Child and Family Agency Ireland – Court Ruling (Ireland, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Child and Family Agency in Ireland was ordered to pay €7,500 in damages after a data breach revealed sensitive information about a person’s childhood abuse. The court found that the agency's actions caused serious emotional distress and damaged family relationships. This case emphasizes the importance of handling sensitive data with care.
What happened
The Child and Family Agency unlawfully disclosed sensitive data about a person’s childhood abuse to her deceased brother.
Who was affected
A woman whose sensitive data regarding childhood abuse was disclosed, affecting her and her family members.
What the authority found
The court ruled that the agency's breach of data protection rules caused significant distress and awarded the woman €7,500 in damages.
Why this matters
This ruling underscores that organizations must handle sensitive information responsibly, as breaches can have profound emotional impacts. It also shows that courts recognize the need for accountability in such cases.
National Law Articles
The data subject took a civil claim against the controller, here the Child and Family Agency, for unlawfully disclosing her data. The controller had been in possession of sensitive data relating to childhood abuse suffered by the data subject. The controller accepted that it had caused a data breach, which resulted in the data subject’s now deceased brother having access to the information. The brother had been the subject of the report of abuse made by the data subject to the controller. After the report had been disclosed to her brother, her other siblings and family members also found out about the incident. The data subject reported that this caused her extreme distress and resulted in a lack of trust in the controller and further mental health problems. The court found that the data subject’s relationship with her family members had been damaged due to the data breach. The court reiterated that a breach of the GDPR does not automatically warrant damages. The court highlighted that in this case, the data subject had been retraumatised through the actions of the controller. The court classified the data breach as serious in nature and awarded the data subject with damages in the sum of €7,500. In setting this number, the court highlighted the controller’s role in handling sensitive data and the high level trust required.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Child and Family Agency Ireland in IE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Child and Family Agency Ireland - Ireland (2023). Retrieved from cookiefines.eu
Last updated: