CHI Tallaght found in breach of data rules over Children’s records

Children’s Health Ireland at Tallaght has been found to be in breach of data protection rules over the storage of children’s personal records by the Data Protection Commission.

The DPC launched an inquiry on 11 August 2025 following a site inspection a month previous after the reporting of protected disclosures to the DPC in June and July 2025.

CHI at Tallaght were found to have failed to ensure personal data within the non-consultant hospital doctor’s office was processed in a way  that ensured its security, or managed and controlled properly.

The DPC stated: “As part of the protected disclosure process, the DPC also became aware that documents containing both sensitive and special category data of children had been over-flowing, and subsequently removed, from a confidential waste bin.

“This bin was located beside the door to the Non-Consultant Hospital Doctor’s (NCHD) office at CHI.”

These issues highlighted security concerns surrounding the confidentiality of children’s personal data.

As part of the Inquiry, the DPC assessed whether CHI complied with its obligations under the General Data Protection Regulation, or GDPR, regarding the confidentiality of paper records stored and retained in the NCHD office at CHI at Tallaght, and also regarding the proper management and control of paper records stored and retained in the NCHD office at CHI at Tallaght.

CHI at Tallaght has been reprimanded and ordered to bring its data processing in line with GDPR, as well as complete a draft Data Protection Impact Assessment and implement actions to minimise the risk of further rule breaches.