Case Study 17: O2 - Missing media tape [2012] IEDPC 17 (2012)

Case Study 17: O2 - Missing media tape [2012] IEDPC 17 (2012)

O2 was required to notify affected individuals because the missing media tape contained data that was potentially accessible by a third party with sufficient resources, triggering notification obligations under S.I. 336 of 2011. Delay in notification was found unacceptable, and remedial actions were mandated.

Citation
[2012] IEDPC 17
Parties
Data Controller: O2; Service Provider: IBM; Regulator: Irish Data Protection Commission
Jurisdiction
Ireland
Procedural Posture
Data Protection Investigation / Final Determination
Outcome
Breach found; remedial actions agreed without admission of liability
Legal Topics
Data Security Breach, Notification Obligations, Third Party Service Provider Liability, Encryption of Backup Media
Data Protection Telecommunications Law Data Security Breach Notification Obligations Third Party Service Provider Liability Encryption of Backup Media

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 2 Authorities cited 2 Party arguments 2 Amounts and remedies 2
Sign in to unlock

Parties

O2

Data Controller

IBM

Service Provider

Irish Data Protection Commission

Regulator

Procedural Posture

Data Protection Investigation / Final Determination

Legal Issues

  1. 1 Whether O2 complied with notification obligations under S.I. 336 of 2011
  2. 2 Whether the data on the missing media tape was accessible and thus required notification to affected individuals
  3. 3 Adequacy of O2's response and remedial actions

Ratio Decidendi

O2 was required to notify affected individuals because the missing media tape contained data that was potentially accessible by a third party with sufficient resources, triggering notification obligations under S.I. 336 of 2011. Delay in notification was found unacceptable, and remedial actions were mandated.

Court Disposition

Breach found; remedial actions agreed without admission of liability

Orders

  • O2 to make public announcement via website and press release
  • O2 to make charitable donation of €50,000 to Headstrong