Clients were put at risk by 60 data breaches in the Probation Service

The Probation Service has suffered 60 data breaches over the past three years, with details of clients going astray, client files reported missing and letters being sent to the wrong addresses.

The service, which deals with sensitive information involving ex-prisoners and others convicted through the courts, said there had been 12 breaches last year, 14 in 2022 and 34 in 2021.

It said there had been only one highrisk incident when an item of unregistered post was undelivered and went missing from a postal depot.

A note of the incident said: “We contacted An Post to ensure they are aware of all breaches relevant to them, this one included, so they could take any remedial action to improve their processes.”

There were seven medium-severity incidents, which included the loss of a client file that despite multiple searches could not be found.

In another case, two letters for individuals on probation were sent to the incorrect address before it was discovered to be the wrong house.

There was also one case where a text message was incorrectly sent to somebody’s next of kin, while in another a letter with the correct address ended up being delivered to the wrong home.

The Probation Service also classified as medium-risk an incident when a client email was sent to the wrong person.

A log of data breaches said: “Deletion of the email was confirmed by unintended recipient.”

There were 52 cases that were categorised as low-risk, according to information released under Freedom of

Information by the Probation Service. Among those incidents were misfiled client reports, texts sent in error, lost phones and another device getting stolen.

A log of one of the incidents said: “The process for disabling lost corporate devices was followed.”

An information note from the Probation Service said many of the breaches involved information only being sent to “trusted recipients” — that is, the Department of Justice or subsidiary agencies.

In other cases, emails or other correspondence were sent to the wrong person within the Probation Service itself.

“Low-risk refers to breaches where any consequence or harm to the data subject is less severe and also much less likely to occur. Most letters we sent clients have minimal information contained in them, just what is necessary,” the service said.