In the matter of the General Data Protection Regulation
DPC Case Reference: IN-22-2-1
In the matter of the Pre-Hospital Emergency Care Council
Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection Act
2018
Further to an own-volition inquiry commenced pursuant to Section 110 of the Data Protection Act 2018
DECISION
Decision-Maker for the Data Protection Commission:
________________________________
Helen Dixon
Commissioner for Data Protection
03 May 2022
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Contents
1. Introduction .................................................................................................................................... 3
2. Legal Framework for the Inquiry and the Decision......................................................................... 3
Legal Basis for the Inquiry ................................................................................................................... 3
Legal Basis for the Decision................................................................................................................. 4
3. Factual Background ......................................................................................................................... 4
4. Scope of the Inquiry and the Application of the GDPR ................................................................... 7
5. Issues for Determination................................................................................................................. 7
6. Issue 1: The PHECC’s Compliance with Article 37(1) and 37(7) GDPR ............................................ 8
i. Whether the PHECC designated a DPO, published the DPO’s contact details, and
communicated the contact details to the DPC ................................................................................... 9
ii. Findings ..................................................................................................................................... 10
7. Issue 2: The PHECC’s Compliance with Article 31 GDPR ............................................................... 10
i. Requests for Cooperation with the DPC ................................................................................... 10
ii. Finding ....................................................................................................................................... 12
8. Corrective Powers ......................................................................................................................... 12
Reprimand......................................................................................................................................... 13
9. Right of Appeal.............................................................................................................................. 14
Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 15
2
1. Introduction
1.1 This document (‘the Decision’) is a decision made by the Data Protection Commission
(‘the DPC’) in accordance with section 111 of the Data Protection Act 2018 (‘the 2018
Act’). I make this Decision having considered the information obtained in the own volition
inquiry (‘the Inquiry’) pursuant to section 110 of the 2018 Act. The Pre-Hospital
Emergency Care Council (‘PHECC’) was provided with an Inquiry Issues Paper in order to
make submissions on it.
1.2 The PHECC was provided with the Draft Decision on 30 March 2022 to provide it with a
final opportunity to make submissions. This Decision is being provided to the PHECC
pursuant to section 116(1)(a) of the 2018 Act in order to give the PHECC notice of the
Decision, the reasons for it, and the corrective power that I have decided to exercise.
1.3 This Decision contains corrective powers under section 115 of the 2018 Act and Article
58(2) of the General Data Protection Regulation (‘the GDPR‘) arising from the
infringements which have been identified herein.
2. Legal Framework for the Inquiry and the Decision
Legal Basis for the Inquiry
2.1 The GDPR is the legal regime covering the processing of personal data in the European
Union. As a regulation, the GDPR is directly applicable in EU member states. The GDPR is
given further effect in Irish law by the 2018 Act. As stated above, the Inquiry was
commenced pursuant to section 110 of the 2018 Act. By way of background in this regard,
under Part 6 of the 2018 Act, the DPC has the power to commence an inquiry on several
bases, including on foot of a complaint, or of its own volition.
2.2 Section 110(1) of the 2018 Act provides that the DPC may, for the purpose of section
109(5)(e) or section 113(2) of the 2018 Act, or of its own volition, cause such inquiry as it
thinks fit to be conducted, in order to ascertain whether an infringement has occurred or
is occurring of the GDPR or a provision of the 2018 Act, or regulation under the Act, that
gives further effect to the GDPR. Section 110(2) of the 2018 Act provides that the DPC
may, for the purposes of section 110(1), where it considers it appropriate to do so, cause
any of its powers under Chapter 4 of Part 6 of the 2018 Act (excluding section 135 of the
2018 Act) to be exercised and / or cause an investigation under Chapter 5 of Part 6 of the
2018 Act to be carried out.
3
Legal Basis for the Decision
2.3 Section 111 of the 2018 Act requires that the DPC must consider the information obtained
during the Inquiry to decide whether an infringement is occurring or has occurred and, if
so, to decide on the corrective powers, if any, to be exercised. As the sole member of the
DPC as defined in section 15 of the 2018 Act, I perform this function in my role as the
decision-maker in the DPC. In so doing, I am required to assess all of the materials and
submissions gathered during the Inquiry and any other materials which I consider to be
relevant in the course of the decision-making process.
2.4 The Inquiry Issues Paper was issued to the PHECC on 11 February 2022. The PHECC made
submissions on the Inquiry Issues Paper on 04 March 2022. The Draft Decision was
provided to the PHECC via email on 30 March 2022. The PHECC acknowledged receipt of
the Draft Decision on 31 March 2022. The PHECC did not make any submissions to the
DPC in relation to the Draft Decision.
2.5 Having reviewed the information obtained in the Inquiry, I am satisfied that the Inquiry
has been correctly conducted, and that fair procedures have been followed throughout.
This includes, but is not limited to, notifications to the controller, information supplied to
the controller, and opportunities for the controller to comment on the Draft Decision.
3. Factual Background
3.1 The PHECC was established by the Minister for Health and Children, by the Pre-Hospital
Emergency Care Council (Establishment) Order, 2000 (SI 109/2000). The PHECC keeps a
register of every person in the State that holds an Emergency Medical Technology
qualification that wishes to practice in Ireland. The PHECC issues a licence to practice to
allow emergency medical technicians, paramedics, and other pre-hospital medical
professionals to practice in Ireland. The PHECC has a fitness to practice function and is
the body for the recognition of qualifications and educational institutions for pre-hospital
emergency care in Ireland.
3.2 The PHECC also licences organisations to deliver emergency care using PHECC Clinical
Practice Guidelines, and licences the delivery of approved training courses delivered by
educational institutions related to pre-hospital care.
3.3 Pursuant to Article 57 of the GDPR, the Supervision Unit of the DPC set out to monitor
and enforce the application of the GDPR, specifically in relation to Article 37, concerning
the appointment of Data Protection Officers (DPOs).
3.4 As the PHECC was established by an enactment, the Supervision Unit of the DPC
considered that the PHECC was required to designate a DPO pursuant to Article 37(1)(a)
of the GDPR.
4
3.5 A review of the publicly available website to the PHECC indicated that the PHECC may not
have designated a DPO for the organisation. In addition, the DPC had no record of being
notified of the contact details of the PHECC DPO. Article 37(7) of the GDPR requires that
relevant controllers publish the contact details of their DPO and communicate them to
the supervisory authority.
3.6 On 14 September 2020 the DPC sent a letter to the PHECC via email. The email outlined
the role of the DPC concerning Article 57 of the GDPR and provided information on the
obligations contained within Article 37 of the GDPR. The letter requested that the PHECC
publish the contact details of its DPO and notify the details to the DPC within 10 days, or
if a DPO had not already been designated; to designate a DPO, publish the contact details
and notify the DPC within 20 days.
3.7 The email of 14 September 2020 did not elicit a response.
3.8 On 06 October 2020 a second email was sent to the PHECC outlining that no response
had been received. A second copy of the original letter was attached to this email.
3.9 The email of 06 October 2020 did not elicit a response.
3.10 On 13 January 2021 a letter was sent to the PHECC in hard copy, via registered post,
including a copy of the original letter. It was requested that the PHECC normalise or
explain its position no later than 01 February 2021.
3.11 On 14 January 2021 an electronic copy of the material supplied in hard copy on 13 January
2021 was sent directly to the email address of the Director of the PHECC and the publicly
available general email address of the PHECC.
3.12 The DPC did not receive any reply to the above contact efforts and no notification of a
DPO was received.
3.13 In November 2021, following a review of all public sector bodies contacted during the
compliance and monitoring project, it was found that the PHECC was the only public body
or authority that had not engaged with the DPC.
3.14 On 05 November 2021 the Director of the PHECC was again emailed directly. This email
outlined previous efforts to contact the PHECC concerning Article 37 obligations. The
email also reminded the Director of the obligations of the PHECC as a data controller to
cooperate with the DPC carrying out its functions.
