Search Privacy Fines

This inquiry examined the basis upon which Meta Platforms Ireland Limited (“Meta Ireland”) transfers personal data from the EU/EEA to the US in connection with the delivery of its Facebook…

Articles: Art. 58

This Decision concerns an Inquiry by the Data Protection Commission (the DPC) into LinkedIn Ireland Unlimited Company (LinkedIn), a data controller with its main establishment in…

Articles: Art. 5, Art. 6, Art. 14, Art. 13

On 30 April 2025, the Irish Data Protection Commission (the ‘DPC’) adopted a final decision in an own-volition statutory inquiry, concerning TikTok Technology Limited’s (‘TikTok’) transfers…

Articles: Art. 46, Art. 13

On 12 December 2024, the Irish Data Protection Commission (‘DPC’) adopted final decisions in two own-volition statutory inquiries reprimanding Meta Platforms Ireland Limited (‘MPIL’) and…

Articles: Art. 25, Art. 33

The DPC commenced this own-volition inquiry on 21 September 2020, based both on information provided by a third party, and in connection with processing identified by the DPC itself. The…

Articles: Art. 5, Art. 6, Art. 12, Art. 24, Art. 25, Art. 35

These two inquiries relate to the data processing operations of Meta Platforms Ireland Limited (“Meta Ireland”) in connection with the delivery of its Facebook and Instagram services. (Meta…

Articles: Art. 5, Art. 6, Art. 12, Art. 13

The Data Protection Commission (DPC) adopted its final decision regarding its inquiry into TikTok Technology Limited (TTL) on 1 September 2023. This own-volition inquiry sought to examine…

Articles: Art. 5, Art. 24, Art. 25

This inquiry, which was commenced by the Data Protection Commission (DPC) on 10 December 2018, examined whether WhatsApp Ireland Ltd had discharged its GDPR transparency obligations with…

Articles: Art. 5, Art. 13

On 25 November 2022, the Data Protection Commission (the DPC) adopted a decision to impose a fine of €265 million and to exercise other corrective powers on Meta Platforms Ireland Limited …

Articles: Art. 25

This inquiry relates to the processing carried out by WhatsApp Ireland Limited (“WhatsApp Ireland”) in connection with the delivery of its WhatsApp service, in which the DPC has fined…

Articles: Art. 6, Art. 12, Art. 13

On 26 September 2024, the Irish Data Protection Commission (DPC) adopted a final decision in an own-volition statutory inquiry, concerning the processing of user passwords on the Facebook…

Articles: Art. 4, Art. 5, Art. 32, Art. 33

The DPC has adopted a decision, imposing a fine of €17 million on Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) (“Meta Platforms”). The decision followed an inquiry by…

Articles: Art. 5, Art. 24, Art. 32

This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related to a personal data breach notified by City of Dublin Education and Training Board …

Articles: Art. 5, Art. 32, Art. 33, Art. 34

This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related a personal data breach notified by Maynooth University in November 2018. The…

Articles: Art. 5, Art. 32, Art. 33

The inquiry was commenced after BOI notified the DPC of a series of 10 data breaches relating to the BOI365 banking app. The data breach notifications concerned individuals gaining…

Articles: Art. 5, Art. 32

The Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection’s (DSP) processing of biometric facial templates and the use of associated facial…

Articles: Art. 5, Art. 6, Art. 9, Art. 35

This Inquiry, which was commenced by the Data Protection Commission (‘the Commission) on 22 January 2019, examined whether Twitter International Company (‘TIC’) had complied with its…

Articles: Art. 33, Art. S 110, Art. S 111

This inquiry was commenced in respect of 22 personal data breach notifications that Bank of Ireland Group plc (“BOI”) made to the Data Protection Commission (“DPC”) between 9 November 2018…

Articles: Art. 32, Art. 33, Art. 34

The DPC commenced the Inquiry following a ransomware attack affecting patient data held on Centric’s patient administration system which was notified to the DPC on 5 December 2019. As a…

Articles: Art. 3, Art. 32

On the 10 June 2026 the Data Protection Commission adopted its final decision following an inquiry into a ransomware attack on the laboratory information system in Midlands Regional…

Articles: Art. 5, Art. 28, Art. 30, Art. 32, Art. 34

The inquiry commenced following Permanent TSB’s (‘PTSB’) notification to the DPC of a series of three data breaches relating to PTSB’s ‘Open 24 Contact Centre’. Each of the data breach…

Articles: Art. 5, Art. 32, Art. 33

This inquiry sought to assess whether Limerick City and County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a…

Articles: Art. 13, Art. 12, Art. 15

This Decision arises from an own-volition inquiry into the University of Limerick (‘UL’) following a series of personal data breaches that occurred between November 2018 and January 2020…

Articles: Art. 5, Art. 30, Art. 32, Art. 33, Art. 34

This inquiry was commenced in respect of a personal data breach that the Irish Credit Bureau (‘ICB’) notified to the DPC on 31 August 2018. The ICB is a credit reference agency that…

Articles: Art. 5, Art. 24, Art. 25, Art. 26

The inquiry was commenced after VIEC notified a personal data breach to the DPC on 19 August 2020. VIEC operates and manages five nursing homes on the Southside of Dublin and in County…

Articles: Art. 5, Art. 32