![Forvis Mazars Expands to Cork with James Byrne&Co](https://www.forvismazars.com/var/mazars/storage/images/_aliases/card/6/8/8/7/61477886-1-eng-GB/58ac8cf2ec33-Forvis-Mazars-Expands-to-Cork-with-James-Byrne-Co-Header.jpg.webp)
Forvis Mazars expands into Cork
Firms plans to grow to 150 employees in the Southwest over the next two years
The Irish Data Protection Commission (DPC) has released its DPIA Blacklist highlighting processing activities which require a DPIA and its Activity Report detailing the frequency of complaints and breaches reported. Additionally, Mazars in association with McCann FitzGerald conducted their third GDPR survey, which provides interesting insights into GDPR from an Irish business leaders perspective.
The DPC’s activity report for the first half of 2018 (pre-GDPR) was published on the 23 November 2018, highlighting a lot of great insights for Irish businesses. The two activities we are most interested in: complaints received and audit findings.
In the first half of 2018, 23 audits were carried out. These audits take place on a strategic basis guided by complaints received.
The main themes of these audits:
By the May 25th, the DPC had received 1,249 complaints, a breakdown of which is provided below. This indicates that the number of complaints received by the DPC in 2018 is set to match 2017, where 2,642 complaints were received.
Our third GDPR survey, in association with McCann Fitzgerald, was published this month. While we have observed that many leaders have increased confidence in their ability to reach a material level of compliance in comparison to 2017, we are also seeing a rise in expressed difficulties around areas such as demonstrating compliance, consent mechanisms and privacy notices as well as assessing and documenting privacy risks. This is not surprising as it shows respondents are becoming increasingly knowledgeable and have a growing awareness of the stringent obligations introduced by the GDPR.
The DPC published their adopted blacklist, following a public consultation and approval by the European Data Protection Board, on 15 November 2018.
This blacklist details processing activities which require a Data Protection Impact Assessment (DPIA), in line with Article 35 of the GDPR.
As we mature in our capability to accurately assess the level of risk associated with security incidents and data breaches, we are becoming increasingly aware of the fact that many organisations in Ireland are overreporting—a sentiment which is shared with the DPC.
In response to breach notifications, we are seeing the DPC remind organisations of situations where breaches are likely non-reportable. Looking back to the Article 29 Working Party guidance on data breaches, we are reminded of the following such situations:
Where the controller knows this individual, their procedures and relevant details, the controller may have a reasonable level of assurance that the third party shall not read or access the data which was sent in error and will comply with instructions to return/destroy it.
Note: This should be considered on a case-by-case basis, and in certain scenarios, a likely risk may still be present, rendering the breach reportable to the DPC.
The increased financial and reputational damage associated with cyber security instances which become personal data breaches has put cyber insurance on the agenda of management boards across the country. A conglomerate of insurance boards have released a paper to aid organisations in preparing for cyber insurance.
This paper highlights the need to consider the extent of exposure to sensitive data the organisation has when taking out a cyber insurance policy. What does paper doesn’t explicitly cover is type of cyber insurance which will cover organisations in the event of a sanction from the supervisory authority (the DPC) or the cost of securing a major data breach. This article from AIG is very useful and details the elements of GDPR which AIG deems to be insurable, namely:
An interesting point which is not stressed here is the need to cover indemnity clauses in data processing situations if an organisation has indemnified another in the event of a data breach. Or in situations where a processor has not agreed to indemnify the data controller, should they cause a data breach.
This website uses cookies.
Some of these cookies are necessary, while others help us analyse our traffic, serve advertising and deliver customised experiences for you.
For more information on the cookies we use, please refer to our Privacy Policy.
This website cannot function properly without these cookies.
Analytical cookies help us enhance our website by collecting information on its usage.
We use marketing cookies to increase the relevancy of our advertising campaigns.