Slane Credit Union

background ........................................................................................................................ 4 4. Scope of the Inquiry ....................................................................................................................... 6 5. Issues for determination ................................................................................................................ 6 6. Issue 1: Whether SCU infringed Articles 5(1)(f) and 32(1) of the GDPR in relation to Member Personal Data during the Temporal Scope ............................................................................................ 6 7. Issue 2: Whether SCU infringed Articles 24 and 30(1) of the GDPR in relation to Member Personal Data during the Temporal Scope .......................................................................................... 13 8. Issue 3: Whether SCU infringed Article 28 of the GDPR in relation to Member Personal Data during the Temporal Scope .................................................................................................................. 15 9. Decision on corrective powers ..................................................................................................... 18 A. Reprimand ........................................................................................................................................ 19 B. Administrative fine .......................................................................................................................... 20 10. Summary of corrective powers ................................................................................................ 31 11. Right of Appeal ......................................................................................................................... 31 3 1. Purpose of this document 1.1. This document (the “Decision”) is a decision made by the Data Protection Commission (the “DPC”) in accordance with Section 111 of the Data Protection Act 2018 (the “2018 Act”). I make this Decision having considered the information obtained in the separate own volition inquiry (the “Inquiry”) conducted by authorised officers of the DPC (the “Inquiry Team”) pursuant to Section 110 of the 2018 Act. The Inquiry Team provided Slane Credit Union Limited (“SCU”) with a draft inquiry report on 20 March 2020 (the “Draft Inquiry Report”) and a final inquiry report on 14 October 2021 (the “Final Inquiry Report”). 1.2. SCU was provided with the Draft Decision in this Inquiry on 22 December 2021 to provide it with a final opportunity to make submissions.