Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE)
Data Protection Commission fines HSE €645,000 for data protection failings.
Summary
The Irish Data Protection Commission (DPC) has issued a €645,000 fine to the Health Service Executive (HSE) following an inquiry into data protection failings. The inquiry was triggered by two personal data breaches in October and November 2023, where intruders gained unauthorized access to paper medical records stored in former psychiatric hospitals. The DPC found significant data protection issues related to the physical security and integrity of these stored documents.
Full text
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) National News 03 September 2026 ie Background informationDate of final decision: 28 August 2026National caseLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Communication order personal data breachKey words: GDPR enforcement, Data subjects rights, Fines, Health and researchSummary of the DecisionOrigin of the case This Inquiry commenced on 24 May 2024 as a result of two personal data breaches notified to the Data Protection Commission (DPC) in October 2023 and November 2023.In both cases, individuals gained unauthorised access to paper records stored and retained in both St. Loman’s Hospital (Mullingar, County Westmeath) and St Conal’s Hospital (Letterkenny, County Donegal). Both locations are former disused psychiatric hospitals.Videos uploaded to social media by intruders highlighted that medical records were stored and retained in both facilities.Key FindingsThe Data Protection Commission (DPC) has announced its final decision following an inquiry into the HSE’s processing of personal data contained in paper records, which are stored and retained in the HSE’s external storage facilities. The DPC’s findings identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held within those facilities.DecisionThe DPC issued fines totalling €645 000, a reprimand and made a number of compliance orders. For further information: Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Relevant topics GDPR enforcement Data subject rights Fines Health and research Latest news EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: overview of topics available30 July 2026 EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: save the date23 July 2026 EDPB News EDPB calls for legal basis for cross-regulatory information sharing17 July 2026All news