GDPR Enforcement: The Use Of Reprimands By The Data Protection Commission

Supervisory authorities such as the Data Protection Commission can issue a variety of corrective measures to an offending organisation where it determines that a breach of data protection legislation has occurred.

While administrative fines are the landmark corrective measure levied against organisations for serious data protection breaches, DPC decisions have shown that reprimands are a sanction frequently imposed on organisations, but which are not often discussed in detail.

Reprimands under Irish Law

A reprimand is a written statement of disapproval stating that the regulator believes an organisation has not complied with its regulatory obligations. Under data protection legislation, a reprimand serves to formally recognise the serious nature of data protection breaches and to ensure that remedial action is taken.