My Department has been subject to one investigation by the Data Protection Commission since 2016, which was on foot of a complaint by an individual.
On 20 June 2017, the DPC informed the Department of the complaint and the commencement of an investigation. The complaint concerned an allegation that a breach of the Acts had occurred by way of the unauthorised disclosure by the Department to two organisations of a letter incorporating personal information.
The complainant declined the offer of an amicable resolution, including an apology, and so the DPC issued a formal statutory Decision earlier this year.
While the DPC acknowledged that the letter was forwarded to the organisations in an attempt to provide assistance and to be helpful, she found that the Department did not have a valid legal basis to disclose the personal data.