DPC Fines CDETB €125,000 for GDPR Data Breach

The Irish Data Protection Commission (DPC) has issued a final decision imposing a €125,000 fine on the City of Dublin Education and Training Board (CDETB) following an inquiry into a personal data breach that occurred in November 2018. The breach involved the webserver retaining personal data of approximately 13,000 student grant applicants and the discovery of malware. The DPC found CDETB infringed Articles 5(1)(f), 32(1), 32(2), 33(1), and 34(1) of the GDPR for failing to implement appropriate security measures, notify the DPC promptly, and notify affected data subjects.

This decision highlights the critical importance for organisations, particularly public sector bodies, to conduct thorough risk assessments and implement robust technical and organisational measures to ensure data security. Regulated entities must also strictly adhere to their obligations for timely breach notification to both the DPC and affected data subjects. Failure to comply can result in significant financial penalties and reputational damage, as demonstrated by this case and previous DPC sanctions.