Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Data Protection Commission Fines HSE EUR 645,000 for Personal Data Breaches in Paper Records

The Data Protection Commission (DPC) announced a final decision on 2 September 2026, fining the Health Service Executive (HSE) a total of EUR 645,000 following an inquiry into its processing of personal data in paper records. This inquiry commenced on 24 May 2024 after two personal data breaches were notified in October and November 2023. The DPC also issued a reprimand and several corrective orders to the HSE.

The DPC found the HSE infringed Article 5(1)(f) GDPR and Article 32(1) GDPR by failing to ensure appropriate security and implement proper technical and organisational measures, resulting in a EUR 300,000 fine. Further infringements included Article 5(1)(e) GDPR for failing to adhere to storage limitation principles, retaining personal data longer than necessary, which also incurred a EUR 300,000 fine. The HSE also infringed Article 33(1) GDPR by failing to notify breaches without undue delay, leading to a EUR 30,000 fine, and Article 34(1) GDPR for failing to communicate breaches to data subjects, resulting in a EUR 15,000 fine.

Authorised officers conducted 12 site inspections nationwide, observing documents damaged by mould, contaminated by animal droppings, and stored in profound disarray in disused bathrooms, cubicles, and derelict buildings. As part of its corrective orders, the DPC requires the HSE to carry out a complete audit of all storage facilities to implement a robust management system for recording and tracing all personal data and to ensure immediate and safe destruction of unnecessary records. The DPC considered previous similar infringements by the HSE as an aggravating factor in its fine calculation.

The persistent challenge of managing legacy paper records in large public sector organisations frequently leads to compliance failures under GDPR, particularly concerning storage and security.

General Data Protection Regulation (GDPR)

Who this binds
Public sector bodies and other organisations processing personal data in paper records are bound by the Data Protection Commission's expectations regarding secure storage and retention.
What changed
The Data Protection Commission's decision on 2 September 2026 clarified that organisations must implement robust management systems for paper records, including regular audits and secure destruction, to comply with Articles 5(1)(e), 5(1)(f), 32(1), 33(1), and 34(1) GDPR.
What to check
Organisations should review their paper record management policies and conduct audits of all storage facilities to ensure compliance with GDPR principles and notification requirements.
What this does not mean
This decision does not mean that all paper records must be digitised immediately, but rather that their physical storage and management must meet GDPR security and retention standards.

Not settled: The Data Protection Commission will publish the full decision in due course, which may provide additional detailed guidance.

Send this to your team

The Data Protection Commission fined the Health Service Executive EUR 645,000 and issued corrective orders for systemic failings in the secure storage and retention of paper personal data records, impacting all organisations handling similar data.

Today's question

A social media platform operating in the EU reports 50 million average monthly users. Under the Digital Services Act, what is the primary additional obligation it must fulfill?

  1. Obtain explicit consent for all data processing activities from each user.
  2. Assess and mitigate systemic risks stemming from its service and algorithmic systems.
  3. Appoint a dedicated Data Protection Officer (DPO) for its EU operations.
  4. Implement a full ban on targeted advertising for all users within the EU.

Answer this question on the site

Worth knowing

  1. Meta Settlement with 29 States Approved by Court Over Harms to Children and Teens

    Privacy counsel should review their platforms' features and disclosures, especially those targeting minors, to ensure compliance with COPPA and state consumer protection laws following this significant Meta settlement.

  2. FulcrumSec Claims Responsibility for Manchester Airport Group Breach

    Privacy professionals should care because this incident involving Manchester Airport Group highlights the severe impact of large scale data exfiltration by threat actors on customer personal identifiable information.

  3. Baylor Genetics: ePHI of 2.8M Patients Exposed in Cybersecurity Incident

    Privacy professionals in the healthcare sector should care about the Baylor Genetics breach as it demonstrates the significant patient population impacted by electronic protected health information compromises within genetic testing organisations.

  4. The Hugging Face hack could indicate cultural issues at OpenAI

    Privacy professionals involved in AI governance should note this analysis of the Hugging Face hack as it signals potential cultural challenges within AI development organisations like OpenAI regarding the prioritisation of safety and security protocols.

  5. Texas and Florida Step Back from ALPRs

    Privacy professionals should care about the policy shifts in Texas and Florida regarding ALPRs, as they indicate a potential re evaluation of mass surveillance technologies and their impact on individual privacy rights.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.