The PULSE Printout
On a Monday morning, you are the inspector in a district office. A probationer asks to speak to you privately. She says that on Saturday a popular colleague with 20 years' service asked her to 'check a name' on PULSE for a friend who is a landlord. She ran the query and printed a page showing the tenant's address, date of birth, previous convictions and a 'risk to gardaí' flag. She left the printout in the locker room. You find it there, along with a sticky note with the colleague's PULSE username. The tenant has since emailed the station saying their landlord 'knew things he shouldn't'. The colleague is on annual leave until Wednesday. The probationer is tearful and asks you not to 'ruin her career'. Your Superintendent is on leave; the acting Superintendent says 'handle it locally'. There is a station WhatsApp group where the colleague is active.
1. What are your immediate obligations regarding the data breach and the probationer's disclosure?
Read the worked answer
Contain and preserve. I would take the printout and sticky note, log them as evidence, and ensure they are not destroyed or returned to a locker. I would restrict access to the locker area, identify whether copies exist, and preserve PULSE audit logs. The tenant's email should be recorded and acknowledged through the proper channel.
Data breach response. This is an unauthorised disclosure of personal data, including sensitive conviction and risk information. I would notify the Garda Data Protection Officer or data protection unit immediately, assess the risk to the tenant, and record the breach. If there is a risk to the tenant's rights and freedoms, the breach may need to be notified to the Data Protection Commission within 72 hours, and the tenant may need to be informed. I would not wait for Wednesday.
The probationer. I would treat her disclosure as a report, take a written statement while it is fresh, and explain that I cannot promise secrecy or immunity. She may face a disciplinary or criminal process for the query, but her early disclosure is significant mitigation. I would arrange support and separate her from the colleague.
2. How do you handle the colleague and the 'handle it locally' instruction?
Read the worked answer
Do not handle it locally. A local, informal resolution would create a conflict of interest, risk further access to PULSE and undermine public trust. I would record the acting Superintendent's instruction and escalate to the next available senior officer, the Data Protection Officer and the independent oversight body. The colleague's popularity and long service are not reasons to lower the standard.
Preserve and restrict. I would preserve the PULSE audit trail and any relevant WhatsApp messages, and consider restricting the colleague's PULSE access immediately. I would not confront him on leave in a way that allows deletion of evidence. When he returns, he should be given a fair opportunity to account for his actions, with representation if the process becomes disciplinary or criminal.
Fair procedure. I would ensure the investigation is independent of the station WhatsApp group and of anyone close to him. The tenant's complaint should be investigated as a data protection and possible misconduct matter. I would record every decision and reason, because the test is whether the response would withstand scrutiny by the Data Protection Commission, a court or the oversight body.
3. What advice would you give the probationer about her own position and the station WhatsApp group?
Read the worked answer
Her position. I would tell her honestly that running the query without a policing purpose may be a breach of discipline and possibly an offence, but that her decision to report it now is the right thing and will be recorded. She should not minimise or delete anything. She should write her own statement and seek representation or advice before any formal interview.
The WhatsApp group. She should not discuss the matter on the station WhatsApp group, not speculate about the colleague, and not delete messages. If messages already exist, she should preserve them and tell me. She should not contact the colleague about the investigation. If anyone pressures or retaliates against her, she should report it to me or to a designated support person.
Welfare. I would offer peer support or welfare services and check whether she is fit to remain on duty. The message must be consistent: the organisation protects people who report wrongdoing, but it does not promise that wrongdoing has no consequences. Her career is not ruined by telling the truth; it is put at greater risk by concealment.