RTÉ notify Data Protection Commission over memo leak about Irish sports star

They could face a fine.

A memo from the RTÉ newsroom which named an Irish sports star in relation to an alleged assault and was subsequently leaked on social media and messaging apps has led RTÉ to notify the Data Protection Commission (DPC). The DPC confirmed to JOE that they received a breach notification from RTÉ last week and that it falls under the EU’s General Data Protection Regulation (GDPR). Under GDPR, a data controller must notify the personal data breach to the supervisory authority without undue delay after becoming aware of the breach. For private bodies, GDPR has a tiered penalty structure where more serious infringements can merit GDPR penalties of up to 4% of a company’s global revenue. Irish legislation has limited any potential fines levied on public bodies to €1 million. The DPC were not able to confirm which category RTÉ fell under when contacted by JOE. The memo, which contained the line "NB NB NOT FOR PUBLICATION/BROADCAST NB NB", named a sports star and said that they had presented themselves to a Garda Station for questioning in relation to an alleged assault. The rest of the memo contained the running order of other stories broadcast on RTÉ's Morning Ireland radio show that morning. JOE contacted RTÉ on Monday but they declined to comment on the breach.