Irish Credit Bureau DAC

Introduction .................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................... 3 ii. Legal Basis for the Decision ......................................................................................................... 4 3. Factual Background ......................................................................................................................... 4 4. Scope of the Inquiry ........................................................................................................................ 9 5. Issues for Determination................................................................................................................. 9 6. Issue 1: Article 25(1) of the GDPR ................................................................................................... 9 i. Findings ..................................................................................................................................... 15 7. Issue 2: Articles 5(2) and 24(1) of the GDPR ................................................................................. 16 i. Finding ....................................................................................................................................... 18 8. Issue 3: Article 26(1) of the GDPR ................................................................................................. 19 ii. Finding ....................................................................................................................................... 21 9. Decision on Corrective Powers ..................................................................................................... 21 A. Reprimand ................................................................................................................................. 22 B. Administrative Fine ................................................................................................................... 23 i. Whether Each Infringement Warrants an Administrative Fine ............................................ 23 ii. The Permitted Range ............................................................................................................ 36 iii. Calculating the Administrative Fine ...................................................................................... 37 10. Right of Appeal .......................................................................................................................... 39 Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 40 3 1. Introduction 1.1 This document (“the Decision”) is a decision made by the Data Protection Commission (“the DPC”) in accordance with Section 111 of the Data Protection Act 2018 (“the 2018 Act”). I make this Decision having considered the information obtained in the separate own volition inquiry (“the Inquiry”) conducted by a case officer of the DPC (“the Case Officer”) pursuant to Section 110 of the 2018 Act. The Case Officer provided the Irish Credit Bureau DAC (“the ICB”) with the Draft Inquiry Report and the Final Inquiry Report. 1.