MOVE Ireland

Introduction .................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................... 3 ii. Data Controller ............................................................................................................................ 4 iii. Legal Basis for the Decision ......................................................................................................... 4 3. Factual Background ......................................................................................................................... 4 4. Scope of the Inquiry and the Application of the GDPR ................................................................... 7 5. MOVE’s submissions in relation to the Draft Decision ................................................................... 9 6. Issue for Determination ................................................................................................................ 12 7. Issue: Articles 5(1)(f) and 32(1) of the GDPR ................................................................................ 13 i. Assessing Risk ............................................................................................................................ 15 ii. Security Measures Implemented by MOVE .............................................................................. 18 iii. The Appropriate Level of Security ............................................................................................. 22 iv. Findings ..................................................................................................................................... 25 8. Corrective Powers ......................................................................................................................... 25 A. Reprimand ................................................................................................................................. 26 B. Order to Bring Processing into Compliance .............................................................................. 27 C. Administrative Fine ................................................................................................................... 28 i. Whether the Infringements Warrant an Administrative Fine .............................................. 28 ii. The Applicable Range for the Administrative Fine ............................................................... 37 iii. Calculating Administrative Fine ............................................................................................ 38 9. Right of Appeal .............................................................................................................................. 39 Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 40 3 1. Introduction 1.1 This document (‘the Decision’) is a decision made by the Data Protection Commission (‘the DPC’) in accordance with section 111 of the Data Protection Act 2018 (‘the 2018 Act’). I make this Decision having considered the information obtained in the own volition inquiry (‘the Inquiry’) pursuant to section 110 of the 2018 Act.