Health Service Executive

Introduction .................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................... 3 ii. Data Controller ............................................................................................................................ 4 iii. Legal Basis for the Decision ......................................................................................................... 4 3. Factual Background ......................................................................................................................... 4 4. Scope of the Inquiry and the Application of the GDPR ................................................................... 6 5. Analysis and Findings ...................................................................................................................... 8 i. Assessing Risk .............................................................................................................................. 9 ii. Security Measures Implemented by the HSE ............................................................................ 12 iii. The Appropriate Level of Security............................................................................................. 15 iv. Finding ....................................................................................................................................... 18 6. Corrective Powers ......................................................................................................................... 18 A. Order to Bring Processing into Compliance .............................................................................. 18 B. Reprimand ................................................................................................................................. 19 C. Administrative Fine ................................................................................................................... 20 i. Decision to Impose an Administrative Fine .......................................................................... 20 ii. The Same or Linked Processing Operations .......................................................................... 26 iii. The Permitted Range ............................................................................................................ 26 iv. Calculating the Administrative Fine ...................................................................................... 28 7. Right of Appeal .............................................................................................................................. 29 Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 30 3 1. Introduction 1.1 This document (“the Decision”) is the decision made by the Data Protection Commission (“the DPC”) in accordance with Section 111 of the Data Protection Act 2018 (“the 2018 Act”). I make this Decision having considered the information obtained in the separate own volition inquiry (“the Inquiry”) conducted by an Authorised Officer of the DPC (“the Case Officer”) pursuant to Section 110 of the 2018 Act. The Case Officer provided the Health Service Executive (“the HSE”) with the Draft Inquiry Report and the Final Inquiry Report.