Teaching Council

Introduction .................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................... 3 ii. Legal Basis for the Decision ......................................................................................................... 4 3. Factual Background ......................................................................................................................... 4 i. Chronology .................................................................................................................................. 5 4. Scope of the Inquiry ...................................................................................................................... 11 5. Issues for Determination............................................................................................................... 11 6. Issue 1: Article 5(1) and 32(1) of the GDPR .................................................................................. 11 i. Assessing Risk ............................................................................................................................ 14 ii. Security Measures Implemented by the Council ...................................................................... 16 iii. The Appropriate Level of Security............................................................................................. 20 iv. Finding ....................................................................................................................................... 23 7. Issue 2: Article 33(1) ..................................................................................................................... 23 i. The Obligation to Notify Without Delay ........................................................................................ 23 ii. The Breach Notification ................................................................................................................. 27 iii. Finding .......................................................................................................................................... 35 8. Decision on Corrective Powers ..................................................................................................... 35 A. Order to Bring Processing into Compliance .............................................................................. 36 B. Reprimand .................................................................................................................................... 38 C. Administrative Fine ...................................................................................................................... 39 i. Whether Each Infringement Warrants an Administrative Fine ................................................. 39 ii. The Permitted Range ............................................................................................................ 50 iii. Calculating the Administrative Fines .................................................................................... 51 iv. The Article 83(3) Limitation .................................................................................................. 53 v. The Amount of the Administrative Fine ................................................................................ 56 9. Right of Appeal .............................................................................................................................. 57 Appendix: Schedule of Materials Considered for the Purposes of this Decision.................................. 58 3 1. Introduction 1.1 This document (“the Decision”) is a Decision of the Data Protection Commission (“the DPC”) in accordance with Section 111 of the Data Protection Act (“the 2018 Act”).