Article 83(7) let every Member State decide whether the state can be fined at all. Ireland said yes, capped it at a million, and has now spent most of that twice.

The Data Protection Commission announced a final decision against the Health Service Executive on 2 September. It had been notified to the HSE ten days earlier. A reprimand, a set of corrective orders, and fines totalling €645,000 — and the subject is paper.

Not a cloud misconfiguration and not a third-country transfer. Files in external storage facilities, including a store at St Loman's Hospital in Mullingar, which people who should not have been in it got into. The DPC opened the inquiry on 24 May 2024 after two breach notifications, in October and November 2023. It found the HSE had failed to secure personal data in paper records and had no records management controls at a level appropriate to the risk.

In calculating the fine it treated as an aggravating factor that the HSE had infringed in a similar way before, on the same subject: loss of control over personal data in paper healthcare records.The DPC has exercised corrective powers against the HSE previously, and an earlier decision on the same broad subject sits on its own decisions page. We have not read it for this piece.

Fifteen months earlier the same regulator fined another arm of the same state €550,000.

The most it could have fined either of them is one million euro. That figure is not in the GDPR.

The one sentence that hands the decision back

Article 83(7) reads, in full: "Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State."

Read the operative words twice. Not how much. Whether.

Ireland took the option and used it to cap rather than to exclude. Section 141 of the Data Protection Act 2018 lets the Commission fine a public authority or public body up to one million euro, and lifts the cap where the body is acting as an undertaking within the meaning of the Competition Act 2002. We have not had section 141 open for this piece — the statute book refused the request — and its effect is described here from secondary material. The number is load-bearing. If it is wrong, so is the headline.

Other Member States answered the same question differently. Luxembourg's 2018 law largely excludes the State and the municipalities except where they operate on a competitive market. Denmark routes the penalty through the criminal courts rather than the supervisory authority. We have not built the map of twenty-seven answers and will not imply that we have. What is established is that the same facts, in the same kind of body, produce a fine in Dublin, a prosecution in Copenhagen, and somewhere else a letter.

An Irish public authority or public body

€1,000,000

Fixed by section 141 of the Data Protection Act 2018, whatever the body is and whatever it did. Both fines above were imposed under this ceiling.

A private controller, same infringement

€20,000,000, or 4% of worldwide annual turnover, whichever is higher

Article 83(5) GDPR. For a controller of any size the second limb is the operative one, and the bar does not end where this drawing does.

The money moves between two accounts of the same state

Ten corrective powers sit in Article 58(2), lettered (a) to (j). A warning, a reprimand, orders to comply, an order to tell the people affected, a limitation on processing, orders to rectify or erase, withdrawal of a certification, a fine, a suspension of transfers. The fine is one of ten. It is also the one every account of these decisions leads on, including this one, four paragraphs ago.

And it is the least likely to change anything. A department pays out of money the Oireachtas appropriated to it, and the payment lands back in the exchequer. We could not establish from this desk how either fine was actually accounted for, and neither decision says. Article 83(1) asks that a fine be effective, proportionate and dissuasive, which is a test drafted with a controller that has shareholders in mind.

A fine on a government department is a transfer between two accounts of the same state. The order is the only part of the decision a citizen would ever notice.

The part of the Department of Social Protection decision that is visible from outside the building is the order. The DPC found the Department had no valid lawful basis for collecting biometric facial templates during SAFE 2 registration, had retained them without justification, had not told people in the terms the transparency provisions require, and had left required elements out of its impact assessment. In 2021 it held facial templates for around seventy per cent of the population of the State.That is the DPC's figure and it is for 2021. What the holding is today, nobody has published. SAFE 2 registration is not optional for a person who needs a Public Services Card in order to be paid.

The order requires the Department to stop processing that biometric data within nine months if it cannot identify a valid lawful basis. Nine months from mid-June 2025 landed around March 2026, which was six months ago.

Nobody has said what happened in March

On 7 July 2025 the Department issued High Court proceedings challenging the decision and said it believes its processing complies with data protection law. Irish Legal News reported both. Whether the proceedings stayed the order, whether any templates were deleted, whether SAFE 2 runs today on the basis it ran on last year — we could not establish, and nothing we have read answers it either.

So: a supervisory authority found the State's own identity infrastructure unlawful, ordered it wound down absent a legal fix, and the State went to court to say otherwise. The fine was paid, or netted, or appropriated. It is not the interesting number.

None of this is new law

The cap has been in Irish law since 2018, and the power to fine a public body has been available to the Commission for just as long. What changed is not the instrument. What changed is that somebody used it twice in fifteen months, and that the second time the regulator wrote down that the body had done this before and priced it accordingly.

That is the only mechanism in the set that compounds. A statutory ceiling does not rise. An aggravating factor does. Two decisions against arms of the State are a rounding error in a year the DPC closed 11,734 cases. They are also the only ones where the maximum is fixed by an act of the Oireachtas rather than by turnover.

The next Irish public body to appear in a decision arrives in front of a regulator that has now said, twice and in writing, what a repeat looks like. The ceiling will still be a million.