Maynooth University

Introduction .................................................................................................................................... 1 B. Legal Framework for the Inquiry and the Decision ........................................................................ 2 a) Legal Basis for the Inquiry .............................................................................................................. 2 b) Data Controller ............................................................................................................................... 2 c) Legal Basis for the Decision ............................................................................................................ 2 C. Factual Background ........................................................................................................................ 3 D. Scope of the Inquiry and the Application of the GDPR .................................................................. 7 E. Issues for Determination .............................................................................................................. 10 F. Analysis of the Issues for Determination ..................................................................................... 10 a) Issue 1: Articles 5(1)(f) and 32(1) GDPR ....................................................................................... 10 i) Assessment of the Risks ........................................................................................................... 11 ii) Measures Implemented by MU to Address the Risks .............................................................. 15 Training and Awareness ................................................................................................................... 15 Security of Personal Data ................................................................................................................. 16 Technical Measures .......................................................................................................................... 16 Organisational Measures ................................................................................................................. 18 b) Issue 2: Article 33 GDPR ............................................................................................................... 20 i) Personal Data Breach ............................................................................................................... 20 ii) The Obligation to Notify Without Delay ................................................................................... 20 iii) The Breach Notification ............................................................................................................ 22 G. Findings Regarding Articles 5(1)(f), 32(1) and 33(1) ..................................................................... 25 H. Decision on Corrective Powers ..................................................................................................... 26 I. Order to Bring Processing into Compliance ................................................................................. 26 J. Reprimand .................................................................................................................................... 28 K. Decision on administrative fines .................................................................................................. 29 a) Whether to impose an administrative fine .................................................................................. 30 i) Article 83(2)(a) GDPR: the nature, gravity and duration of the infringement taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; .........................................................