Tirlán committed a serious breach of data protection legislation when a substantial number of its suppliers received milk statements containing the personal data of other suppliers.

Personal data is information about a living person, where that person either is identified or could be identified.

As required by law, Tirlán took immediate steps to deal with this by notifying the Data Protection Commissioner (DPC) and requesting those who received the wrong statements to return them and to confirm they had not been distributed.

If a supplier received the wrong statement and shares it to third parties then they are also committing a breach of the data protection legislation.


There has been concern expressed on social media and elsewhere by Tirlán suppliers as the milk statements provide not just the name and address of the individual but a range of potentially commercially sensitive information. A careful reading of the statement could provide a detailed overview on the person’s business.

If you are aware your statement was sent to a third party in error or you have a concern, you should write to Tirlán and ask for confirmation on this and that your data has been held in accordance with the GDPR legislation.

A supplier also has the option to go to the DPC to lodge a formal complaint. It has a clear process for this online at www.dataprotection.ie.

This will be separate to the notification process made by Tirlán. Any investigation by the DPC could result in fines for Tirlán.


It has been suggested by some that suppliers may be entitled to damages for a data breach.

There are currently a number of cases being referred to the European Court of Justice to seek clarity on the scope of damages for data breaches. However, the general thinking is that if the personal data is returned and the supplier has suffered no more than concern and upset for a short period of time, then, at best, an award of damages by a court would be at the very low end.

However, where the information is more extensive and the breach could cause more serious damage to the person’s business, then the supplier could be entitled to look for a higher level of damages. Each case will have to be decided on its own merits.