The corporate watchdog has widened its governance investigation of Independent News & Media to include its handling of a potential data breach involving personal information at the newspaper publishing group.
The Office of the Director of Corporate Enforcement (ODCE) is investigating INM after a whistleblower complaint by the company's former chief executive Robert Pitt. During the course of this inquiry the ODCE became aware of the potential breach.
An email that originated outside the company, and said there has been a major data breach at the company, has also been circulated recently to several senior journalists at the publisher, who notified management.
INM confirmed to The Irish Times that there was "a potential personal data breach" and that it recently hired the consultancy Deloitte to look into the matter. It is understood that a subcommittee of the board of directors was also established to examine the breach.
"INM can confirm that it did notify the Office of the Data Protection Commissioner of a potential personal data breach in August 2017," the company said. But the company added that the commissioner's office told it the matter "did not constitute a personal data breach under the terms of their voluntary code of practice and was, therefore, recorded as a non-breach on their files". INM said Deloitte's mandate from INM's board was "terminated when it was established that no breach had occurred".
It is understood, however, that, despite the data-protection commissioner’s clearance, the scope of the ODCE inquiry now includes the nature of the potential breach and the organisation’s handling of it. The ODCE investigation has therefore moved beyond Mr Pitt’s original whistleblower complaint, which was over a boardroom row about an aborted bid for Newstalk, the radio station owned by INM’s biggest shareholder, Denis O’Brien.
INM's statement in response to queries from The Irish Times did not mention the widening of the ODCE's inquiry. When asked to specify when the "potential breach" occurred, it declined to comment further.
Profit warning
In a trading statement last week INM issued a profit warning that it partly blamed on mounting legal costs for the ODCE investigation, which it said were ongoing and “significantly higher than previously estimated”.
When asked to comment, the Office of the Data Protection Commissioner confirmed it received a notification in August and that the matter was not recorded as a breach of personal data. The office would not comment when asked if the ODCE had been in contact.
When the ODCE was asked if its inquiry into INM now includes investigating the suspected data breach, a spokesman for the watchdog said it does not comment on individual cases. “We don’t comment at all, and we are precluded from doing so under the confidentiality provisions that we operate under.”
Deloitte made no comment on its involvement.
INM has been dogged by a series of corporate-governance issues since it was revealed a year ago that Mr Pitt had fallen out with Leslie Buckley, the chairman and a representative of Mr O'Brien. The two men had a dispute about how much INM should bid for Newstalk. Mr Pitt was not prepared to meet Mr O'Brien's asking price. He later made a whistleblower complaint to the ODCE and refused to back Mr Buckley's re-election to the board at INM's agm this year.
Mr Pitt left INM last month, and was replaced by the company veteran Michael Doorly. Ryan Preston, the chief financial officer, who also made an internal whistleblower complaint at INM about the Newstalk bid, remains in his position.
