Inquiry into Child and Family Agency - August 2020

• Year: 2020
• Section: Decisions made under data protection act 2018

1

Decision of the Data Protection Commission under Section 111 of the Data Protection

Act 2018 on foot of the

Own-Volition Inquiry under Section 110 of the Data Protection Act, 2018

regarding

Tusla Child and Family Agency

Inquiry Reference: IN-18-11-04

Commission Decision-Maker:

Helen Dixon (Commissioner for Data Protection), sole member of the Commission

Date of Decision: 12th August 2020

2

Contents

1. Purpose of this Document............................................................................................................. 4

2. Background .................................................................................................................................... 4

3. Topics Arising in this Decision ......................................................................................................... 6

4. Legal Regime Pertaining to the Inquiry and the Decision ............................................................... 8

5. Materials Considered ...................................................................................................................... 9

6. Data Controller .............................................................................................................................. 10

7. Personal Data ................................................................................................................................ 10

8. Analysis and Findings .................................................................................................................... 11

A. Transmitting Personal Data on the NCCIS: Security of Processing ........................................... 11

i. Assessing Risk ........................................................................................................................ 13

ii. Security Measures Implemented by Tusla ............................................................................ 15

iii. The Appropriate Level of Security......................................................................................... 15

iv. Finding ................................................................................................................................... 16

B. Transmitting Personal Data Internally by Email: Security of Processing .................................. 17

i. Assessing Risk ........................................................................................................................ 17

ii. Security Measures Implemented by Tusla ............................................................................ 18

iii. The Appropriate Level of Security......................................................................................... 19

iv. Finding ................................................................................................................................... 20

C. Transmitting Personal Data Externally: Security of Processing ................................................ 20

i. Assessing Risk ........................................................................................................................ 20

ii. Security Measures Implemented by Tusla ............................................................................ 21

iii. The Appropriate Level of Security......................................................................................... 22

iv. Finding ................................................................................................................................... 24

D. Printing and Scanning: Security of Processing .......................................................................... 24

i. Assessing Risk ........................................................................................................................ 24

ii. Security Measures Implemented by Tusla ............................................................................ 25

iii. The Appropriate Level of Security......................................................................................... 26

iv. Finding ................................................................................................................................... 26

E. Processes for Testing Security Measures: Security of Processing ............................................ 26

i. Assessing Risk ........................................................................................................................ 27

ii. Security Measures Implemented by Tusla ............................................................................ 28

iii. The Appropriate Level of Security......................................................................................... 29

iv. Finding ................................................................................................................................... 30

3

F. Data Accuracy: Sharing Personal Data and Updating Tusla Records ........................................ 30

i. Accuracy of Personal Data Disclosed to Third Parties .......................................................... 31

ii. Accuracy of Tusla’s Internal Records .................................................................................... 31

iii. Findings ................................................................................................................................. 32

G. Duty to Notify Personal Data Breaches..................................................................................... 32

i. The Obligation to Notify Without Undue Delay .................................................................... 32

ii. The Breach Notifications ....................................................................................................... 33

iii. Findings ................................................................................................................................. 39

H. Remaining Breach Notifications ................................................................................................ 39

9. Corrective Powers ......................................................................................................................... 40

A. Reprimand ................................................................................................................................. 41

B. Order to Bring Processing into Compliance .............................................................................. 41

C. Administrative Fines ................................................................................................................. 43

i. Decision to Impose Administrative Fines .............................................................................. 43

ii. Linked Processing Operations ............................................................................................... 56

iii. Calculating the Administrative Fines .................................................................................... 58

iv. Summary: Administrative Fines ............................................................................................ 62

10. Right of Appeal .......................................................................................................................... 62

Appendix: Personal Data Breaches Considered in the Inquiry ............................................................. 63