Peadar Tóibín (Meath West, Aontú)
Link to this: Individually | In context | Oireachtas source

639. To ask the Minister for Education and Skills further to Parliamentary Question No. 716 of 3 October 2023, if he will provide detail on the nature of the data breaches suffered by his Department; the severity of the breaches; if all individuals whose information was compromised were notified of the breach; if the Data Protection Commission was notified of all data breaches; and if he will make a statement on the matter. [45337/23]

Simon Harris (Wicklow, Fine Gael)
Link to this: Individually | In context | Oireachtas source

As the Deputy will be aware, the General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and any personal data breaches since its introduction are dealt with under the Regulation and the Data Protection Act 2018.

Article 4 of the GDPR defines a data breach as “‘a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”.

All of the data breaches that occurred in my Department since its establishment in 2020 are classified as unauthorised disclosure of personal data. Of the breaches that occurred in my Department since 2020, none were assessed to represent either a high or a medium risk. Two of them (40%) were classified as low risk, and the remaining three (60%) as presenting no risk.

The Data breaches which occurred in my Department were reported to the Data Protection Commission and/or the affected data subjects in line with the requirements of the legislation.