# data[].attributes.body
requires controller to document personal data breach including facts relating to breach, its effects and steps taken to remediate them

# data[].attributes.body
controller of personal data has obligation to notify supervisory authority of breach no later than 72 hours after becoming aware of it unless risk to rights and freedom of natural persons is is unlikely

# data[].attributes.body
Tusla issued with 2nd fine by DPC, November 2019 unauthorized disclosure of personal data to an alleged abuser, posted on social media. First body in Ireland to be fined by DPC. 2 previous breaches in 2018. One case involved contact and location data of a mother and child disclosed to an alleged abuser. Total fine for 3 data breaches €75,000.

# data[].attributes.headline
88,726 data subjects in EEC affected by breach

# data[].attributes.subject
88,726 data subjects in EEC affected by breach

# data[].attributes.body
Twitter unable to identify total number affected. 88,726 reflects those affected between 05/09/17

Bug that led to breach was introduced in 04/11/14 and remediated by 14/01/19

# data[].attributes.headline
37,000 Eir customers hit with a data breach after a staff laptop containing customer details was stolen.

# data[].attributes.subject
37,000 Eir customers hit with a data breach after a staff laptop containing customer details was stolen.

# data[].attributes.body
Eir insisted that no financial data was exposed.
The company  reported the incident to gardaí and the Data Protection Commissioner.
A spokesman for Eir said that "There is no evidence at this time that the data at risk has been used by a third party" and the laptop had been decrypted by a faulty security update the previous day. However, the laptop was password protected and would hinder the thief from gaining access to the laptop.

Eir  initiated a programme to contact those customers whose data may be at risk as a result of the theft of a laptop.

Eir also states that the laptp was stolen 10 days ago and all customers has been informed.

Under the GDPR rules, they state
that early notification to data protection authorities and those potentially affected are regarded as good practice which can offset possible regulatory punitive action

# data[].attributes.headline
Twitter fined 450,000 after they reported personal data breach 

# data[].attributes.subject
Twitter fined 450,000 after they reported personal data breach 

# data[].attributes.body
Breach arose as result of a bug in android app causing twitter to unintentionally make users private tweets public

# data[].attributes.body
Hackers have stolen personal details relating to thousands of Irish online shoppers from an international courier company.
The Irish Data Protection Commission has opened an investigation into the data breach at Fastway couriers. The personal details were linked to deliveries that were due to take place over a 30-day period from mid-January onwards.  No financial information or other personal data was accessed.

# data[].attributes.attachment_link.readable_text
Irish DPC fines Twitter €450,000 for data breach

On 15 th December 2020, the Irish Data Protection Commission (the " DPC") announced its decision to impose an administrative fine of €450,000 on Twitter International Company (" Twitter") following an investigation into a personal data breach reported by Twitter, under the self-reporting obligations of General Data Protection Regulation (EU) 2016/679 (" GDPR "). The breach arose as a result of a bug in Twitter's android app which caused Twitter to unintentionally make some of its users' private tweets public.

It transpired that at least 88,726 data subjects in the European Economic Area were affected by the breach. Due to retention limitations on its available logs, however, Twitter could not identify the total number of people affected. The 88,726 data subjects identified reflects only those affected people Twitter could identify for the period from 5 th September 2017 to 11 th January 2019. Notably, the bug that lead to the breach " was introduced on 4 November 2014" and " fully remediated by 14 January 2019."

Under Article 33(1) of the GDPR a controller of personal data has an obligation to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having becoming aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 33(5) of the GDPR requires a controller to document the personal data breach, including the facts relating to the personal data breach, its effects and the steps taken to remediate them.

In this case:

* Twitter became aware of the bug on 26 th December 2018 (arguing that actual "awareness" of the breach occurred later).

* Twitter notified the breach to the DPC on 8 th January 2019.

* The DPC commenced its investigation on 22 nd January 2019.

The DPC concluded that Twitter infringed both Article 33(1) and Article 33(5) of the GDPR due to its failure (i) to notify the breach to the DPC within the prescribed timeframe and (ii) to adequately document the breach.

The DPC's draft decision in the matter was submitted to the other European data regulators for review in May 2020, as required under Article 60 of the GDPR, and it was subject to their scrutiny. Some regulators were unhappy with the fine originally proposed by the DPC ($150,000 - $300,000) given that Twitter reported revenue of €2.8 billion last year in circumstances where the GDPR empowers regulators to fine organisations up to 4% of their global turnover for the previous year, or €20 million (whichever is greater).

As a consequence, the draft decision was referred to a dispute resolution mechanism under the European Data Protection Board (the " EDPB ") and was the first to go through this process since the introduction of the GDPR in May 2018. The EDPB's decision was finalised in November and published this week.

