Slane Credit Union January 2022

Date26 January 2022
SectionDecisions made under data protection act 2018
1
In the matter of the General Data Protection Regulation
DPC Case Reference: IN-19-7-5
In the matter of Slane Credit Union Limited
Decision of the Data Protection Commission under Section 111 of the Data Protection Act 2018
Further to an own-volition inquiry under Section 110 of the Data Protection Act 2018
DECISION
Decision-Maker for the Data Protection Commission:
Helen Dixon
Commissioner for Data Protection
26 January 2022
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
2
Contents
1. Purpose of this document .............................................................................................................. 3
2. Legal framework for the Inquiry and the Decision ....................................................................... 3
3. Factual background ........................................................................................................................ 4
4. Scope of the Inquiry ....................................................................................................................... 6
5. Issues for determination ................................................................................................................ 6
6. Issue 1: Whether SCU infringed Articles 5(1)(f) and 32(1) of the GDPR in relation to Member
Personal Data during the Temporal Scope ............................................................................................ 6
7. Issue 2: Whether SCU infringed Articles 24 and 30(1) of the GDPR in relation to Member
Personal Data during the Temporal Scope .......................................................................................... 13
8. Issue 3: Whether SCU infringed Article 28 of the GDPR in relation to Member Personal Data
during the Temporal Scope .................................................................................................................. 15
9. Decision on corrective powers ..................................................................................................... 18
A. Reprimand ........................................................................................................................................ 19
B. Administrative fine .......................................................................................................................... 20
10. Summary of corrective powers ................................................................................................ 31
11. Right of Appeal ......................................................................................................................... 31
3
1. Purpose of this document
1.1. This document (the “Decision”) is a decision made by the Data Protection Commission (the
DPC”) in accordance with Section 111 of the Data Protection Act 2018 (the “2018 Act”). I
make this Decision having considered the information obtained in the separate own volition
inquiry (theInquiry”) conducted by authorised officers of the DPC (the “Inquiry Team”)
pursuant to Section 110 of the 2018 Act. The Inquiry Team provided Slane Credit Union
Limited (“SCU”) with a draft inquiry report on 20 March 2020 (the “Draft Inquiry Report”)
and a final inquiry report on 14 October 2021 (the “Final Inquiry Report”).
1.2. SCU was provided with the Draft Decision in this Inquiry on 22 December 2021 to provide it
with a final opportunity to make submissions. This Decision is being provided to SCU pursuant
to Section 116(1)(a) of the 2018 Act in order to give SCU notice of the Decision, the reasons
for it, and the corrective powers that I have decided to exercise.
1.3. This Decision contains corrective powers under Section 115 of the 2018 Act and Article 58(2)
of the General Data Protection Regulation (Regulation (EU) 679/2016) (the “GDPR) arising
from the infringements that have been identified herein. In this regard, SCU will be required
to comply with these corrective powers, and it is open to this office to serve an enforcement
notice on SCU in accordance with Section 133 of the 2018 Act.
2. Legal framework for the Inquiry and the Decision
i. Legal basis for the Inquiry
2.1. The GDPR is the legal regime covering the processing of personal data in the European Union
(“EU”). The GDPR is directly applicable in EU member states. The GDPR is given further effect
in Irish law by the 2018 Act. As stated above, the Inquiry was commenced pursuant to Section
110 of the 2018 Act. By way of background in this regard, under Part 6 of the 2018 Act, the
DPC has the power to commence an inquiry on several bases, including on foot of a
complaint, or of its own volition.
2.2. Section 110(1) of the 2018 Act provides that the DPC may, for the purpose of Section
109(5)(e) or Section 113(2) of the 2018 Act, or of its own volition, cause such inquiry as it
thinks fit to be conducted, in order to ascertain whether an infringement has occurred or is
occurring of the GDPR or a provision of the 2018 Act, or regulation under the Act, that gives
further effect to the GDPR. Sectio n 110(2) of the 2018 Act provides that the DPC may, for the
purposes of Section 110(1), where it considers it appropriate to do so, cause any of its powers
under Chapter 4 of Part 6 of the 2018 Act (excluding Section 135 of the 2018 Act) to be
exercised and/or cause an investigation under Chapter 5 of Part 6 of the 2018 Act to be
carried out.
ii. Legal basis for the Decision
2.3. The decision-making process for the Inquiry is provided for under Section 111 of the 2018
Act, and requires that the DPC must consider the information obtained during the Inquiry; to
decide whether an infringement is occurring or has occurred; and if so, to decide on the
corrective powers, if any, to be exercised. As the sole member of the DPC, I perform this
function in my role as the decision-maker in the DPC. In so doing, I am required to carry out
an independent assessment of all the materials provided to me by the Inquiry Team as well

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT