11 Apr 2018 17:34
INM investigating data security incident; co-operating with the Office of the Data Protection Commissioner
A data security incident occurred in 2014 as a result of which there is a risk that personal data held on INM's servers as at 2014 may have been put at risk of unauthorised disclosure. The INM board became aware of new information suggesting this possibility arising from information that was included in materials sent by the Office of the Director of Corporate Enforcement ("ODCE") on 23 March 2018 to INM's solicitors in respect of a court application which is before the High Court on 16 April 2018.
The data security incident involved a number of INM's back-up tapes, containing back-up copies of electronic data stored on INM's servers as at 2014, being provided to a third party service provider on the instructions of the then-Chairman of INM. The INM board only became aware of this incident in August 2017 and promptly notified the Data Protection Commissioner on learning of the matter at that time.
Prior to receiving the court papers from the ODCE in March 2018 in respect of the court application, INM's understanding from the persons directly involved in this exercise was that the data recorded on these back-up tapes was restored and searched for the specific purpose of seeking details regarding the terms and value for money of a particular long-term contract for professional services between INM and a service supplier. INM has now seen documentation in the context of the ODCE court application which suggests that the data may have been restored and searched more extensively and for a different purpose. INM does not know whether any such searches were in fact undertaken or for what purpose but based on the limited information currently available to INM it seems possible that they were. INM also does not know to whom any results of any such searches might have been provided.
INM is taking these matters very seriously. INM is conducting an investigation and is also co-operating with the Office of the Data Protection Commissioner.
We will provide an update to any affected individuals upon the completion of our investigation.
Ends