CHI breached data rules over storage of children's records in 'overflowing...waste bin'

CHI acknowledged that children's records were being stored in an unlocked room at Tallaght University Hospital and said it would act on the reprimand issued by the DPC. File photo: Mark Stedman/Photocall Ireland.

Children's Health Ireland (CHI) breached data protection rules in relation to the storage of children's records, the Data Protection Commission (DPC) has found.

CHI acknowledged that children's records were being stored in an unlocked room at Tallaght University Hospital and said it would act on the reprimand issued by the DPC.

It follows an investigation launched by the regulator in August after it received protected disclosures raising concerns about the storage of children’s records.

“Documents containing both sensitive and special category data of children had been overflowing, and subsequently removed, from a confidential waste bin,” the DPC said in a statement on Thursday.

This bin was located beside the door to an office used by non-consultant doctors at the hospital.

CHI was found to be in breach of General Data Protection Regulations (GDPR) for failing to ensure personal information was processed to protect security and confidentiality of the data.

CHI was told about the findings last month and must now bring its processing of personal data into compliance with GDPR.

In response, CHI said it has “accepted the reprimand that we were given, and we will continue to work closely with the DPC to ensure any and all actions are closed". 

A spokeswoman said: “We apologise for any upset this issue may have caused to the children, young people, and families in our care.” 

The hospital group takes the security of patient information seriously and has protocols in place to correctly manage data, she said.

“CHI acknowledges that in August 2025, a number of patient records were stored in an unlocked room in CHI at Tallaght. This was in breach of our own protocols and, as is appropriate, were determined by the Data Protection Commissioner to be in breach of GDPR legislation.” 

She said the DPC did not impose a fine for this breach. “We remain committed to ensuring that we review our processes and procedures for data management, in consultation with the DPC,” said the spokeswoman. 

CHI will become a paperless hospital when its hospitals all move together to the new children’s hospital. “We continue to prepare to move to an electronic-based system once we get into the new hospital,” she said.