Twitter released a statement on the decision and stated that:

" An unanticipated consequence of staffing between Christmas Day 2018 and New Years' Day resulted in Twitter notifying the DPC outside of the 72 hour statutory notice period. We have made changes so that all incidents following this have been reported to the DPC in a timely fashion. We take responsibility for this mistake and remain fully committed to protecting the privacy and data of our customers, including through our work to quickly and transparently inform the public of issues that occur".

As the DPC is the lead supervisory authority for a number of multinational technology companies who have their headquarters here in Ireland, it faced pressure in recent years to clamp down in their processing activities and this decision is notably the DPC's first GDPR enforcement against such a multinational. The DPC described the penalty as " an effective, proportionate and dissuasive measure ".

The Irish Council for Civil Liberties was disappointed at the level of the fine imposed describing it as "meagre".

The EDPB has published its decision and the DPC's final decision on its website, both of which can be viewed here.
This note is for general information purposes and does not constitute legal advice. Legal advice must be obtained for all individual circumstances. Each case must be assessed on its own merits

View Profile

View Profile

# data[].attributes.attachment_link.title
Irish DPC fines Twitter €450,000 for data breach - Flynn O'Driscoll

# data[].attributes.attachment_link.description
On 15 th December 2020, the Irish Data Protection Commission (the " DPC") announced its decision to impose an administrative fine of €450,000 on Twitter International Company (" Twitter") following an investigation into a personal data breach reported by Twitter, under the self-reporting obligations of General Data Protection Regulation (EU) 2016/679 (" GDPR ").

# data[].attributes.attachment_link.readable_text
Tusla has been issued with a second fine by the Data Protection Commission (DPC) for a breach of data protection rules.

The decision was issued to the Child and Family Agency yesterday, following the completion of an inquiry that began last year.

It relates to a breach notified to the DPC in November 2019 regarding an unauthorised disclosure of sensitive personal data.

The disclosure was made to an alleged abuser and the data was subsequently posted on social media.

Tusla now has 28 days to appeal the decision and the corrective measures accompanying it. The DPC would not comment on the size of the fine.

"As the decision referred to has only just been received, we are not in a position to comment further until we have reflected on all of the matters," Tusla said in a statement.

Earlier this week the Sunday Times revealed that Tusla had become the first body to be fined in Ireland by the DPC for a data protection breach under the stricter rules contained in the General Data Protection Regulation (GDPR).

That case related to three breaches reported in February and March of last year.

One of those cases involved the accidental disclosure of the contact and location data of a mother and child to an alleged abuser.

The fine for the three breaches totaled €75,000.

"Tusla has and continues to engage constructively with the DPC and the public on these matters," it said.

"In recent days we commented on a decision in respect of a sanction by the DPC and this followed the period in which we considered that decision when it first issued. We will now reflect on this, the second of what is anticipated will be a total of three decisions. We will at that point issue further comment."

Meanwhile, the DPC has sent a draft decision on an investigation it was conducting into Twitter to other supervisory authorities in Europe.

That inquiry was launched by the regulator in January last year and was initiated following a receipt of a data breach notification by the social media platform.

It relates to its compliance with the requirement under Article 33 of the GDPR to notify the DPC of a breach within 72 hours and provide certain information.

Under GDPR, a company that breaks privacy laws can be fined up to 4% of global revenue or €20 million, whichever is higher.

The DPC also said in a statement that there had been a number of other significant developments this week around its investigations of "big tech" firms.

This includes the sending of a preliminary draft decision of an investigation into WhatsApp to the company.

"The inquiry into WhatsApp Ireland examines its compliance with Articles 12 to 14 of the GDPR in terms of transparency including in relation to transparency around what information is shared with Facebook," said Deputy Commissioner Graham Doyle in a statement.

The social messaging firm may now make submissions which will then be taken in to account by the DPC before a draft decision is prepared and sent to other European supervisory authorities.

The regulator said it had also completed the investigation phase of a complaint-based inquiry which focuses on Facebook's obligations to establish a lawful basis for personal data processing.

This probe is now in the decision-making phase, the DPC said.

Draft inquiry reports have also been sent to complainants and companies in relation to two other inquiries involving Instagram and WhatsApp.

The DPC also revealed that the Court of Justice of the European Union will deliver its decision in the case being taken by it against Facebook and Austrian privacy campaigner, Max Schrems on 16 July.

The case centres on whether Facebook's use of so-called standard contractual clauses to move data from Europe to the US complies with EU privacy standards, and whether the DPC can make a decision on the matter.

