ICRIR Statement: Data breach (Updated)
Update on 28 March 2025:
Following the ICRIR’s reporting of this incident to the Information Commissioner’s Office (ICO), a decision was issued by the ICO on 28 March 2025 as follows:
“We have considered the information you have provided and we have decided that no further action by the ICO is necessary on this occasion. This information is based on the information we have recorded about the breach.”
The ICRIR experienced a limited data breach on the afternoon of Tuesday, March 18 2025.
The names of 25 people, principally Requesting Individuals (RI), were mistakenly disclosed to a single recipient who had previously sought assistance from the Commission.
This was caused by an administrative error in an email address field. No sensitive or special category information was disclosed. The mistake was discovered within several hours and addressed swiftly.
The recipient has confirmed the information was deleted.
All affected RIs have been contacted, with a sincere apology and offer of further advice or support.
All other RIs, including those no longer with the Commission, have also been advised.
The Commission takes very seriously its responsibilities in protecting the privacy of individuals and the security of information entrusted to us.
The Commission is very sorry for this error.
An internal investigation is now underway, and a full report has been sent to the Information Commissioner’s Office.