GAA Statement on Data Breach - Dec 2010

Post date: Jun 24, 2011 1:49:13 PM

A Chara,

We are writing to advise you that Servasport Ltd., has informed the GAA that there has been unauthorised access to the GAA membership database.

Servasport Ltd., a Belfast based company that develops and maintains the GAA membership database, has issued an unreserved apology to the GAA and to our members.

The GAA became aware of the data breach when it was informed on the 19th November 2010 that disks containing the database had been received by the Office of the Data Protection Commissioner and the GPA, who immediately passed the disk to the GAA. The Information Commissioners Office in Belfast also received a disk.

An investigation is being carried out by the Police Service of Northern Ireland and in order to facilitate this investigation the GAA has been unable to inform members until today.

The database contains names and addresses of 501,786 members.

In relation to these members the database holds:

288,511 dates of birth

107,212 mobile numbers

63,695 landline numbers

30,171 email addresses

In the case of 544 members, the database contains a reference to a medical condition and the GAA is writing directly to each of these members setting out the information recorded about them.

167,157 of the members on the database are under 18 years of age. It is GAA policy that mobile phone or email details of persons under 18 years of age should not be stored on any database. The policy states that any such communication should be via the mobile phone or email address of their parent or guardian.

No other GAA IT system is affected by this incident. The database does not contain financial or any other information.

This matter is being taken very seriously by the GAA:

The GAA is working closely with the Office of the Data Protection Commissioner, the Information Commissioners Office and the Police Service of Northern Ireland

Deloitte has been engaged to undertake an independent review of Servasport and other suppliers of IT to the GAA

All clubs have been sent this email

The GAA has set up an Information Line

Any member or any parent/guardian with any questions, or who wishes to establish whether data relating to them has been affected by this incident, should contact the Information Line on Lo Call Number : 1890 987 807 or 0800 0114787 (from Six Counties) 8am to 8pm daily.

The compilation of the GAA database is the result of enormous effort by our volunteers across the country. The GAA greatly regrets that this incident has occurred. We would ask for your help by informing your members of the contents of this email.

Páraic Ó Dufaigh

Ard Stiúrthóir