Bank of Ireland Group plc

Introduction ........................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ............................................................... 3 i. Legal Basis for the Inquiry ................................................................................................... 3 ii. Legal Basis for the Decision ................................................................................................ 3 3. Findings of Fact ...................................................................................................................... 4 4. Scope of the Inquiry ............................................................................................................... 5 5. Issues for Determination ....................................................................................................... 5 6. Preliminary Issue: Article 4(12) of the GDPR ......................................................................... 5 7. Issue 1: Article 33 of the GDPR ............................................................................................ 17 8. Issue 2: Article 34 of the GDPR ............................................................................................ 26 9. Issue 3: Article 32 of the GDPR ............................................................................................ 39 10. Decision on Corrective Powers .......................................................................................... 46 A. Reprimand ........................................................................................................................ 46 B. Order ................................................................................................................................ 48 C. Administrative Fine .......................................................................................................... 49 i. Decision to Impose Administrative Fines .......................................................................... 57 ii. Total Value of the Administrative Fine ............................................................................. 60 11. Right of Appeal ................................................................................................................... 61 Appendix: Schedule of Materials Considered for the Purposes of this Decision .................... 63 3 1. Introduction 1.1 This document is a decision (the “Decision” or the “Final Decision”) made by the Data Protection Commission (the “DPC”) in accordance with section 111 of the Data Protection Act 2018 (the “2018 Act”). I make this Decision having considered the information obtained in the separate own volition Inquiry (the “Inquiry”) conducted by authorised officers of the DPC pursuant to section 110 of the 2018 Act (the “Case Officers”). The Case Officers provided Bank of Ireland Group plc (“BOI”, the “data controller” or the “controller”) with the Draft Inquiry Report and the Final Inquiry Report. 1.