City of Dublin Education and Training Board

Summary of the breach SUSI was created in 2012 as a business unit of CDETB. CDETB, through SUSI, operates a website (https://www.susi.ie) on which third-level students can apply, and find information relating to their eligibility, for a higher education grant. The breach, as notified to the DPC, arose due to a combination of two factors. Firstly, CDETB discovered that its webserver was retaining the personal data of student grant applicants who had uploaded information connected to their grant applications through CDETB’s website. Prior to this discovery, CDETB had assumed that personal data being submitted through its website were being emailed to the relevant SUSI team and were not been retained locally. Secondly, CDETB discovered that there was also malware present on the webserver, which presented a risk that the retained personal data had been unlawfully disclosed. The breach impacted approximately 13,000 data subjects, identifiable by email address, who had submitted supplementary forms through the SUSI website during 2017 and 2018. The personal data impacted by the breach included names, surnames, birth dates, PPSNs, contact details, identification data and special categories of data (such as data revealing racial or ethnic origin and health data). The DPC’s inquiry assessed CDETB’s technical and organisational measures for ensuring the security of the personal data that it processed, including whether it had carried out an appropriate risk assessment prior to its implementation of certain additional functionality to its website, and also examined CDETB’s compliance with its obligation to notify the breach to both the DPC and to affected data subjects.