Garda watchdog Fiosrú logged 38 data breaches in the space of a year-and-a-half, including sensitive information shared with the wrong people and a laptop left in a taxi.
One of the most serious breaches involved an email sent to the wrong person with two attachments containing personal information including a name, address, age, gender and details of allegations.
The incident was categorised as high risk, reported to the Data Protection Commission (DPC) and the individuals involved were notified of what happened.
In another case, a Fiosrú staff member left a laptop in a bag in a Dublin taxi along with a notebook and a document.
The incident was reported to the DPC although the bag was recovered later that day and Fiosrú said the laptop had not been accessed.
The other missing items were also recovered, according to a log of breaches.
Records released under FOI also detail how a letter meant for a complainant was accidentally sent to the Garda Commissioner.
A note of the incident said: “Sixteen update letters were to be sent to the Garda Commissioner and the Complainant.
“The [official] tasked with completing the task, inadvertently forwarded the Complainant’s letter to the Garda Commissioner.”
Another email intended for Fiosrú’s own data protection unit was instead sent to the data protection office at Dublin Bus.
“Staff members’ emails only personal data disclosed,” said a log. “Dublin Bus has confirmed double deletion of emails and that they haven’t been shared with third parties.”
Four of the incidents reached the threshold for mandatory reporting to the DPC, according to a statement provided by the watchdog.
The records covered incidents during 2025 and the first six months of this year, spanning the period in which the Garda Síochána Ombudsman Commission was replaced by Fiosrú.
The database also lists repeated cases of emails, attachments and correspondence being sent to incorrect recipients, including material relating to complainants and garda members.
One case saw a staff member leave a mobile phone in a shop while another involved a copy of an online complaint submission getting issued to an “unintended recipient.”
However, most cases were classified as having a “low” level of risk and did not require notification to the DPC.
Asked about the records, a Fiosrú spokesperson said: “In all the recorded incidents, appropriate steps were promptly taken to mitigate the largely low-level breaches, most of which involved email correspondence.
“Fiosrú has security software on all of its laptops including two-factor authentication systems and passcode technology for network access. Each laptop hard drive is encrypted.”
The garda watchdog also said it had introduced data-loss prevention software to ensure that all staff members verify the correct identity of external email recipients and sensitive content attachments before sending messages.
“The software integrates directly into Outlook and prompts users to review and verify external recipients and sensitive content before sending,” the spokesperson added.