Over 6,700 data breaches reported to Data Protection commissioner

More than 160,000 breaches were recorded across Europe over the past 12 months, with European regulators dishing out fines of more than €102m in that time.

In Ireland, members of the public reported 132.52 breaches per 100,000 people, putting this country second in the rankings per capita behind only the Netherlands, which had 147.2 per 100,000.

Despite these figures, the Data Protection Commission has yet to levy any fines against firms for breaching the regulation.

Data protection is a hot-button topic in Ireland, with the commission’s status as the ‘one-stop-shop’ regulator for a cadre of giant data companies, such as Google and Amazon, which have European headquarters here.

Despite this, the State has become embroiled in a number of controversial projects with assorted privacy issues, such as that of the public services card, a court battle concerning which is unfolding between the Government and Data Protection Commissioner Helen Dixon.

John Magee, intellectual property and technology partner at DLA Piper, said in light of the report’s findings that it was “no surprise” to see Ireland featured so high on the list. “GDPR has driven the issue of data breach well and truly into the open,” said Mr Magee.

“The rate of breach notifications has increased by over 12% compared to last year’s report and it is no surprise to see Ireland — a strategic global hub for data-rich businesses across many sectors — once again ranked highly on number of breach notifications.”

Under GDPR, the maximum fine that an independent regulator can levy against a company is either €20m or up to 4% of the firm’s turnover, whichever is higher.

State bodies here can be held liable for a lesser fine of €1m, per the 2018 Data Protection Act which enshrined GDPR in legislation.

Fines of just €114m have been levied to date across Europe since GDPR took effect on May 25, 2018.

Mr Magee indicated that statistic is indicative that “we are still in the early days of enforcement”.

“We expect to see momentum build with more multi-million-euro fines being imposed over the coming year as regulators ramp up their enforcement activity,” he said.

The Data Protection Commissioner has over 70 investigations under way for possible data breaches — 21 of those are against large tech companies like Google and Facebook.

Despite this, Ireland is one of just seven countries within the wider European Economic Area to have failed to deliver financial sanctions against companies, the others being Estonia, Finland, Iceland, Liechtenstein, Luxembourg, and Slovenia.

The UK has delivered one such fine, for €320,000, but has filed two notices of intent to levy fines worth €213m and €115m against companies from the airline and hospitality industries in the immediate future - the larger figure being more than four times the currently largest fine levied of €50 million, delivered in France against Google.