In brief
On 2 September 2026 the Irish Data Protection Commission announced its final decision on the HSE, the national health service: €645,000 in total, a reprimand and a series of corrective orders. The subject is not an IT system but the paper documents held in external storage facilities. The decision had been notified to the HSE on 25 August.
Where it started
The inquiry commenced on 24 May 2024 following two breaches the HSE itself had notified. The first in October 2023: individuals gained unauthorised access to St. Loman's Hospital in Mullingar, County Westmeath, where paper records were stored. It is a former disused psychiatric hospital, contaminated with asbestos. The second in November 2023, on the same pattern, in the New Building at St. Conal's Hospital in Letterkenny, County Donegal: also a former disused psychiatric hospital, this one with severe mould.
In both cases the intruders uploaded videos of what they had found to social media, and that is how it emerged that medical records were being stored there. In April 2024 the HSE informed the Commission that it had become aware — again via social media — of a further unauthorised access, this time to the basement of St. Loman's, where more records were held, which the HSE described as old mental health records.
The twelve inspections
At that point the Commission's question was no longer what had happened in those two buildings, but whether the problem was isolated or systemic. Authorised officers from the DPC carried out twelve site inspections nationwide.
What they found is set out in the announcement: documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment, or water damaged. Storage areas in such disarray and neglect that the records could not be deemed filed in any organised or accessible manner. Records stored in disused bathrooms and cubicles, in a shipping container in a turf shed, in rooms without functioning lighting or heating, and in derelict buildings at several separate locations.
The passage that applies to everyone, not just healthcare
Deputy Commissioner Graham Doyle observed that “the retention of records by the HSE in an insecure manner beyond the period where they should be retained gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties. There is also the risk of records not being available for other medical care or other legal or regulatory reasons.” Keeping things too long is not prudence: it is exposure on one side and unavailability on the other.
The infringements found
- Article 5(1)(f) and Article 32(1): failure to ensure appropriate security of the personal data contained in paper records held in external facilities, and failure to implement appropriate technical and organisational measures, including proper records management processes, mechanisms and controls.
- Article 5(1)(e): infringement of the storage limitation principle, by failing to keep the data in a form permitting identification of data subjects for no longer than necessary.
- Article 33(1), on two separate occasions: failure to notify the breach to the Commission without undue delay and within 72 hours, in respect of St. Loman's and of the records in the basement of St. Loman's.
- Article 34(1): failure to communicate the breaches at St. Loman's and St. Conal's to the data subjects.
What the HSE must do now
Beyond the reprimand and the fine, the orders require a complete audit of every facility where the HSE stores paper files, with three aims: to implement a robust management system for recording and tracing all personal data held in those facilities; to ensure the immediate and safe destruction of paper records no longer necessary for the purposes for which they are retained; and to put in place policies and procedures for regularly testing, assessing and evaluating compliance with the HSE's own retention policies. A separate audit must establish that each facility is fit for purpose.
Worth reading if you keep a record of processing
The third of those aims is the one always forgotten: regularly testing compliance with your own retention policies. Having a period written in the record and no mechanism that checks whether it is observed means having a statement, not a measure. Under scrutiny that is the whole difference.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
