Dáil Éireann Debate, Tuesday - 17 October 2023
154. Deputy Peadar Tóibín asked the Minister for Transport further to Parliamentary Question No. 194 of 3 October 2023, if he will provide detail on the nature of the data breaches suffered by his Department; the severity of the breaches; if all individuals whose information was compromised were notified of the breach; if the Data Protection Commission was notified of all data breaches; and if he will make a statement on the matter. [45346/23]
View answerPlease see below in tabular form the number of data breaches reported within my Department, and noting the number which were reported to the Data Protection Commission (DPC) and the number which were notified to the data subject(s).
|
Year |
Number of Data Breaches |
Number of breaches reported to the DPC |
Number of breaches notified to data subject(s) |
|
2017 |
No records of any data breaches within the Department. |
- |
- |
|
2018 |
3 |
1 |
3 |
|
2019 |
9 |
4 |
5 |
|
2020 |
5 |
0 |
2 |
|
2021 |
8 |
4 |
6 |
|
2022 |
11 |
0 |
5 |
|
2023 to 29/09/2023 |
4 |
1 |
2 |
All breaches must be formally notified to the Department’s Data Protection Officer for assessment. In line with guidance from the Data Protection Commission (DPC), the majority of confirmed data breaches were deemed not to meet the threshold that would require formal reporting to the DPC due to the nature of the particular risk, and as such notification to the DPC was not required. These were managed internally with steps taken to ensure that similar breaches would not reoccur.
The majority of confirmed data breaches related to incidents where personal data was accidentally and inadvertently disclosed to third parties. Examples include emails sent to the wrong recipient. There were also a number of incidents where laptops/tablets/mobile phones were temporarily mislaid but which were recovered and it was confirmed that no unauthorised access had been made to the devices.
