Sanction RGPD Data Protection Authority of Ireland — University of Limerick : 98 k€ (2025)
- Autorité de contrôle
- Data Protection Authority of Ireland
- Pays
- Irlande
- Entreprise / secteur
- University of Limerick
- Montant de l'amende
- 98 k€
- Date de la décision
- 10 décembre 2025
- Fondement juridique
- Art. 5 (1) f), Art. 30 (1), Art. 32 (1), Art. 33 (1), Art. 34 (1)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Irish DPA has imposed a fine of EUR 98,000 on the Universtiy of Limerick. The controller suffered multiple data breaches resulting from successful phishing attacks, which gave the attackers access to multiple employee accounts. The attackers gained access to the personal data stored in the accounts and were able to successfully divert emails to hidden folders. The controller also failed to adequately record processing activities and fulfil information obligations regarding the data breaches.