The data-protection watchdog has launched an inquiry into the HSE’s storage and retention of personal data.

The Data Protection Commission (DPC) said that the probe was linked to data contained in paper records held by the HSE through its use of external storage facilities, and breaches of security that were notified to it by the HSE.

The breaches related to two specific locations that were accessed by unauthorised third parties, and the circulation of videos taken from these locations showing paper medical records at these facilities.

The HSE said that it would co-operate fully with the inquiry.

"The HSE takes all breaches of data protection seriously, and manages all breaches of data protection in line with data-protection legislation and HSE policy," a HSE spokesperson told RTÉ.

Cases up 20%

The news came as the DPC’s annual report for 2023 showed that it imposed record fines of €1.55 billion last year as a result of 19 finalised decisions.

The figure included a fine of €1.2 billion for Meta after a GDPR inquiry into the company’s data transfers from the EU to the US.

The DPC received 11,200 new cases from individuals in 2023 – a 20% increase on 2022. Of all cases received last year, 2,600 progressed to the complaint-handling process.

Direct marketing

The watchdog resolved 3,218 complaints through the formal complaint-handling process last year – a figure that includes complaints received before 2023.

It received 156 valid cross-border complaints in its role as EU/EEA lead supervisory authority for many big technology companies headquartered in Ireland.

A total of 237 investigations into electronic direct marketing were concluded in 2023, with the DPC prosecuting four companies for sending unsolicited marketing communications without consent.

The court returned convictions on all charges.