# data[].attributes.attachment_link.title
Second fine for Tusla over data protection rules breach

# data[].attributes.attachment_link.description
Tusla has been issued with a second fine by the Data Protection Commission (DPC) for a breach of data protection rules.The decision was issued to the Child and Family Agency yesterday, following the completion of an inquiry that began last year.

# data[].attributes.attachment_link.readable_text
Some 37,000 Eir customers have been hit by a security breach after a staff laptop was stolen.

he telecoms firm said that the breach happened when an unencrypted device was stolen outside an office at the weekend. Customer data exposed included names, email addresses, phone numbers and Eir account numbers.

However, Eir insists that no financial data was exposed.

The company has reported the incident to gardaí and the Data Protection Commissioner.

"There is no evidence at this time that the data at risk has been used by a third party," said a spokesman for Eir.

"In this case, the laptop had been decrypted by a faulty security update the previous working day, which had affected a subset of our laptops and was subsequently resolved."

A decrypted laptop is easier to break into than a properly encrypted one.

However, the laptop was said to be password-protected, meaning that a thief who is not tech-savvy would find it difficult to hack.

"Eir treats privacy and protection of all data extremely seriously and our policy is that all company laptops should be encrypted as well as password protected," said the spokesman.

"We have initiated a programme to contact those customers whose data may be at risk. This is a result of the theft of one laptop, which was stolen offsite.

"No other personal or financial data relating to customers was stored on the laptop in question."

The laptop was stolen 10 days ago, with letters and emails going out to affected customers today.

Those affected were consumer and small business customers.

"If Eir customers need further information relating to this, it is available at www.eir.ie/customer-announcement," said the spokesman.

Under new European GDPR rules, companies can face higher fines and punitive action for losing or misusing customer information.

However, the rules state that early notification to data protection authorities and those potentially affected are regarded as good practice which can offset possible regulatory punitive action.

Irish Independent

# data[].attributes.attachment_link.title
37,000 Eir customers face data breach in laptop theft

# data[].attributes.attachment_link.description
Some 37,000 Eir customers have been hit by a security breach after a staff laptop was stolen. he telecoms firm said that the breach happened when an unencrypted device was stolen outside an office at the weekend. Customer data exposed included names, email addresses, phone numbers and Eir account numbers.

# data[].attributes.attachment_link.readable_text
The Irish Data Protection Commission has opened an investigation into the data breach at Fastway couriers.

The company has confirmed that names, addresses, email accounts and phone numbers of 446,143 people were accessed during the attack.

It said that no financial information or other personal data was accessed.

The personal details were linked to deliveries that were due to take place over a 30-day period from mid-January onwards.

The Irish Data Protection Commission has confirmed to me that they have received a breach notification from Fastway Couriers.

Customer data impacted includes: names, addresses, email accounts and phone numbers.@NewstalkFM

- Jess Kelly 👩🏻‍💻 (@jesskellynt) March 11, 2021

In a statement, Fastway CEO Danny Hughes said: "It is distressing that our IT system was compromised by a malicious attack as we are exceptionally careful in every aspect of our data protection obligations.

"I deeply regret that people's personal data has been compromised and I apologise to our clients and their customers.

"I want to stress that nobody's financial data was at risk and the issue is limited to delivery information only.

"We will continue to work closely with the Data Protection Commission, the Gardaí and our clients to mange this situation in line with best practice."

The Irish Data Protection Commission has confirmed to me that they have received a breach notification from Fastway Couriers.

Customer data impacted includes: names, addresses, email accounts and phone numbers.@NewstalkFM

- Jess Kelly 👩🏻‍💻 (@jesskellynt) March 11, 2021

It is believed the breach took place on February 24th while the company was carrying out server maintenance.

It was identified by a third-party IT contractor on February 25th and fixed by 9am the next morning.

The contractor did not inform Fastway about the breach until March 2nd.

Fastway said it informed Gardaí and the Data Protection Commissioner as soon as it learned of the breach.

The company handles deliveries for 7263 companies, including 20 "large e-retailers.'

Fastway said each of these companies will now decide "if and how people are advised of the fact that their personal data has been compromised."
With reporting from Jess Kelly
Most Popular

# data[].attributes.attachment_link.title
Fastway Couriers: Thousands of Irish shoppers personal details stolen in major data breach | Newstalk

# data[].attributes.attachment_link.description
The Irish Data Protection Commission has opened an investigation into the data breach at Fastway couriers. The company has confirmed that names, addresses, email accounts and phone numbers of 446,143 people were accessed during the attack. It said that no financial information or other personal data was accessed.