CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 16 (2013)

CASE STUDIES 2013 - Data Protection Commissioner - Ireland [2013] IEDPC 16 (2013)

The organisation failed to demonstrate a legitimate purpose for photocopying and retaining passports; did not follow best practice for data security and retention; notification and remedial steps were required under the Acts and Code of Practice.

Citation
[2013] IEDPC 16
Parties
Data Controller: Voluntary organisation involved with young people; Regulator: Irish Data Protection Commission
Jurisdiction
Ireland
Procedural Posture
Data Security Breach Investigation / Concluded
Outcome
Investigation concluded with confirmation of notification to parents and remedial actions.
Legal Topics
Personal Data Security Breach, Retention of Personal Data, Notification of Affected Individuals

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 2 Authorities cited 1 Party arguments 2 Amounts and remedies 2
Sign in to unlock

Parties

Voluntary organisation involved with young people

Data Controller

Irish Data Protection Commission

Regulator

Procedural Posture

Data Security Breach Investigation / Concluded

  1. 1 Loss of photocopies of passports and parental consent forms
  2. 2 Failure to secure personal data
  3. 3 Legitimacy of photocopying passports

Ratio Decidendi

The organisation failed to demonstrate a legitimate purpose for photocopying and retaining passports; did not follow best practice for data security and retention; notification and remedial steps were required under the Acts and Code of Practice.

Court Disposition

Investigation concluded with confirmation of notification to parents and remedial actions.

Orders

  • Organisation to notify affected parents of loss.
  • Organisation to take advice from Department of Foreign Affairs.