- Enforcing jurisdiction
- Ireland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Health Service Executive – €65,000 Fine (Ireland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Health Service Executive (HSE) was fined for a data breach where personal information of 78 individuals was improperly disposed of. This incident occurred when sensitive documents were found in a public recycling center. It underscores the importance of secure data handling and disposal practices.
What happened
HSE disposed of documents containing personal data in a public recycling center, leading to a data breach.
Who was affected
78 individuals whose personal data was included in the improperly disposed documents.
What the authority found
The authority found that HSE failed to implement adequate security measures for handling personal data.
Why this matters
This ruling highlights the critical need for organizations to ensure secure disposal of personal data to protect individuals' privacy.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 3 April 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Irish Data Protection Commission (DPC) commenced inquiry IN-19-9-1 in respect of one personal data breach notified by the HSE to the DPC. The personal data breach occurred when documentation containing the personal data of 78 individuals, including special category personal data in respect of 6 of those data subjects, were disposed of in a public recycling centre. The list was created in Cork University Maternity Hospital, but was discovered by a member of the public in a public recycling area in Cork County.One personal data breach has been notified by the HSE to the DPC. The personal data breach occurred when documentation containing the personal data of 78 individuals, including special category personal data in respect of 6 of those data subjects, were disposed of in a public recycling centre. The list was created in Cork University Maternity Hospital, but was discovered by a member of the public in a public recycling area in Cork County. The decision found that the HSE infringed Articles 5(1)(f) and 32(1) of the GDPR by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by its use and disposal of hardcopy documents containing patients’ personal data.
Related Enforcement Actions (0)
No other enforcement actions found for Health Service Executive in IE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Health Service Executive - Ireland (2020). Retrieved from cookiefines.eu
Last updated: