University College Dublin

Introduction ................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................ 3 ii. Legal Basis for the Decision ...................................................................................................... 4 3. Factual Background ......................................................................................................................... 4 4. Scope of the Inquiry ........................................................................................................................ 7 5. Issues for Determination .............................................................................................................. 8 6. Issue 1: Articles 5(1)(f) and 32(1) of the GDPR .......................................................................... 8 i. Assessing Risk ............................................................................................................................ 9 ii. Security Measures Implemented by UCD .............................................................................. 11 iii. The Appropriate Level of Security ......................................................................................... 13 iv. Finding ..................................................................................................................................... 15 7. Issue 2: Articles 5(1)(e) of the GDPR ......................................................................................... 15 i. The Principle of Storage Limitation ....................................................................................... 15 ii. Finding ..................................................................................................................................... 16 8. Issue 3: Article 33(1) of the GDPR ............................................................................................. 17 i. The Obligation to Notify Without Undue Delay .................................................................... 17 ii. The Breach Notifications ........................................................................................................ 18 iii. Findings .................................................................................................................................... 19 9. Decision on Corrective Powers .................................................................................................. 19 A. Order to Bring Processing into Compliance .......................................................................... 20 B. Reprimand ............................................................................................................................... 21 C. Administrative Fine ................................................................................................................. 22 i. Whether Each Infringement Warrants an Administrative Fine ...................................... 22 ii. The Permitted Range........................................................................................................... 31 iii. Calculating Administrative Fines ....................................................................................... 33 iv. The Same or Linked Processing Operations ...................................................................... 35 v. The Amount of the Administrative Fine ............................................................................ 36 D. Summary of Corrective Powers .............................................................................................. 37 10. Right of Appeal ........................................................................................................................ 37 Appendix: Schedule of Materials Considered for the Purposes of this Decision .................. 38 3 1. Introduction 1.1 This document (“the Decision”) is the decision made by the Data Protection Commission (“the DPC”) in accordance with Section 111 of the Data Protection Act 2018 (“the 2018 Act”).