DECISION IN-19-9-1: Health Service Executive (August 2020)

LV
by Lucie Valachova0 views·Updated May 22, 2022
Create your own

Chapters

Audio TranscriptAuto-generated

  1. Good morning everyone
  2. today I would like to talk to you
  3. about a decision by the Irish Data Protection Commission
  4. I in 1991
  5. dating in August 2020 regarding health service executive.
  6. So firstly I would like to briefly summarize the some case facts.
  7. So firstly it was initiated by irish Data Protection commission
  8. against the health service executive based on the
  9. notification that there has been a data protection
  10. breach by the health service executive.
  11. So this breach occurred where a student employee and a cork University
  12. maternity hospital incorrectly disposed of 78
  13. documents containing personal data of their patients
  14. As well as six documents which contain sensitive data
  15. of the patients regarding their prior and upcoming treatments.
  16. These documents where they later found in the public recycling center in
  17. the in the cork county um by another member of the community
  18. based on the definition in article 47 of the G. D. P. R.
  19. The data controller was deemed the health service executive and the data
  20. subject where the patients whose data have been um incorrectly disposed of.
  21. So now briefly deviating from the actual case,
  22. I would like to summarize some of the prerogatives of the G.
  23. P. A. And their powers. So um these are enshrined in article 58 of the G. D. P. R.
  24. And they're threefold.
  25. So firstly they have investigatory powers
  26. which means that they may request documents
  27. um from the data controllers as well as um
  28. conduct their own investigations into data protection breach.
  29. Secondly they have corrective powers which includes
  30. the powers to issue fines and reprimand.
  31. And lastly they also have authorization
  32. and advisory powers for data controllers when
  33. in doubt as well as for the legislators when creating new laws.
  34. Mhm.
  35. Now back to the case.
  36. The main issue here was whether the HSC has complied with
  37. their obligations which are set out in article 51 F.
  38. And 30 to 1 G. D. P. R.
  39. Regarding the security storage of information in respect to the
  40. use and disposal of hard copy documents containing personal data
  41. and more specifically whether they have
  42. implemented appropriate technical and organizational measures
  43. in respect to the processing of this data.
  44. Ah these main issues relate mostly to the principle of
  45. integrity and confidentiality which is enshrined in Article 51 f.
  46. And the security of processing an article 32 1 of the G. D. P. R.
  47. Now before we get to the actual outcome of the case I
  48. would like to briefly summarize um how they have reached this outcome.
  49. So the court has conducted so called risk assessment
  50. and they have balanced the risk to the data subject
  51. against the measures which are implemented by the H.
  52. S. E.
  53. And they have concluded that there was a very high risk to data subjects.
  54. And they have concluded this based on 33 criteria.
  55. So firstly the nature of the data as the HSC towards very confidential
  56. data as well as uh sensitive data regarding the health information of the patients
  57. which are considered a sensitive data under article 91 of the G. D. P. R.
  58. The second factor was the quantity of the data that they hold as well
  59. as the quantity of the data that was incorrectly disposed of and found.
  60. And lastly unauthorized access risk as underlined by this case.
  61. The documents have been found by a normal person of community in um in a public
  62. recycling center in the same county and therefore
  63. the data subject could be quite easily identified
  64. balancing this against the measures of the HSC including the policies,
  65. their employee trainings and evaluation of their existing measures.
  66. They have concluded that these were insufficient
  67. so now to the outcome.
  68. So firstly they ordered them to bring their measures into compliance with the Gpr
  69. secondly they have issued a reprimand to the HTC for the infringement.
  70. And lastly they have also imposed an administrative fine of €65,000
  71. to the last point of my presentation. Um that is my opinion.
  72. So there's both pros and cons to these cases but I believe
  73. that the pros over all the cons so this case is not um
  74. one in a million
  75. as there have been seven proceeding cases which have been within
  76. the same controller within the same place around the same time.
  77. And therefore this has been a repeated issue with the H. S. E.
  78. And therefore I believe that
  79. orders were appropriate to the um to ensure
  80. the protection of the data of their patients.
  81. However they're also cons as the fines are quite
  82. hefty when imposed for the bridges of G.
  83. D. P. R. And therefore they could be problematic to comply with.
  84. And another pro for the
  85. actual imposition of these finds is that
  86. these data as they are very sensitive. They need to be very strictly protected.
  87. However, that also brings out a con because
  88. even though mentioned in the case they have shredded most of their documents,
  89. it was still um it was still concluded as
  90. not in line not adequate to the protection necessary.
  91. That is all for me. Thank you so much for your attention.