DPA case 05/SIU/2018 – €50,000 Fine (Ireland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Ireland's Data Protection Commission fined Kildare County Council €50,000 for not properly handling personal data related to surveillance technologies. The investigation looked into how the council used these technologies and whether they followed the law. This case shows that even local authorities must be careful with personal data.
What happened
Kildare County Council was fined for failing to ensure lawful processing of personal data related to surveillance technologies.
Who was affected
Residents and individuals whose data was collected through the council's surveillance systems.
What the authority found
The Data Protection Commission found that Kildare County Council did not comply with GDPR requirements for processing personal data.
Why this matters
This ruling highlights the importance of accountability for public authorities in handling personal data. Local governments must ensure they are compliant with data protection laws to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
This case involves an own-volition investigation conducted by the Irish DPA (DPC) into Kildare County Council, the controller. In June 2018, Officers from the Special Investigations Unit of the DPC were authorised to conduct a range of inquiries pertaining to surveillance technologies deployed by state authorities, including An Garda Síochána (the national police) and various local authorities, including Kildare County Council. These inquiries sought to determine whether the data processing was lawful, and also to ensure that full accountability measures for the collection and processing of personal data were in place, in advance of further investment in and deployment of newer surveillance technology. The investigation into Kildare County Council focused on the following: the legal basis for surveillance technology employed for the purposes of preventing, investigating, detecting or prosecuting crime; the legal basis for surveillance tech deployed for purposes other than preventing, investigating, detecting, or prosecuting crime; appropriate signage and general transparency; and the question of a joint controller agreement between the council and the national police. Furthermore, the authority sought to examine the security measures for traffic management CCTV; housing department CCTV; and the transmission of CCTV footage to An Garda Síochána. Issuing its final decision, the DPC began by establishing that not all of the processing of personal data in question is regulated by the GDPR. Any processing of personal data for the purposes of prevention, investigation, detection, or prosecution of criminal offences is regulated by the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016L0680 Law Enforcement Directive (LED)] supplemented into Irish law by the [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/html Irish Data Protection Act 2018] (“the 2018 Act”). The other personal data processing at issue here is covered by the GDPR. For further in
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 05/SIU/2018 in IE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 05/SIU/2018 - Ireland (2023). Retrieved from cookiefines.eu
Last updated: