Security of processing, transparency and personal data breaches
have all featured in recent data protection decisions from the Data
Protection Commission (DPC).
Security
When considering personal data breaches the DPC often identifies
inadequacies with respect to the technical and organisational
measures in place and the assessments undertaken by the
controllers.
City of Dublin Education and Training Board (CDETB) - Inquiry
IN-19-7-3
CDETB discovered that personal data including names, birth
dates, PPS numbers and contact information and sensitive personal
data such as health data, was being stored on its webserver. CDETB
also discovered that there was malware present on the server,
presenting the risk that the retained personal data had been
unlawfully disclosed.