3.15 The email of 05 November 2021 did not elicit a response.
3.16 The DPC issued an Inquiry Commencement Letter (‘the Commencement Letter’) by email
and registered post to the PHECC on 11 February 2022 notifying the organisation that the
5
DPC had commenced an Inquiry under and in accordance with section 110(1) of the 2018
Act. The letter contained details of the scope of the Inquiry. A Statement of Issues Paper
was issued with the Commencement Letter.
3.17 The decision to commence the Inquiry was taken having regard to the potential failure of
the PHECC to cooperate with the DPC as required under Article 31 of the GDPR, and the
potential that a public authority may not have complied with its obligations concerning a
DPO pursuant to Article 37 of the GDPR.
3.18 The PHECC provided a submission in response to the Commencement Letter on 04 March
2022. In its submission, the PHECC outlined the actions of the PHECC following receipt of
the Commencement Letter and Statement of Issues Paper regarding the previous
correspondence sent to it by the DPC.
3.19 The submission outlined that the PHECC was able to locate the emails and hard copy
letters of 14 September 2020, 04 October 2020, 13 January 2021 and 05 November 2021.
3.20 The PHECC submission stated that the Director recalled receiving the email on 05
November 2021 and that the Deputy Director at the time was tasked to deal with the
issue. However the Deputy Director retired later in November 2021 and no reply was
issued to the DPC. A pre-planned ‘expression of interest’ for an external DPO, which was
intended to issue at the time, did not issue either.
3.21 The PHECC highlighted difficulties of working remotely during the pandemic while
assisting with the response to the pandemic in terms of legalisation, new registers of
retired, overseas and re-joining paramedics, and the issuing of guidelines and protocols
for emergency medical personnel to engage in COVID swabbing, pronouncement of
death, and vaccine administration.
3.22 Throughout the submission, the PHECC was apologetic and frank in its admission of the
provisional facts presented in the Statement of Issues Paper.
3.23 In its submission, the PHECC stated that it could find no record that it had replied to any
of the correspondence issued to it by the DPC. The PHECC stated that steps were taken
by the Deputy Director before their departure, but that this did not appear to result in
any communication with the DPC. The PHECC apologised for this and stated that the
failure to respond to the DPC was in no way deliberate.
3.24 The PHECC accepted that it falls within the definition of a public body or public authority
and is required to designate a DPO. The PHECC further accepted that it had not
designated a DPO at the date of the commencement of this Inquiry.
6
3.25 The PHECC stated that the absence of a DPO was identified in July 2019 as a risk on its
risk register. The PHECC outlined issues with designating a DPO, including budget and role
conflicts of interest internally.
3.26 The PHECC outlined that three staff were trained in a three day GDPR certificate course,
and in July 2021 a member of staff was identified as a potential part time DPO. However,
none of these efforts resulted in the designation of a DPO.
3.27 In addition, the PHECC stated that it had applied to the Department of Health for a DPO
post in 2020 and had included a DPO post in the PHECC business case for 2021. The post
had not been approved at the time the submission of the PHECC was received.
3.28 In its submission, the PHECC informed the DPC that it had engaged a compliance company
to carry out a GDPR compliance audit in March 2021. This audit identified the
appointment of a DPO as a high priority recommendation.
4. Scope of the Inquiry and the Application of the GDPR
4.1 The scope of the Inquiry, which was set out in the Inquiry Commencement Letter, was to
examine whether or not the PHECC discharged its obligations in connection with the
designation and notification of a DPO, and to determine whether or not any provision(s)
of the 2018 Act and/or the GDPR have been contravened by the PHECC in that context.
4.2 In this regard, the Commencement Letter expressly stated that the scope of the Inquiry
would include Articles 31, 37(1) and 37(7) of the GDPR.
5. Issues for Determination
5.1 The Inquiry Issues Paper identified the questions and issues that arise for determination.
This Decision addresses those issues as follows:
a. First, this Decision considers whether the PHECC infringed Article 37(1) GDPR by
assessing whether the PHECC was obliged to designate a data protection officer and
whether it complied with its obligation to do so. If the PHECC was obliged to designate
a data protection officer, the Decision then considers whether the PHECC infringed
Article 37(7) GDPR by failing to publish the contact details of the data protection
officer and/or by failing to communicate them to the supervisory authority;
b. Second, the Decision considers whether the PHECC infringed Article 31 GDPR by
failing, on request, to cooperate with the DPC as the supervisory authority, by not
responding to emails and a registered letter sent to the PHECC by the DPC when
carrying out tasks pursuant to Article 57 of the GDPR.
7
6. Issue 1: The PHECC’s Compliance with Article 37(1) and 37(7)
GDPR
6.1 Article 37(1) of the GDPR defines the circumstances whereby a controller or processor
must designate a DPO:
The controller and the processor shall designate a data protection officer in any case
where:
(a) the processing is carried out by a public authority or body, except for
courts acting in their judicial capacity;
(b) the core activities of the controller or the processor consists of processing
operations which, by virtue of their nature, their scope and/or their
purposes, require regular and systematic monitoring of data subjects on
a large scale; or
(c) the core activities of the controller or the processor consist of processing
on a large scale of special categories of data pursuant to Article 9 or
personal data relating to criminal convictions and offences referred to in
Article 10.
6.2 Article 37(7) of the GDPR provides for the publication of the DPO contact details and the
notification of the DPO details to the supervisory authority:
The controller or the processor shall publish the contact details of the data protection
officer and communicate them to the supervisory authority.
6.3 The obligation in Article 37(1)(a) applies to controllers and processors in any case where
the processing is carried out by a public authority or body. The 2018 Act gives further
effect to the GDPR and Section 2 defines “public authority” as including:
…(f) any other person established by or under an enactment (other than the Act of 2014
or a former enactment relating to companies within the meaning of section 5 of that Act)
other than—
(i) a recognised school or board within the meaning of section 2 of the
Education Act 1998 but including a recognised school established and
maintained by an education and training board and a board of a school
so established and maintained, and
8
(ii) a management committee established under section 37 (3) of the
Education Act 1998 ,
6.4 Statutory Instrument No. 109/2000 - The Pre-Hospital Emergency Care Council
(Establishment) Order, 2000 established the PHECC. Therefore, the PHECC was
established under an enactment1. Consequentially, the PHECC is a public authority.
6.5 The PHECC is also a controller as defined in Article 4(7) GDPR regarding its processing of
personal data. The PHECC’s statutory functions include, amongst others, maintaining a
register of Emergency Care Practitioners. Section 4(s) of the Pre-Hospital Emergency Care
Council (Establishment) Order, 2000 (as amended by Statutory Instruments 575 of 2004
and 166 of 2008) nominates the PHECC as the authority responsible for establishing and
maintaining that register.
6.6 I find that the PHECC was obliged to designate a data protection officer pursuant to
Article 37(1)(a) GDPR in circumstances where it is a controller that carries out processing
as a public authority. This obligation to designate a data protection officer applied from
25 May 2018, the date of application of the GDPR. Consequently, the PHECC was also
obliged to publish the contact details of the data protection officer and to communicate
them to the DPC.
i. Whether the PHECC designated a DPO, published the DPO’s contact details,
and communicated the contact details to the DPC
6.7 In the submission of the PHECC to the Inquiry Issues Paper, it accepted that it had not
designated a data protection officer at the date of the Inquiry Commencement. The
PHECC further accepted that is falls within the meaning of a public body or public
authority and was therefore required to designate a DPO. The PHECC apologised for not
designating a DPO, for not publishing the contact details of the DPO, and for not notifying
the DPC of the PHECC DPO contact details, as one was not designated.
6.8 The PHECC did outline that not having a DPO designated was identified as a risk on the
PHECC risk register in 2019. The PHECC also stated in its submission that an external GDPR
audit identified the fact that no DPO had been designated was a high priority issue. The
PHECC outlined difficulties in filling the position of a DPO, but accepted that one should
have been designated. The PHECC undertook, on 04 March 2022, to notify the DPC of
their DPO imminently.
1
Section 2 of the Interpretation Act 2005 provides that:
“enactment” means an Act or a statutory instrument or any portion of an Act or statutory instrument;
9
6.9 The PHECC notified the DPC of their newly designated DPO on 07 March 2022. The
contact details of the DPO have also been published on the PHECC website, under the
privacy policy.
ii. Findings
I find that the PHECC infringed Article 37(1) GDPR by failing to designate a data protection
officer between 25 May 2018 and 11 February 2022 (the date of commencement of this
Inquiry).
I find that the PHECC also infringed Article 37(7) GDPR by failing to publish contact details for
a data protection officer and by failing to communicate contact details to the DPC between
25 May 2018 and 11 February 2022.
7. Issue 2: The PHECC’s Compliance with Article 31 GDPR
7.1 Article 31 of the GDPR provides the obligation to cooperate with a supervisory authority:
The controller and the processor and, where applicable, their representatives shall cooperate,
on request, with the supervisory authority in the performance of its tasks.
7.2 Article 57(1) GDPR provides:
Without prejudice to other tasks set out under this Regulation, each supervisory authority
shall on its territory:
(a) monitor and enforce the application of this Regulation;
…
i. Requests for Cooperation with the DPC
7.3 Article 31 of the GDPR obliges data controllers and processors to cooperate with the DPC
as a supervisory authority in the performance of its tasks. Article 57 of the GDPR outlines
the tasks of a supervisory authority. The first task listed in Article 57 is to monitor and
enforce the application of [the GDPR].
10
7.4 The DPC, pursuant to Article 57 of the GDPR sought to monitor and enforce the
application of the GDPR, specifically in relation to obligations contained in Article 37 of
the GDPR concerning the designation of a DPO.
7.5 The PHECC was written to by the DPC, using the general contact email address available
on the website of the PHECC, on 14 September 2020. It was outlined in the letter attached
to the email that the contact concerned a task being carried out by the DPC pursuant to
Article 57 of the GDPR. The letter set out that a review of the DPC’s records indicated that
the DPC had not received a notification of the data protection officer designated for the
PHECC. The letter went on to request that the PHECC respond to the letter within 10
working days if the position set out was inaccurate, or, if the position outlined was
accurate, the letter requested the PHECC to notify the DPC of the contact details and to
make them public within 20 working days. When no response was received, the email
address was confirmed as correct by phoning the PHECC directly. The letter was emailed
again to the PHECC on 06 October 2020.
7.6 A letter was sent to the Director of the PHECC in hard copy, via registered post on 13
January 2021. This letter explained that no response had been received to the previous
contact efforts. In the letter of 13 January 2021, the Director was requested to normalise
or explain the position of the PHECC by 01 February 2021.
7.7 A copy of the letter sent on 13 January 2021, was emailed directly to the Director of the
PHECC and the general PHECC email address on 14 January 2021. The email address of
the Director of the PHECC was confirmed to the DPC as correct by the Department of
Health.
7.8 On 05 November 2021 the Director of the PHECC was again emailed directly, along with
the general PHECC email address. This email outlined the efforts to engage with the
PHECC to that date and reminded the Director of the obligations of the PHECC to
cooperate with the DPC in carrying out its functions.
7.9 I consider that the DPC made all reasonable efforts to secure the cooperation of the
PHECC. The PHECC was contacted in an official capacity, via two publically available email
addresses and by registered post. The PHECC was given sufficient time and information
so that they could cooperate with the DPC concerning the designation of a DPO. The DPC
was acting pursuant to its tasks set out in Article 57 of the GDPR and the DPC clearly
communicated this to the PHECC. At no time between 14 September 2020 and the
commencement of the Inquiry, did the PHECC comply with the DPC’s requests, nor did it
11
issue a reply to any of the correspondence. At no point during this timeframe did the
PHECC notify the DPC of their DPO, or edit their website to include contact details of a
DPO. The PHECC has confirmed, in its submission, that the correspondences sent to the
PHECC were received. The PHECC further confirmed that it could find no record of having
responded to the correspondences of the DPC.
ii. Finding
I find that the PHECC infringed Article 31 GDPR by failing to cooperate with the DPC in the
performance of its tasks, regarding the monitoring and enforcement of the application of
Article 37 GDPR, following the DPC’s requests beginning on 14 September 2020 and
concluding with the final attempt on 5 November 2021.
8. Corrective Powers
8.1 I have set out above, pursuant to section 111(1)(a) of the 2018 Act, my decision to the
effect that the PHECC has infringed Articles 31, 37(1)(a) and 37(7) of the GDPR. Under
section 111(2) of the 2018 Act, where the DPC makes a Decision (in accordance with
section 111(1)(a)), it must, in addition, make a decision as to whether a corrective power
should be exercised in respect of the controller or processor concerned and, if so, the
corrective power to be exercised. The remaining question for determination in this
Decision is whether or not those infringements merit the exercise of any of the corrective
powers set out in Article 58(2) and, if so, which one(s).
8.2 Recital 129 of the GDPR, which acts as an aid to the interpretation of Article 58, provides
that “… each measure should be appropriate, necessary and proportionate in view of
ensuring compliance with this Regulation, taking into account the circumstances of each
individual case ….” In the circumstances of the within Decision, and with particular
reference to the findings arising therefrom, I find that the exercise of one or more
corrective powers is both appropriate, necessary and proportionate for the purpose of
ensuring compliance with the GDPR.
8.3 Having carefully considered the infringements, I have decided to exercise corrective
powers in accordance with section 115 of the 2018 Act and Article 58(2) of the GDPR. I
set out below the corrective powers that are appropriate to address the infringements in
the particular circumstances, and the reasons for that decision, having considered all of
the corrective powers set out in Article 58(2). In summary, the corrective power that I
have decided to exercise is:
12
Article 58(2)(b) – I have decided to issue a reprimand to the PHECC in respect of its
infringements of Articles 31, 37(1)(a) and 37(7) of the GDPR.
Reprimand
8.4 I issue the PHECC with a reprimand in respect of its infringements of Articles 31, 37(1)
and 37(7) of the GDPR. Article 58(2)(b) provides that a supervisory authority shall have
the power to “issue reprimands to a controller or processor where processing operations
have infringed provisions of this Regulation.” In accordance with Recital 129 of the GDPR,
in imposing a corrective power, I must ensure that it is “…appropriate, necessary and
proportionate in view of ensuring compliance with this Regulation, taking into account
the circumstances of each individual case…”.
8.5 I consider that a reprimand is appropriate, necessary and proportionate in view of
ensuring compliance with the infringed Articles as the reprimand will act to formally
recognise the serious nature of all of the infringements. Further, the reprimand
emphasises the requirement for the PHECC to take all relevant steps to ensure future and
ongoing compliance with the GDPR.
8.6 Recital 148 of the GDPR provides:
“In order to strengthen the enforcement of the rules of this Regulation, penalties,
including administrative fines should be imposed for any infringement of this Regulation,
in addition to, or instead of appropriate measures imposed by the supervisory authority
pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be
imposed would constitute a disproportionate burden to a natural person, a reprimand
may be issued instead of a fine.”
8.7 Accordingly, it is clear from the GDPR that a reprimand does not have to be issued in
isolation to the exercise of any other corrective power. I am also obliged to consider
whether a fine in addition to any other measure should be imposed in this case. I do not
consider it appropriate to impose an administrative fine in this Inquiry despite the serious
nature of the infringements. In coming to this conclusion, I have considered the criteria
set out in Article 83(2)(a) – (k) of the GDPR. In particular, in light of the specific
circumstances of the explanation put forward by the PHECC for the infringements and
the efforts made by the PHECC to achieve compliance with Article 37 GDPR I do not
consider that an administrative fine is appropriate, necessary or proportionate in the
specific circumstances of this inquiry. In this respect however, I consider it appropriate to
impose a reprimand in isolation. The decision to impose a reprimand is based on the
serious nature of the infringements of Articles 31, 37(1)(a) and 37(7) of the GDPR.
8.8 I note that the PHECC, since the commencement of this Inquiry, has designated a DPO. I
further note that the contact details of the DPO were communicated to the DPC on 07
March 2022, and have been published by the PHECC. I also note the assertion by the
13
PHECC that its failure to cooperate with the DPC was not deliberate in nature, and I note
the frank admission and apologies of the PHECC in its submission.
8.9 The objective of Article 31 is to ensure that controllers and processors cooperate with
the DPC when the DPC is acting pursuant to its tasks. It cannot be the case that a public
authority or body (or any controller), can fail to answer, in any way, repeated efforts to
monitor and enforce the GDPR.
8.10 The objectives of Article 37(1)(a) and 37(7) of the GDPR are to ensure that public sector
data controllers or processors designate a DPO, and make the public and the DPC aware
of the DPO contact details. The position of a DPO is central to (in this case) the public
sector body being able to meaningfully and consistently comply with all of the provisions
of data protection law. As such, it is a protected position. Data subjects must also have a
meaningful way to contact a DPO for the purposes of Article 38(4) of the GDPR. In
addition, one of the tasks assigned to a DPO in Article 39 of the GDPR is to act at the
contact point for issues relating to processing. Therefore, the Designation and
notification of a DPO is a central element of the GDPR and failure to do so, when required,
is a serious matter.
8.11 I consider that the imposition of a reprimand is appropriate, necessary and proportionate
in light of the importance of ensuring compliance with Articles 31, 37(1)(a) and 37(7) of
the GDPR in the context of protecting the fundamental rights and freedoms of data
subjects and ensuring that the monitoring and enforcement of the GDPR is not impeded.
I consider that it is appropriate, necessary and proportionate to recognise the seriousness
of non-compliance of this nature with a reprimand in light of that objective of ensuring
compliance with Articles 31, 37(1)(a) and 37(7) of the GDPR.
8.12 I do not consider that there was ‘intent’ by the PHECC to fail to cooperate with the DPC
as the supervisory authority. However, the PHECC did receive the correspondence from
the DPC that attempted to engage with the PHECC and to monitor and enforce the GDPR
concerning Article 37 of the GDPR. Having received the correspondences, the PHECC did
not reply and did not bring themselves in to compliance with Article 37 of the GDPR prior
to the commencement of this Inquiry. Therefore, I consider that the formal recognition
of the seriousness of the infringements by means of a reprimand is appropriate and
necessary to ensure compliance with these Articles. A reprimand is proportionate in the
circumstances where it does not exceed what is required to ensure compliance with the
GDPR, taking into account the seriousness nature of the infringements.
9. Right of Appeal
9.1 This Decision is issued in accordance with section 111 of the 2018 Act. Pursuant to section
150(5) of the 2018 Act, the PHECC has the right to appeal against this Decision within 28
days from the date on which notice of the Final Decision is received by it.
14
Appendix: Schedule of Materials Considered for the Purposes
of this Decision
1. Letter sent by attachment to the PHECC 14 September 2020 and 06 October 2020
2. Escalation letter sent to the PHECC in hardcopy 13 January 2021
3. Proof of hardcopy letter posting and delivery 14 January 2021
4. Escalation email sent to the PHECC 14 January 2021
5. Automatic reply from the PHECC 14 January 2021
6. Final escalation email sent to the PHECC 05 November 2021
7. Commencement of Inquiry letter and Statement of Issues Paper issued 11 February 2022
8. Submission of the PHECC received 04 March 2022
9. External GDPR audit report supplied by the PHECC
10. Draft Decision issued to the PHECC on 30 March 2022
15