fiche entière et la veille personnalisée.
Essayer gratuitement 14 jours · accès complet · sans carte bancaire