Inquiry into City of Dublin Education and Training Board (CDETB) - June 2025

• Year: 2025
• Section: Decisions made under data protection act 2018

The Data Protection Commission (DPC) has today announced its final decision (Decision) following an inquiry into a personal data breach at the City of Dublin Education and Training Board (CDETB). The DPC commenced this inquiry on an own-volition basis in July 2019. The inquiry related to a personal data breach notified by CDETB in November 2018, following CDETB’s discovery that its webserver was retaining the personal data of student grant applicants who had uploaded information related to their grant applications through CDETB’s website, as well as the discovery of malware on the webserver.

The data processed included approximately 13,000 data subjects, identifiable by email address, who had submitted supplementary forms through the CDETB website during 2017 and 2018. The personal data at risk due to the security incident included data subject identity (name, surname, and birth date), PPSN, contact details, identification data and special categories of data such as data revealing racial or ethnic origin and health data.

The DPC assessed CDETB’s technical and organisational measures for ensuring the security of personal data that it processed on its website in light of the risks presented. Those risks included the...