An investigation has been launched into two data breaches at the Health Service Executive last year.
The Data Protection Commission (DPC) says its inquiry concerns the "storage and retention of personal data contained in paper records" and breaches of security at external storage facilities where these records were held.
"The breaches notified to the DPC related to two specific locations which accessed by unauthorised third parties," the DPC said.
Videos taken from these locations showing paper medical records were also circulated on social media.
The HSE has received a notice of commencement of an inquiry from the DPC and says it will fully cooperate.
A hacker using a laptop during a simulated data breach, 19-12-13. Image: Artur Marciniec / AlamyIt comes as the Data Protection Commission annual report shows it issued 19 finalised decisions resulting in fines totalling €1.55 billion last year.
Among these was a fine of €1.2 billion on Meta Ireland in May 2023 concerning data transfers from the EU to the US.
Last September, the DPC also issued fines totalling €345 million against TikTok after examining the processing of personal data relating to children.
The office also fined Bank of Ireland €750,000 in relation to a series of data breaches on the Bank of Ireland 365 app.
There was a reprimand and an order to bring processing into compliance.
The DPC says it received 11,200 new cases from individuals in 2023, representing a 20% increase on 2022.
Some 2,600 of these cases progressed to the complaint handling process with 8,600 being dealt with "relatively expeditiously".
The DPC concluded 11,147 cases last year.
'Significant increase in complaints'
Commissioner Dale Sunderland said it was a busy period.
"The year saw a significant increase in complaints dealt with by the Data Protection Commission with record fines issued and corrective orders imposed following cross-border and national inquiries," he said.
"Throughout 2023, the DPC sought to uphold the individual’s right to the protection of their personal data.
"This critical work was greatly supported by Data Protection Officers and data protection staff and teams in organisations across the public, private and voluntary sectors who play a critical role in championing data protection rights, acting as a critical friend to those organisations by keeping the compliance conversation front and centre," he added.
The DPC also received 6,991 valid breach notifications in 2023, representing a 20% increase on 2022.
