Data protection commissioners 'want to look wider' into patient file breach

It’s understood that the investigation was notified to the HSE on Tuesday. Picture: Gareth Chaney/Collins

The Data Protection Commission has opened an investigation into the HSE after the personal files of patients were “compromised”.

Questions have been raised about “unsuitable locations” in which that data was stored.

A spokesperson for the commission said that the inquiry “concerns the storage and retention of personal data contained in paper records held by the HSE, via its use of external storage facilities, and breaches of security which were notified to the  Data Protection Commission by the HSE”.

“The breaches notified to the Data Protection Commission related to two specific locations which were accessed by unauthorised third parties, and the circulation of videos taken from these locations showing paper medical records located at these facilities,” they added.

It’s understood that the investigation, the most significant to be announced since the two new data protection commissioners Dale Sunderland and chair Des Hogan took on their roles in February, was notified to the HSE on Tuesday.

GDPR breaches by public bodies are potentially punishable by up to €20m in fines, though the largest fine handed out to such a State body to date was the €110,000 levied on Limerick City and County Council in 2021 — over its installation of CCTV cameras around the county without Garda authorisation.

The HSE storage facilities in question had allegedly seen individual files suffering water damage, while the videos of the files which emerged on social media had broadcast some of the details of the cases concerned.

Mr Hogan said that, while the investigation resulted from just two breach notifications, the commissioners now “want to look wider”.

Ahead of the publication of the Data Protection Commission annual report for 2023, Mr Hogan said: “This is the thing about taking on public bodies."

If we see there’s a problem in one area, we need to see what the picture is and what the other systemic issues are which need to be tackled

The commission’s report, which covers the last full year in her role of former commissioner Helen Dixon, notes a 20% increase in the number of complaints filed year-on-year for 2023 — at 11,200 new cases.

The commission finalised 19 decisions across 2023 and applied administrative fines of €1.5bn, including the largest GDPR fine to date in the €1.2bn levied off Facebook owner Meta in May 2023 regarding its transfers of data from the EU into the US.