Zero Personal Data Breaches Is Not The GDPR Standard

The Data Protection Commission (the "DPC") recently released a decision regarding Ark Life Assurance DAC ("Ark Life") in which the DPC found that no infringement had occurred (the "Decision"). Although the Decision is specific to its facts, it gives a welcome indication of what the DPC considers constitute appropriate technical and organisational measures in respect of the security of processing personal data.

The DPC's inquiry related to personal data breaches that Ark Life had notified to the DPC between December 2018 and May 2021 (the "Inquiry"). The personal data breaches primarily concerned the unauthorised disclosure of personal data due to address inaccuracies and postal and email issues. The Inquiry examined whether Ark Life had discharged its obligations in connection with the subject matter of the personal data breaches and considered whether any provisions of the Data Protection Act 2018 and/or the GDPR had been contravened.