A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Download PDF Print page
Published 29 abril 2022
The Data Protection Commission recently announced its decision to fine Bank of Ireland (“BOI”) €463,000 for a number of breaches of the General Data Protection Regulation (“GDPR”).
The DPC’s announcement came following an inquiry by the regulator into 22 data breach notifications made by BOI between November 2018 and June 2019. The DPC found that 19 of the breaches met the definition of a personal data breach. One such breach affected approximately 47,000 data subjects, even though BOI’s initial notification said only one individual was affected. The notifications related to corruption of personal data in BOI’s data feed to the Central Credit Register (“CCR”), a centralised system managed by the Central Bank of Ireland, which collects and stores information about loans. The incidents included unauthorised disclosure by BOI of customer data to the CCR and accidental alteration of certain customer data stored on the CCR – such alterations may have damaged customers’ credit ratings and prevented them getting loans.
Ultimately, the DPC’s inquiry found that BOI breached a number of provisions of the GDPR, including:
In response to the DPC’s decision, BOI said that it “fully acknowledges” and “sincerely apologises” for the breaches and advised that it has taken measures to improve its ongoing CCR reporting. Pursuant to section 143 of the Data Protection Act 2018 (as amended) where an organisation does not appeal the DPC’s decision within 28 days, the DPC must apply to the Circuit Court to affirm its decision.
The decision to fine BOI follows the release of the DPC’s annual report in February 2022 which outlined that the regulator had, as at 31 December 2021, 81 statutory inquiries on hand. Therefore, it is likely we will see more fines being handed down by the DPC as the year progresses.
To see a summary of the DPC’s BOI decision, click here.
Dublin
+353 (0)123 19669
+353 (0)1 2319679
By Darryn Hale, David Hill, Sophie Devlin
By Jade Kowalski, Charlotte Halford
By Johanna Lipponen, Rebecca Morgan
By Hans Allnutt, Patrick Hill, Eleanor Ludlam
By Pavan Trivedi, Charlotte Halford
By Eleanor Ludlam, Astrid Hardy
By Eleanor Ludlam, Pavan Trivedi
By Charlotte Halford, Johanna Lipponen
By Eleanor Ludlam, Charlotte Halford, Pavan Trivedi
By Hans Allnutt, Alexander Dimitrov
By Hans Allnutt, Tom Evans
By Eleanor Ludlam, Camilla Elliot
By Eleanor Ludlam, Sonali Malhotra
By Brett Randles, Annabel Walker
By Hans Allnutt, Florence Clissitt
By Justin Tivey, Charlotte Muzabazi
By Alex Stovold, Tom Evans
By Eleanor Ludlam, Alexander Dimitrov
By Eleanor Ludlam, Jonathan Hopkins