The Data Protection Commission (DPC) has fined the Department of Health €22,500 for the "excessive and disproportionate" processing of personal data relating to children with special education needs.
The DPC launched an inquiry following an RTÉ Investigates programme in 2021 containing allegations made by whistleblower Shane Corr exposing the collection of files on autistic children involved in litigation with the State.
In the report published today, the DPC said when defending lawsuits the Department of Health asked the Health Service Executive (HSE) for information on services provided to the plaintiffs and their families along "any other issues HSE feels worth mentioning".
The DPC said this "broad question resulted in the provision of private information about the lives of plaintiffs and their families".
The Data Protection Commission found the department did not infringe data protection law by seeking information about the services that were being provided to plaintiffs in relation to cases where there was open litigation.
However, the DPC found that the department did infringe data protection law by asking broad questions that resulted in the provision of sensitive information about the private lives of the children and their families.
The report said the information included details about plaintiffs' jobs and living circumstances, information about their parents’ marital difficulties and in one case, information received directly from a doctor about the services that were being provided to the plaintiff.
The DPC found that the processing of information obtained in response to broad scoping questions sent to the HSE for the purposes of seeking to settle a case "was excessive and disproportionate to the aims pursued by the department and that the processing for this reason was not necessary for the purposes of litigation".
It found that there was "no lawful basis for this processing in the files examined".
Along with a €22,500 fine, the DPC also imposed a ban on further processing the sensitive data in the files examined for the purposes of determining an appropriate time to settle a case.
Mr Corr, the whistleblower, welcomed today's development, saying: "The decision from the DPC is very welcome. The Department of Health secretly gathered sensitive information on the most vulnerable children and their families. It was wrong then and it is wrong now."
Whistleblower welcomes data breach ruling against Dept of Health
