Joe Cluxton

TUSLA STAFF SNOOPED ON MISSING BOY KYRAN DURNIN’S FILES AS GARDAÍ LAUNCHED MURDER INVESTIGATION An exclusive report in today’s Irish Daily Mail (29 October 2026) by political correspondent Muiris Ó Cearbhaill reveals that Tusla investigated employees for inappropriately accessing highly sensitive records concerning missing schoolboy Kyran Durnin. An inquiry identified eight breaches, including one on 17 October 2024, the day Gardaí upgraded their investigation into Kyran’s disappearance to a murder inquiry. Kyran was reported missing in August 2024, but Gardaí believe he may have died in 2022, when he was just six. Tusla’s case-management system records who opens files and requires staff to confirm a legitimate business purpose. Nevertheless, employees with no professional role in Kyran’s case accessed his confidential records. Some reportedly claimed a legitimate business reason for opening them. More than 20 staff members were examined during the inquiry. According to the newspaper, eight breaches were upheld, and further incidents were referred for investigation. The article does not identify the employees or say whether disciplinary action followed. Sources familiar with the investigation expressed concern that inappropriate access could disrupt the criminal inquiry. However, the newspaper provides no evidence that Tusla staff leaked information, interfered with evidence or obstructed Gardaí. One source characterised the incidents as staff being “nosy”; another indicated that they were considered low risk because there was no evidence of an intention to share information externally. The revelations are especially troubling given Tusla’s previous data-protection failures. In 2020 the Data Protection Commission fined the agency €200,000 over several breaches. One involved a staff member accessing records on behalf of a friend who was estranged from the person concerned. Tusla was required to improve safeguards against unauthorised access. Yet the Mail reports that Tusla failed repeatedly to honour commitments to audit staff access logs. Regular national and local auditing reportedly began only in the six months before these latest revelations, despite earlier commitments to the regulator. Tusla confirmed that management discovered the matter and that an immediate investigation was conducted. It described the incident as low risk, confirmed that breaches were upheld and referred to the Data Protection Commission, and said mandatory data-protection training for staff and contractors was being introduced. Kyran was not in State care, but Tusla had contact with him and his family and alerted Gardaí to significant concerns in August 2024. His disappearance and suspected death remain the subject of public concern. The questions for Tusla’s leadership are unavoidable. Why could staff access a missing child’s confidential records without a legitimate reason? Why were promised audits delayed? What consequences followed for those responsible? And what assurance can families have that their most private information is protected? There is no evidence in the report that staff disclosed Kyran’s information outside Tusla or compromised the Garda investigation. But accessing a vulnerable child’s records out of curiosity is itself a serious breach of trust. Tusla is entrusted with protecting children. That responsibility must include protecting their confidential information — especially during a murder investigation.