The Data Protection Commission (or DPC) has published its annual report for 2023. The Irish body has imposed administrative fines of between €15,000 and €750,000 on five firms.

The Data Protection Commission (DPC) is the independent national authority responsible for upholding the fundamental right to protect the personal data of people in the European Union.

We will understand it when we read his report “2023 was a busy year for the protection of personal data rights (GDPR). This year saw a significant increase in complaints handled by the Data Protection Commission, with record fines issued and corrective orders imposed following cross-border internal investigations..

Regarding GDPR, the highlights of the 2023 Annual Report are as follows:

• The DPC issued 19 final decisions resulting in administrative fines of €1.55 billion and multiple reprimands and compliance orders, including:

  • In May 2023, the DPC announced the conclusion of its GDPR investigation into Meta Platforms Ireland Limited regarding the transfer of data from the EU to the United States. The decision fined Meta Ireland €1.2 billion, in addition to an order to comply with its processing operations.
  • In September 2023, the body issued its final decision as part of its investigation into Tik Tok Technology Limited. The investigation concerned the processing of personal information relating to children by TikTok. Tik Tok was ordered to comply with its processing operations and fined €345 million.

• In 2023, the Dublin Circuit Court upheld decisions by the DPC to impose administrative fines of between €15,000 and €750,000 on five different organisations. All these fines were collected and transferred to the Irish Treasury.

In February 2023, the DPC issued its final decision in its inquiry into Bank of Ireland. The investigation into a series of data breaches in the Bank of Ireland 365 app involved a reprimand, a fine of €750,000 and a processing compliance order.

In January 2023, the agency issued a final decision in its investigation of Centric Health. The investigation began following a ransomware attack that affected patient data contained in Centric's patient administration system, affecting more than 70,000 patients.

Around 2,500 patients were permanently affected and their data was deleted due to unavailability of backup. The decision reprimanded Centric and fined it a total of €460,000.

Of all the files received in 2023, 2,600 progressed through the complaints handling process and 8,600 were disposed of relatively quickly. DPC resolved 3,218 complaints through formal complaints procedures (this figure includes complaints received before 2023).

Our report is that the DPC received 156 valid cross-border complaints (as the EU/EEA lead supervisory authority). 82.5% of cross-border complaints received since 2018 by the DPC Lead Supervisory Authority have been resolved.

Finally, the DPC postponed or modified four planned Internet platform projects with implications for individuals' rights and freedoms.