Midlands Regional Hospital Tullamore

the DPC has: reprimanded the HSE; fined the HSE €300,000 for the infringements of Articles 5(1)(f) and 32(1) GDPR; and ordered the HSE to implement specified policies and procedures intended to ensure appropriate security of processing of personal data. 10 June 2026 Data Protection Commission 6 Pembroke Row Dublin 2, Ireland DECISION 2 Contents Contents .................................................................................................................................................. 2 A. Introduction .................................................................................................................................... 4 B. Personal data breaches ................................................................................................................... 5 a) Data controller ...................................................................................................................... 6 C. Legal Framework for the Inquiry and the Decision ......................................................................... 7 a) Legal basis for the Inquiry ..................................................................................................... 7 b) Legal basis for the Decision ................................................................................................... 7 D. Factual Background and Material Considered for the Purposes of this Decision .......................... 7 a) Controller overview .............................................................................................................. 7 b) Impact of the breach ............................................................................................................. 8 c) Breach response.................................................................................................................... 9 d) Inquiry IN-19-9-4 ................................................................................................................. 10 E. Scope of the Inquiry ...................................................................................................................... 10 F. Issues for Determination............................................................................................................... 11 G. Issue 1: Whether the HSE Infringed Articles 5(1)(f) and 32(1) in Relation to Patient Personal Data during the Temporal Scope. ..................................................................................................................