Far-Reaching Outcomes? Irish Data Protection Commission Publishes 2021 Annual Report

Editor’s Note: The Data Protection Commission (DPC) is the Irish supervisory authority for the General Data Protection Regulation (GDPR). It also has functions and powers related to other critical regulatory frameworks, including the Irish ePrivacy Regulations (2011) and the EU Directive known as the Law Enforcement Directive. Recently the Commissioner for Data Protection, Helen Dixon, published the Irish Data Protection Commission’s Annual Report for 2021. In this recently released report (February 24, 2022), DPC Ireland details the extensive span of regulatory work completed during its discharge of duties in the role of overseeing and regulating the application of EU data protection and e-privacy laws. As part of that detailing of work, the DPC shares details about data-breach complaints and notifications to the DPC during 2021. As data and legal professionals operating in the eDiscovery ecosystem seek to understand the market impact and opportunities driven by data breaches, they may benefit from the details and data points shared in this important annual report.

Press Announcement and Report

Data Protection Commission Publishes 2021 Annual Report*

Announcement

Commissioner for Data Protection, Helen Dixon, has today [February 24, 2022] launched the Irish Data Protection Commission’s Annual Report for 2021.

Highlights of the 2021 Annual report include:

• The DPC received 7,469 queries and 3,419 complaints from individuals in 2021 (an increase of 7% on 2020 figures).
• The DPC concluded 7,081 queries and 3,564 complaints, including 1,884 complaints received prior to 2021.
• Total valid breach notifications received in 2021 was 6,549. Of the total recorded breach cases, 95% were concluded in 2021 (6,274 cases).
• In 2021, the DPC concluded 5 large-scale inquiries; sent forward 4 draft decisions to the EU co-decision making process; referred 1 case to the EU dispute resolution mechanism on foot of which the DPC issued a finalized decision; issued a further 9 preliminary drafts of decisions for submissions to regulated entities and complainants in advance of finalization, and sought submissions on statements of issues or inquiry reports from relevant parties in a further 17 inquiries.
• In September, the DPC announced a conclusion to a GDPR investigation it conducted into WhatsApp Ireland Ltd. The decision was subject to the EU dispute resolution process, after which the DPC imposed a fine of €225 million on WhatsApp, in addition to an order for WhatsApp to bring its processing into compliance.
• 138 electronic direct marketing investigations were concluded in 2021 and two telco companies were prosecuted for persistently contacting customers who had opted out of correspondence.
• In December 2021 the DPC published its Data Protection Audit of Political Parties in Ireland. The report was compiled following data protection audits conducted this year by the DPC in twenty-six registered political parties in Ireland.
• In December 2021, the DPC settled legal proceedings with the Department of Social Protection (D/SP) on the D/SP’s processing of personal data when issuing Public Service Card.
• In 2021, the DPC published its finalized Fundamentals for a Child-Oriented Approach to Data Processing, giving much-needed direction to organizations involved in the processing of children’s data.
• In December 2021, the DPC published its Five-Year Regulatory Strategy for 2022-2027, providing clarity to stakeholders as to the direction of travel for the regulatory priorities of the DPC going forward.
• Staff numbers increased to 190 and the budget increased to €19.1 million (€23.2 million in 2022).

The Commissioner for Data Protection, Helen Dixon, commented:

“2021 has been a year of strong regulatory results from the DPC, in which it delivered impactful and far-reaching outcomes for the protection of individuals’ personal data. The GDPR is a strong framework law that demands accountability, fairness, and transparency from all organizations that process personal data. It is clear that “data controllers” in Ireland continue to improve their compliance efforts, but higher standards of responsiveness to individuals seeking to exercise their rights are still needed in many sectors. The DPC will continue to target enforcement actions aimed at driving those necessary improvements, in addition to publishing decisions and case studies on its website to guide data controllers in the application of the GDPR. Operationalizing the aims of the GDPR is an important work-in-progress for all of us and must continue.“

Read the original announcement.

Report Extract on Data Breaches (Chapter 7)

In 2021, the DPC received 6,616 personal data breach notifications under Article 33 of the GDPR. A total of 6,549 valid data breaches were recorded, representing a 2% decrease (114) on the numbers reported in 2020. In line with what was reported in previous years since the introduction of GDPR, the highest category of data breaches notified in 2021 was in relation to unauthorized disclosures, accounting for 71% of the total notifications.

Of the total 6,616 breach notifications that the DPC received in 2021, in terms of breakdown, 3,677 related to the private sector, 2,707 to the public sector, and the remaining 232 came from the voluntary and charity sector.

It is noted that a disproportionately large chunk of breach notifications (2,707) originate in public sector organizations in Ireland. The ten organizations with the highest number of breach notifications recorded against them are public sector bodies and banks, with insurance and telecom companies falling among the top twenty.

Regarding the number relating to unauthorized disclosures, this is mostly due to poor operational practices and human error, such as inserting the wrong document in an envelope addressed
to an unrelated third party, or sending email correspondence to multiple recipients using the ‘To’ or ‘Cc’ fields instead of the Bcc field. The DPC has also seen a vast increase in the number of breaches caused by email correspondence issuing to an incorrect recipient due to the message service employed which predicts the recipient’s email address based on the first characters entered. As regards hard copy correspondence issuing to the wrong party, we are seeing this occurring particularly in the financial institutions and fundamentally it is down to a failure to update data in a timely fashion and customers’ failure to notify the financial institution of a change of address.

Complete Report: Irish Data Protection Commission’s 2021 Annual Report (PDF)

* Copyrighted information note shared by permission according to the Re-use of Public Section Information

Additional Reading

• The Data Protection Commission (DPC) Ireland
• Luck of the Irish? Data Protection Commission of Ireland Published Annual Report (2020)

Source: ComplexDiscovery