Further to my previous response to Parliamentary Question No. 284 of 3 October last, I can inform the Deputy that 90% of the personal data breaches that occurred in my Department and its Offices since 2018, were categorised as ‘Low Risk’ or "No Risk" breaches. The remaining 10% of breaches were made up of 10 "Medium" Risk and 6 "High Risk" breaches. The majority of these breaches were caused by administrative error, for example where an email (or attachment) containing personal data was sent to an unintended recipient.
The decision to report breaches to the Data Protection Commission and affected data subjects (individuals) is taken by my Department's Data Protection Officer, who is an independent appointed officer, following a full risk analysis of the details relating to each personal data breach. Since 2018, a total of 18 breaches for my Department and its Offices have been notified to the Data Protection Commission. Of those 18 notified breaches, 10 were categorised as ‘Low Risk’, 3 were categorised as ‘Medium Risk’, and 5 was categorised as ‘High Risk’. There were also 14 notifications made to affected data subjects (individuals) during this period. Following the mitigation actions that were put in place to protect the privacy rights and freedoms of the affected individuals, the Data Protection Commission were satisfied that no further action was required.
