CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 14 (2013)

Loyaltybuild Ltd. and associated data controllers failed to comply with statutory and contractual data protection obligations, necessitating enforcement action and remedial measures to protect affected individuals.

Citation: [2013] IEDPC 14
Parties: Data Processor: Loyaltybuild Ltd.; Data Controllers: Unnamed Data Controllers; Regulator: Irish Data Protection Commissioner
Jurisdiction: Ireland
Procedural Posture: Data Protection Investigation / Post Breach Enforcement and Compliance Review
Outcome: Enforcement Notices issued; remedial actions required and verified; processing recommenced after compliance.
Legal Topics: Data Security Breach, Data Processor Obligations, Data Controller Responsibilities, PCI DSS Compliance, Contractual Data Protection Requirements

Data Protection Privacy Law Data Security Breach Data Processor Obligations Data Controller Responsibilities PCI DSS Compliance Contractual Data Protection Requirements

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 2 Authorities cited 2 Party arguments 2 Amounts and remedies 1

Parties

Loyaltybuild Ltd.

Data Processor

Unnamed Data Controllers

Data Controllers

Irish Data Protection Commissioner

Regulator

Procedural Posture

Data Protection Investigation / Post Breach Enforcement and Compliance Review

Legal Issues

1 failure to implement adequate security measures
2 failure to implement proper data management procedures
3 lack of data retention policy

Ratio Decidendi

Court Disposition

Enforcement Notices issued; remedial actions required and verified; processing recommenced after compliance.

Orders

Loyaltybuild Ltd. to notify clients and affected individuals.
Loyaltybuild Ltd. to delete all personal data held for clients.