Background information

• Date of final decision: 28 August 2026
• National case
• Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject)
• Decision: Administrative fine, Compliance order, Communication order personal data breach
• Key words: GDPR enforcement, Data subjects rights, Fines, Health and research

Summary of the Decision

Origin of the case  

This Inquiry commenced on 24 May 2024 as a result of two personal data breaches notified to the Data Protection Commission (DPC) in October 2023 and November 2023.

In both cases, individuals gained unauthorised access to paper records stored and retained in both St. Loman’s Hospital (Mullingar, County Westmeath) and St Conal’s Hospital (Letterkenny, County Donegal). Both locations are former disused psychiatric hospitals.Videos uploaded to social media by intruders highlighted that medical records were stored and retained in both facilities.

Key Findings

The Data Protection Commission (DPC) has announced its final decision following an inquiry into the HSE’s processing of personal data contained in paper records, which are stored and retained in the HSE’s external storage facilities. The DPC’s findings identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held within those facilities.

Decision

The DPC issued fines totalling €645 000, a reprimand and made a number of compliance orders. 

For further information: Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE)