- Enforcing jurisdiction
- Ireland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case IN-20-4-7 – No Violation (Ireland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Personal Injuries Assessment Board lost a USB key containing personal data, but the Data Protection Commission found no violation. They determined that the board had taken reasonable steps to protect the data. This case shows that organizations can be held accountable for data security, but they can also be cleared if they follow proper procedures.
What happened
A USB key with personal data was lost in the post after being sent unencrypted.
Who was affected
The Personal Injuries Assessment Board and the individuals whose data was on the lost USB key.
What the authority found
The Data Protection Commission found that the board had not violated data protection rules because they had requested the third party not to send personal data.
Why this matters
This case underscores the importance of data security measures and that organizations can be held accountable if they take reasonable precautions.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is the Personal Injuries Assessment Board (PIAB), an independent statutory body that deals with personal injury claims. The personal data breach occurred when a third party organisation contracted by the PIAB returned materials containing personal data to the PIAB on an unencrypted USB key in a paper envelope. That USB key was ultimately lost in the post with only a ripped envelope delivered to the PIAB. The inquiry considered whether the PIAB had complied with its obligation to implement an appropriate level of security under Article 32 GDPR. The inquiry established that the PIAB had requested in advance that the third party not send personal data to the PIAB. In those circumstances, the DPC found that the PIAB could not possibly have foreseen that without consultation, the third party would post an unencrypted USB storage device in an unpadded envelope by ordinary (not registered) post.
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case IN-20-4-7 in IE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case IN-20-4-7 - Ireland (2022). Retrieved from cookiefines.eu
Last updated: