LegalizeReform history
Data Protection Act , 1988
2 versions
· 1988-07-13
2025-11-10
IE-1988-act-25 — consolidated version 2025-11-10
Changes on 2025-11-10
@@ -1,26 +1,32 @@
# Data Protection Act , 1988
*Preliminary*
##### 1 Interpretation and application of Act.
**1.**—(1) In this Act, unless the context otherwise requires—
##### 1. **Interpretation and application of Act.**
1.—(1)In this Act, unless the context otherwise requires—
F1["the Act of 2003" means the Data Protection (Amendment) Act 2003]
“appropriate authority” has the meaning assigned to it by the Civil Service Regulation Acts, 1956 and 1958;
F1["automated data" means information that—
(*a*) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or
(*b*) is recorded with the intention that it should be processed by means of such equipment;]
“back-up data” means data kept only for the purpose of replacing other data in the event of their being lost, destroyed or damaged;
F1["blocking", in relation to data, means so marking the data that it is not possible to process it for purposes in relation to which it is marked;]
“civil servant” has the meaning assigned to it by the Civil Service Regulation Acts, 1956 and 1958;
“the Commissioner” has the meaning assigned to it by *section 9* of this Act;
“company” has the meaning assigned to it by the Companies Act, 1963;
“company” has the meaning assigned to it by the Companies Act, 1963
“the Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January, 1981, the text of which is set out in the *First Schedule* to this Act;
“the Court” means the Circuit Court;
“data” means information in a form in which it can be processed;
“the Court” means the Circuit Court
F2["data" means automated data and manual data;]
“data controller” means a person who, either alone or with others, controls the contents and use of personal data;
@@ -32,844 +38,1069 @@
“data subject” means an individual who is the subject of personal data;
“direct marketing” includes direct mailing;
F1["the Directive" means Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals withregard to the processing of personal data and on the free movement of such data^(1);]
F3[…]
“disclosure”, in relation to personal data, includes the disclosure of information extracted from such data and the transfer of such data but does not include a disclosure made directly or indirectly by a data controller or a data processor to an employee or agent of his for the purpose of enabling the employee or agent to carry out his duties; and, where the identification of a data subject depends partly on the data and partly on other information in the possession of the data controller, the data shall not be regarded as disclosed unless the other information is also disclosed;
F1["the EEA Agreement"means the Agreement on the European Economic Area signed at Oporto on 2 May 1992 as adjusted by the Protocol signed at Brussels on 17 March 1993;]
F1["enactment" means a statute or a statutory instrument (within the meaning ofthe Interpretation Act 1937);]
“enforcement notice” means a notice under *section 10* of this Act;
“financial institution” means—
(*a*) a person who holds or has held a licence under section 9 of the Central Bank Act, 1971, or
(*b*) a person referred to in section 7 (4) of that Act;
F1["the European Economic Area" has the meaning assigned to it by the EEA Agreement;]
F3[…]
“information notice” means a notice under *section 12* of this Act;
“local authority” means a local authority for the purposes of the Local Government Act, 1941;
F4[“local authority”means a local authority for the purposes of theLocal Government Act 2001(as amended by the Local Government Reform Act 2014);]
F1["manual data" means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;]
“the Minister” means the Minister for Justice;
“personal data” means data relating to a living individual who can be identified either from the data or from the data in conjunction with other information in the possession of the data controller;
F2["personal data" means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;]
“prescribed”, in the case of fees, means prescribed by regulations made by the Minister with the consent of the Minister for Finance and, in any other case, means prescribed by regulations made by the Commissioner with the consent of the Minister;
“processing” means performing automatically logical or arithmetical operations on data and includes—
(*a*) extracting any information constituting the data, and
(*b*) in relation to a data processor, the use by a data controller of data equipment in the possession of the data processor and any other services provided by him for a data controller,
but does not include an operation performed solely for the purpose of preparing the text of documents;
F2["processing" of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including—
(*a*) obtaining, recording or keeping the information or data,
(*b*) collecting, organising, storing, altering or adapting the information or data,
(*c*) retrieving, consulting or using the information or data,
(*d*) disclosing the information or data by transmitting, disseminating or otherwise making it available, or
(*e*) aligning, combining, blocking, erasing or destroying the information or data;]
“prohibition notice” means a notice under *section 11* of this Act;
“the register” means the register established and maintained under *section 16* of this Act;
F3[…]
F5["relevant filing system" means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;]
F1["sensitive personal data" means personal data as to—
(*a*) the racial or ethnic origin, the political opinions or the religious or philosophical beliefs of the data subject,
(*b*) whether the data subject is a member of a trade union,
(*c*) the physical or mental health or condition or sexual life of the data subject,
(*d*) the commission or alleged commission of any offence by the data subject, or
(*e*) any proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings;]
and any cognate words shall be construed accordingly.
(2) For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.
(3) (*a*) An appropriate authority, being a data controller or a data processor, may, as respects all or part of the personal data kept by the authority, designate a civil servant in relation to whom it is the appropriate authority to be a data controller or a data processor and, while the designation is in force—
(i) the civil servant so designated shall be deemed, for the purposes of this Act, to be a data controller or, as the case may be, a data processor, and
(ii) this Act shall not apply to the authority,
(2)For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.
(3)(a)An appropriate authority, being a data controller or a data processor, may, as respects all or part of the personal data kept by the authority, designate a civil servant in relation to whom it is the appropriate authority to be a data controller or a data processor and, while the designation is in force—
(i)the civil servant so designated shall be deemed, for the purposes of this Act, to be a data controller or, as the case may be, a data processor, and
(ii)this Act shall not apply to the authority,
as respects the data concerned.
(*b*) Without prejudice to *paragraph (a)* of this subsection, the Minister for Defence may, as respects all or part of the personal data kept by him in relation to the Defence Forces, designate an officer of the Permanent Defence Force who holds a commissioned rank therein to be a data controller or a data processor and, while the designation is in force—
(i) the officer so designated shall be deemed, for the purposes of this Act, to be a data controller or, as the case may be, a data processor, and
(ii) this Act shall not apply to the Minister for Defence,
(b)Without prejudice to *paragraph (a)* of this subsection, the Minister for Defence may, as respects all or part of the personal data kept by him in relation to the Defence Forces, designate an officer of the Permanent Defence Force who holds a commissioned rank therein to be a data controller or a data processor and, while the designation is in force—
(i)the officer so designated shall be deemed, for the purposes of this Act, to be a data controller or, as the case may be, a data processor, and
(ii)this Act shall not apply to the Minister for Defence,
as respects the data concerned.
(*c*) For the purposes of this Act, as respects any personal data—
(i) where a designation by the relevant appropriate authority under *paragraph (a)* of this subsection is not in force, a civil servant in relation to whom that authority is the appropriate authority shall be deemed to be its employee and, where such a designation is in force, such a civil servant (other than the civil servant the subject of the designation) shall be deemed to be an employee of the last mentioned civil servant,
(ii) where a designation under *paragraph (b)* of this subsection is not in force, a member of the Defence Forces shall be deemed to be an employee of the Minister for Defence and, where such a designation is in force, such a member (other than the officer the subject of the designation) shall be deemed to be an employee of that officer, and
(iii) a member of the Garda Síochána (other than the Commissioner of the Garda Síochána) shall be deemed to be an employee of the said Commissioner.
(4) This Act does not apply to—
(*a*) personal data that in the opinion of the Minister or the Minister for Defence are, or at any time were, kept for the purpose of safeguarding the security of the State,
(*b*) personal data consisting of information that the person keeping the data is required by law to make available to the public, or
(*c*) personal data kept by an individual and concerned only with the management of his personal, family or household affairs or kept by an individual only for recreational purposes.
*Protection of Privacy of Individuals with regard to Personal Data*
##### 2 Collection, processing, keeping, use and disclosure of personal data.
**2.**—(1) A data controller shall, as respects personal data kept by him, comply with the following provisions:
(c)For the purposes of this Act, as respects any personal data—
(i)where a designation by the relevant appropriate authority under *paragraph (a)* of this subsection is not in force, a civil servant in relation to whom that authority is the appropriate authority shall be deemed to be its employee and, where such a designation is in force, such a civil servant (other than the civil servant the subject of the designation) shall be deemed to be an employee of the last mentioned civil servant,
(ii)where a designation under *paragraph (b)* of this subsection is not in force, a member of the Defence Forces shall be deemed to be an employee of the Minister for Defence and, where such a designation is in force, such a member (other than the officer the subject of the designation) shall be deemed to be an employee of that officer, and
(iii)a member of the Garda Síochána (other than the Commissioner of the Garda Síochána) shall be deemed to be an employee of the said Commissioner.
F1[(3A) A word or expression that is used in this Act and also in the Directive has, unless the context otherwise requires, the same meaning in this Act as it has in the Directive.
(3B) (*a*) Subject to any regulations under*section 15(2)*of this Act, this Act applies to data controllers in respect of the processing of personal data only if—
(i) the data controller is established in the State and the data are processed in the context of that establishment, or
(ii) the data controller is established neither in the State nor in any other state that is a contracting party to the EEA Agreement but makes use of equipment in the State for processing the data otherwise than for the purpose of transit through the territory of the State.
(*b*) For the purposes of*paragraph (a)*of this subsection, each of the following shall be treated as established in the State:
(i) an individual who is normally resident in the State,
(ii) a body incorporated under the law of the State,
(iii) a partnership or other unincorporated association formed under the law of the State, and
(iv) a person who does not fall within*subparagraphs (i), (ii)*or*(iii)*of this paragraph, but maintains in the State—
(I) an office, branch or agency through which he or she carries on any activity, or
(II) a regular practice,
and the reference to establishment in any other state that is a contracting party to the EEA Agreement shall be construed accordingly.
(*c*) A data controller to whom*paragraph (a)(ii)*of this subsection applies must, without prejudice to any legal proceedings that could be commenced against the data controller, designate a representative established in the State.
(3C)*Section 2*and*sections 2A*and*2B*(which sections were inserted by the Act of 2003) of this Act shall not apply to—
(*a*) data kept solely for the purpose of historical research, or
(*b*other data consisting of archives or departmental records (within the meaning in each case ofthe National Archives Act 1986),
and the keeping of which complies with such requirements (if any) as may be prescribed for the purpose of safeguarding the fundamental rights and freedoms of data subjects.]
(4)This Act does not apply to—
(a)personal data that in the opinion of the Minister or the Minister for Defence are, or at any time were, kept for the purpose of safeguarding the security of the State,
(b)personal data consisting of information that the person keeping the data is required by law to make available to the public, or
(c)personal data kept by an individual and concerned only with the management of his personal, family or household affairs or kept by an individual only for recreational purposes.
F1[(5)F3[…]]
##### 2. **Collection, processing, keeping, use and disclosure of personal data.**
**2.**—F6[(1) A data controller shall, as respects personal data kept by him or her, comply with the following provisions:
(*a*) the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly,
(*b*) the data shall be accurate and, where necessary, kept up to date,
(*b*) the data shall be accurate and complete and, where necessary, kept up to date,
(*c*) the data—
(i) shall be kept only for one or more specified and lawful purposes,
(ii) shall not be used or disclosed in any manner incompatible with that purpose or those purposes,
(iii) shall be adequate, relevant and not excessive in relation to that purpose or those purposes, and
(i) shall have been obtained only for one or more specified, explicit and legitimate purposes,
(ii) shall not be further processed in a manner incompatible with that purpose or those purposes,
(iii) shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and
(iv) shall not be kept for longer than is necessary for that purpose or those purposes,
(*d*) appropriate security measures shall be taken against unauthorised access to, or alteration, disclosure or destruction of, the data and against their accidental loss or destruction.
(2) A data processor shall, as respects personal data processed by him, comply with *paragraph (d)* of *subsection (1)* of this section.
(3) *Paragraph (a)* of the said *subsection (1)* does not apply to information intended for inclusion in data, or to data, kept for a purpose mentioned in *section 5 (1) (a)* of this Act, in any case in which the application of that paragraph to the data would be likely to prejudice any of the matters mentioned in the said *section 5 (1) (a)*.
(4) *Paragraph (b)* of the said *subsection (1)* does not apply to backup data.
(5) (*a*) *Paragraph (c) (iv)* of the said *subsection (1)* does not apply to personal data kept for historical, statistical or research purposes, and
(*b*) the data or, as the case may be, the information constituting such data shall not be regarded for the purposes of *paragraph (a)* of the said subsection as having been obtained unfairly by reason only that its use for any such purpose was not disclosed when it was obtained,
(*d*) appropriate security measures shall be taken against unauthorised access to, or unauthorised alteration, disclosure or destruction of, the data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.]
(2)A data processor shall, as respects personal data processed by him, comply with *paragraph (d)* of *subsection (1)* of this section.
(3)*Paragraph (a)* of the said *subsection (1)* does not apply to information intended for inclusion in data, or to data, kept for a purpose mentioned in *section 5 (1) (a)* of this Act, in any case in which the application of that paragraph to the data would be likely to prejudice any of the matters mentioned in the said *section 5 (1) (a)*.
(4)*Paragraph (b)* of the said *subsection (1)* does not apply to backup data.
(5)F7[(*a*)*Subparagraphs (ii)*and*(iv)*of*paragraph (c)*of the said*subsection (1)*do not apply to personal data kept for statistical or research or other scientific purposes, and the keeping of which complies with such requirements (if any) as may be prescribed for the purpose of safeguarding the fundamental rights and freedoms of data subjects, and,]
(b)the data or, as the case may be, the information constituting such data shall not be regarded for the purposes of *paragraph (a)* of the said subsection as having been obtained unfairly by reason only that its use for any such purpose was not disclosed when it was obtained,
if the data are not used in such a way that damage or distress is, or is likely to be, caused to any data subject.
(6) (*a*) The Minister may, for the purpose of providing additional safeguards in relation to personal data as to racial origin, political opinions, religious or other beliefs, physical or mental health, sexual life or criminal convictions, by regulations amend *subsection (1)* of this section.
(*b*) Regulations under this section may make different provision in relation to data of different descriptions.
(*c*) References in this Act to *subsection (1)* of this section or to a provision of that subsection shall be construed in accordance with any amendment under this section.
(*d*) Regulations under this section shall be made only after consultation with any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted.
(*e*) Where it is proposed to make regulations under this section, a draft of the regulations shall be laid before each House of the Oireachtas and the regulations shall not be made until a resolution approving of the draft shall have been passed by each such House.
(7) Where—
(*a*) personal data are kept for the purpose of direct marketing, and
(*b*) the data subject concerned requests the data controller in writing to cease using the data for that purpose,
the data controller shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him—
(i) if the data are kept only for the purpose aforesaid, erase the data,
(ii) if the data are kept for that purpose and other purposes, cease using the data for that purpose, and
(iii) notify the data subject in writing accordingly and, where appropriate, inform him of those other purposes.
##### 3 Right to establish existence of personal data.
**3.**—An individual who believes that a person keeps personal data shall, if he so requests the person in writing—
(*a*) be informed by the person whether he keeps any such data, and
(*b*) if he does, be given by the person a description of the data and the purposes for which they are kept,
(6) F8[…]
F9[(7)F10[…]
(8)F10[…]]
##### 2A. **F11[Processing of personal data.**
**2A.**—(1) Personal data shall not be processed by a data controller unless*section 2*of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met:
(*a*) the data subject has given his or her consent to the processing or, if the data subject, by reason of his or her physical or mental incapacity or age, is or is likely to be unable to appreciate the nature and effect of such consent, it is given by a parent or guardian or a grandparent, uncle, aunt, brother or sister of the data subject and the giving of such consent is not prohibited by law,
(*b*) the processing is necessary—
(i) for the performance of a contract to which the data subject is a party,
(ii) in order to take steps at the request of the data subject prior to entering into a contract,
(iii) for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract, or
(iv) to prevent—
(I) injury or other damage to the health of the data subject, or
(II) serious loss of or damage to property of the data subject,
or otherwise to protect his or her vital interests where the seeking of the consent of the data subject or another person referred to in*paragraph (a)*of this subsection is likely to result in those interests being damaged,
(*c*) the processing is necessary—
(i) for the administration of justice,
(ii) for the performance of a function conferred on a person by or under an enactment,
(iii) for the performance of a function of the Government or a Minister of the Government, or
(iv) for the performance of any other function of a public nature performed in the public interest by a person,
(*d*) the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject.
(2) The Minister may, after consultation with the Commissioner, by regulations specify particular circumstances in which*subsection (1)(d)*of this section is, or is not, to be taken as satisfied.]
##### 2B. **F12[Processing of sensitive personal data.**
**2B.**—(1) Sensitive personal data shall not be processed by a data controller unless:
(*a*)*sections 2*and*2A*(as amended and inserted, respectively, by the Act of 2003) are complied with, and
(*b*) in addition, at least one of the following conditions is met:
(i) the consent referred to in paragraph (*a*) of*subsection (1)*of*section 2A*(as inserted by the*Act of 2003*) of this Act is explicitly given,
(ii) the processing is necessary for the purpose of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment,
(iii) the processing is necessary to prevent injury or other damage to the health of the data subject or another person or serious loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or of another person in a case where—
(I) consent to the processing cannot be given by or on behalf of the data subject in accordance with*section 2A(1)(a)*(inserted by the Act of 2003) of this Act, or
(II) the data controller cannot reasonably be expected to obtain such consent,
or the processing is necessary to prevent injury to, or damage to the health of, another person, or serious loss in respect of, or damage to, the property of another person, in a case where such consent has been unreasonably withheld,
(iv) the processing—
(I) is carried out in the course of its legitimate activities by any body corporate, or any unincorporated body of persons, that—
(A) is not established, and whose activities are not carried on, for profit, and
(B) exists for political, philosophical, religious or trade union purposes,
(II) is carried out with appropriate safeguards for the fundamental rights and freedoms of data subjects,
(III) relates only to individuals who either are members of the body or have regular contact with it in connection with its purposes, and
(IV) does not involve disclosure of the data to a third party without the consent of the data subject,
(v) the information contained in the data has been made public as a result of steps deliberately taken by the data subject,
(vi) the processing is necessary—
(I) for the administration of justice,
(II) for the performance of a function conferred on a person by or under an enactment, or
(III) for the performance of a function of the Government or a Minister of the Government,
(vii) the processing—
(I) is required for the purpose of obtaining legal advice or for the purposes of, or in connection with, legal proceedings or prospective legal proceedings, or
(II) is otherwise necessary for the purposes of establishing, exercising or defending legal rights,
(viii) the processing is necessary for medical purposes and is undertaken by—
(I) a health professional, or
(II) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health professional,
(ix) the processing is necessary in order to obtain information for use, subject to and in accordance withthe Statistics Act 1993, only for statistical, compilation and analysis purposes,
(x) the processing is carried out by political parties, or candidates for election to, or holders of, elective political office, in the course of electoral activities for the purpose of compiling data on people’s political opinions and complies with such requirements (if any) as may be prescribed for the purpose of safeguarding the fundamental rights and freedoms of data subjects,
(xi) the processing is authorised by regulations that are made by the Minister and are made for reasons of substantial public interest,
(xii) the processing is necessary-for the purpose of the assessment, collection or payment of any tax, duty, levy or other moneys owed orpayable to the State and the data has been provided by the data subject solely for that purpose,
(xiii) the processing is necessary for the purposes of determining entitlement to or control of, or any other purpose connected with the administration of any benefit, pension, assistance, allowance, supplement or payment underthe Social Welfare (Consolidation) Act 1993, or any nonstatutory scheme administered by the Minister for Social, Community and Family Affairs.
(2) The Minister may by regulations made after consultation with the Commissioner—
(*a*) exclude the application of*subsection (1)(b)(ii)*of this section in such cases as may be specified, or
(*b*) provide that, in such cases as may be specified, the condition in the said*subsection (1)(b)(ii)*is not to be regarded as satisfied unless such further conditions as may be specified are also satisfied.
(3) The Minister may by regulations make such provision as he considers appropriate for the protection of data subjects in relation to the processing of personal data as to—
(*a*) the commission or alleged commission of any offence by data subjects,
(*b*) any proceedings for an offence committed or alleged to have been committed by data subjects, the disposal of such proceedings or the sentence of any court in such proceedings,
(*c*) any act or omission or alleged act or omission of data subjects giving rise to administrative sanctions,
(*d*) any civil proceedings in a court or other tribunal to which data subjects are parties or any judgment, order or decision of such a tribunal in any such proceedings,
and processing of personal data shall be in compliance with any regulations under this subsection.
(4) In this section—
"health professional" includes a registered medical practitioner, within the meaning of the MedicalPractitioners Act 1978, a registered dentist, within the meaning ofthe Dentists Act 1985or a member of any other class of health worker or social worker standing specified by regulations made by the Minister after consultation with the Minister for Health and Children and any other Minister of the Government who, having regard to his or her functions, ought, in the opinion of the Minister, to be consulted;
"medical purposes" includes the purposes of preventive medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.]
##### 2C. **F13[Security measures for personal data.**
**2C.**—(1) In determining appropriate security measures for the purposes of*section 2(1)(d)*of this Act, in particular (but without prejudice to the generality of that provision), where the processing involves the transmission of data over a network, a data controller—
(*a*) may have regard to the state of technological development and the cost of implementing the measures, and
(*b*) shall ensure that the measures provide a level of security appropriate to—
(i) the harm that might result from unauthorised or unlawful processing, accidental or unlawful destruction or accidental loss of, or damage to, the data concerned, and
(ii) the nature of the data concerned.
(2) A data controller or data processor shall take all reasonable steps to ensure that—
(*a*) persons employed by him or her, and
(*b*) other persons at the place of work concerned,
are aware of and comply with the relevant security measures aforesaid.
(3) Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller shall—
(*a*) ensure that the processing is carried out in pursuance of a contract in writing or in another equivalent form between the data controller and the data processor and that the contract provides that the data processor carries out the processing only on and subject to the instructions of the data controller and that the data processor complies with obligations equivalentto those imposed on the data controller by*section 2(1)(d)*of this Act,
(*b*) ensure that the data processor provides sufficient guarantees in respect of the technical security measures, and organisational measures, governing the processing, and
(*c*) take reasonable steps to ensure compliance with those measures.]
##### 2D. **F14[Fair processing of personal data.**
**2D.**—(1) Personal data shall not be treated, for the purposes of*section 2(1)(a)*of this Act, as processed fairly unless—
(*a*) in the case of data obtained from the data subject, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in*subsection (2)*of this section,
(*b*) in any other case, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in*subsection (3)*of this section—
(i) not later than the time when the data controller first processes the data, or
(ii) if disclosure of the data to a third party is envisaged, not later than the time of such disclosure.
(2) The information referred to in*subsection (1)(a)*of this section is:
(*a*) the identity of the data controller,
(*b*) if he or she has nominated a representative for the purposes of this Act, the identity of the representative,
(*c*) the purpose or purposes for which the data are intended to be processed, and
(*d*) any other information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data to be fair to the data subject such as information as to the recipients or categories of recipients of the data, as to whether replies to questions asked for the purpose of the collection of the data are obligatory, as to the possibleconsequences of failure to give such replies and as to the existence of the right of access to and the right to rectify the data concerning him or her.
(3) The information referred to in*subsection (1)(b)*of this section is:
(*a*) the information specified in*subsection (2)*of this section,
(*b*) the categories of data concerned, and
(*c*) the name of the original data controller.
(4) The said*subsection (1)(b)*does not apply—
(*a*) where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of the information specified therein proves impossible or would involve a disproportionate effort, or
(*b*) in any case where the processing of the information contained or to be contained in the data by the data controller is necessary for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract,
if such conditions as may be specified in regulations made by the Minister after consultation with the Commissioner are complied with.]
##### 3. **Right to establish existence of personal data.**
3.—An individual who believes that a person keeps personal data shall, if he so requests the person in writing—
(a)be informed by the person whether he keeps any such data, and
(b)if he does, be given by the person a description of the data and the purposes for which they are kept,
as soon as may be and in any event not more than 21 days after the request has been given or sent to him.
##### 4 Right of access.
**4.**—(1) (*a*) Subject to the provisions of this Act, an individual shall, if he so requests a data controller in writing—
(i) be informed by the data controller whether the data kept by him include personal data relating to the individual, and
(ii) be supplied by the data controller with a copy of the information constituting any such data,
as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section; and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.
(*b*) A request for the information specified in *subparagraph (i)* of *subsection (1) (a)* of this section shall, in the absence of any indication to the contrary, be treated as including a request for a copy of the information specified in *subparagraph (ii)* of the said *subsection (1) (a)*.
(*c*) (i) A fee may be payable to the data controller concerned in respect of such a request as aforesaid and the amount thereof shall not exceed such amount as may be prescribed or an amount that in the opinion of the Commissioner is reasonable, having regard to the estimated cost to the data controller of compliance with the request, whichever is the lesser.
(ii) A fee paid by an individual to a data controller under *subparagraph (i)* of this paragraph shall be returned to him if his request is not complied with or the data controller rectifies or supplements, or erases part of, the data concerned (and thereby materially modifies the data) or erases all of the data on the application of the individual or in accordance with an enforcement notice or an order of a court.
(2) Where pursuant to provision made in that behalf under this Act there are separate entries in the register in respect of data kept by a data controller for different purposes, *subsection (1)* of this section shall apply as if it provided for the making of a separate request and the payment of a separate fee in respect of the data to which each entry relates.
(3) An individual making a request under this section shall supply the data controller concerned with such information as he may reasonably require in order to satisfy himself of the identity of the individual and to locate any relevant personal data or information.
(4) Nothing in *subsection (1)* of this section obliges a data controller to disclose to a data subject personal data relating to another individual unless that other individual has consented to the disclosure:
Provided that, where the circumstances are such that it would be reasonable for the data controller to conclude that, if any particulars identifying that other individual were omitted, the data could then be disclosed as aforesaid without his being thereby identified to the data subject, the data controller shall be obliged to disclose the data to the data subject with the omission of those particulars.
(5) Information supplied pursuant to a request under *subsection (1)* of this section may take account of any amendment of the personal data concerned made since the receipt of the request by the data controller (being an amendment that would have been made irrespective of the receipt of the request) but not of any other amendment.
(6) (*a*) A request by an individual under *subsection (1)* of this section in relation to the results of an examination at which he was a candidate shall be deemed, for the purposes of this section, to be made on—
(i) the date of the first publication of the results of the examination, or
(ii) the date of the request,
whichever is the later; and *paragraph (a)* of the said *subsection (1)* shall be construed and have effect in relation to such a request as if for “40 days” there were substituted “60 days”.
(*b*) In this subsection “examination” means any process for determining the knowledge, intelligence, skill or ability of a person by reference to his performance in any test, work or other activity.
(7) A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner about the refusal.
(8) (*a*) If and whenever the Minister considers it desirable in the interests of data subjects to do so and by regulations so declares, the application of this section to personal data—
(i) relating to physical or mental health, or
(ii) kept for, or obtained in the course of, carrying out social work by a Minister of the Government, a local authority, a health board or a specified voluntary organisation or other body,
##### 4. **Right of access.**
4.—(1)F15[(*a*) Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in writing—
(i) be informed by the data controller whether the data processed by or on behalf of the data controller include personal data relating to the individual,
(ii) if it does, be supplied by the data controller with a description of—
(I) the categories of data being processed by or on behalf of the data controller,
(II) the personal data constituting the data of which that individual is the data subject,
(III) the purpose or purposes of the processing, and
(IV) the recipients or categories of recipients to whom the data are or may be disclosed,
(iii) have communicated to him or her in intelligible form—
(I) the information constituting any personal data of which that individual is the data subject, and
(II) any information known or available to the data controller as to the source of those data unless the communication of that information is contrary to the public interest,
and
(iv) where the processing by automatic means of the data of which the individual is the data subject has constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, be informed free of charge by the data controller of the logic involved in the processing,
as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.
(*b*) A request under*paragraph (a)*of this subsection that does not relate to all of its subparagraphs shall, in the absence of any indication to the contrary, be treated as relating to all of them.]
(c)(i)A fee may be payable to the data controller concerned in respect of such a request as aforesaid and the amount thereof shall not exceed such amount as may be prescribed or an amount that in the opinion of the Commissioner is reasonable, having regard to the estimated cost to the data controller of compliance with the request, whichever is the lesser.
(ii)A fee paid by an individual to a data controller under *subparagraph (i)* of this paragraph shall be returned to him if his request is not complied with or the data controller rectifies or supplements, or erases part of, the data concerned (and thereby materially modifies the data) or erases all of the data on the application of the individual or in accordance with an enforcement notice or an order of a court.
(2)F16[…]
(3)An individual making a request under this section shall supply the data controller concerned with such information as he may reasonably require in order to satisfy himself of the identity of the individual and to locate any relevant personal data or information.
(4)F16[…]
F17[(4A) (*a*) Where personal data relating to a data subject consist of an expression of opinion about the data subject by another person, the data may be disclosed to the data subject without obtaining the consent of that person to the disclosure.
(*b*)*Paragraph (a)*of this subsection does not apply—
(i) to personal data held by or on behalf of the person in charge of an institution referred to in*section 5(1)(c)*of this Act and consisting of an expression of opinion by another person about the data subject if the data subject is being or was detained in such an institution, or
(ii) if the expression of opinion referred to in that paragraph was given in confidence or on the understanding that it would be treated as confidential.]
(5)Information supplied pursuant to a request under *subsection (1)* of this section may take account of any amendment of the personal data concerned made since the receipt of the request by the data controller (being an amendment that would have been made irrespective of the receipt of the request) but not of any other amendment.
(6)F16[…]
(7)A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner about the refusal.
(8)(a)If and whenever the Minister considers it desirable in the interests of data subjects F18[or in the public interest] to do so and by regulations so declares, the application of this section to personal data—
(i)relating to physical or mental health, or
(ii)kept for, or obtained in the course of, carrying out social work by a Minister of the Government, a local authority, a health board or a specified voluntary organisation or other body,
may be modified by the regulations in such manner, in such circumstances, subject to such safeguards and to such extent as may be specified therein.
(*b*) Regulations under *paragraph (a)* of this subsection shall be made only after consultation with the Minister for Health and any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted and may make different provision in relation to data of different descriptions.
##### 5 Restriction of right of access.
**5.**—(1) *Section 4* of this Act does not apply to personal data—
(*a*) kept for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of that section to the data would be likely to prejudice any of the matters aforesaid,
(*b*) to which, by virtue of *paragraph (a)* of this subsection, the said *section 4* does not apply and which are kept for the purpose of discharging a function conferred by or under any enactment and consisting of information obtained for such a purpose from a person who had it in his possession for any of the purposes mentioned in *paragraph (a)* of this subsection,
(*c*) in any case in which the application of that section would be likely to prejudice the security of, or the maintenance of good order and discipline in—
(i) a prison,
(ii) a place of detention provided under section 2 of the Prison Act, 1970,
(iii) a military prison or detention barrack within the meaning of the Defence Act, 1954, or
(iv) Saint Patrick's Institution,
(*d*) kept for the purpose of performing such functions conferred by or under any enactment as may be specified by regulations made by the Minister, being functions that, in the opinion of the Minister, are designed to protect members of the public against financial loss occasioned by—
(i) dishonesty, incompetence or malpractice on the part of persons concerned in the provision of banking, insurance, investment or other financial services or in the management of companies or similar organisations, or
(ii) the conduct of persons who have at any time been adjudicated bankrupt,
in any case in which the application of that section to the data would be likely to prejudice the proper performance of any of those functions,
(*e*) in respect of which the application of that section would be contrary to the interests of protecting the international relations of the State,
(*f*) consisting of an estimate of, or kept for the purpose of estimating, the amount of the liability of the data controller concerned on foot of a claim for the payment of a sum of money, whether in respect of damages or compensation, in any case in which the application of the section would be likely to prejudice the interests of the data controller in relation to the claim,
(*g*) in respect of which a claim of privilege could be maintained in proceedings in a court in relation to communications between a client and his professional legal advisers or between those advisers,
(*h*) kept only for the purpose of preparing statistics or carrying out research if the data are not used or disclosed (other than to a person to whom a disclosure of such data may be made in the circumstances specified in *section 8* of this Act) for any other purpose and the resulting statistics or the results of the research are not made available in a form that identifies any of the data subjects, or
(*i*) that are back-up data.
(2) Regulations under *subsections (1) (d)* and *(3) (b)* of this section shall be made only after consultation with any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted.
(3) (*a*) Subject to *paragraph (b)* of this subsection, *section 4* of this Act, as modified by any other provisions thereof, shall apply notwithstanding any provision of or made under any enactment or rule of law that is in force immediately before the passing of this Act and prohibits or restricts the disclosure, or authorises the withholding, of information.
(*b*) If and whenever the Minister is of opinion that a prohibition, restriction or authorisation referred to in *paragraph (a)* of this subsection in relation to any information ought to prevail in the interests of the data subjects concerned or any other individuals and by regulations so declares, then, while the regulations are in force, the said *paragraph (a)* shall not apply as respects the provision or rule of law concerned and accordingly *section 4* of this Act, as modified as aforesaid, shall not apply in relation to that information.
##### 6 Right of rectification or erasure.
**6.**—(1) An individual shall, if he so requests in writing a data controller who keeps personal data relating to him, be entitled to have rectified or, where appropriate, erased any such data in relation to which there has been a contravention by the data controller of *section 2 (1)* of this Act; and the data controller shall comply with the request as soon as may be and in any event not more than 40 days after it has been given or sent to him:
(b)Regulations under *paragraph (a)* of this subsection shall be made only after consultation with the Minister for Health and any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted and may make different provision in relation to data of different descriptions.
F19[(9) The obligations imposed by*subsection (1)(a)(iii)*(inserted by the Act of 2003) of this section shall be complied with by supplying the data subject with a copy of the information concerned in permanent form unless—
(*a*) the supply of such a copy is not possible or would involve disproportionate effort, or
(*b*) the data subject agrees otherwise.
(10) Where a data controller has previously complied with a request under*subsection (1)*of this section, the data controller is not obliged to comply with a subsequent identical or similar request under that subsection by the same individual unless, in the opinion of the data controller, a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
(11) In determining for the purposes of*subsection (10)*of this section whether the reasonable interval specified in that subsection has elapsed, regard shall be had to the nature of the data, the purpose for which the data are processed and the frequency with which the data are altered.
(12)*Subsection (1)(a)(iv)*of this section is not to be regarded as requiring the provision of information as to the logic involved in the taking of a decision if and to the extent only that such provision would adversely affect trade secrets or intellectual property (in particular any copyright protecting computer software).]
F19[(13)F16[…]]
##### 5. **Restriction of right of access.**
5.—(1)*Section 4* of this Act does not apply to personal data—
(a)kept for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of that section to the data would be likely to prejudice any of the matters aforesaid,
(b)to which, by virtue of *paragraph (a)* of this subsection, the said *section 4* does not apply and which are kept for the purpose of discharging a function conferred by or under any enactment and consisting of information obtained for such a purpose from a person who had it in his possession for any of the purposes mentioned in *paragraph (a)* of this subsection,
(c)in any case in which the application of that section would be likely to prejudice the security of, or the maintenance of good order and discipline in—
(i)a prison,
F20[(ii)a place of detention provided under section 2 of thePrisons Act 1970, or
(iii)a military prison or detention barrack within the meaning of theDefence Act 1954,]
(iv)F21[…]
(d)F22[…]
(e)in respect of which the application of that section would be contrary to the interests of protecting the international relations of the State,
(f)consisting of an estimate of, or kept for the purpose of estimating, the amount of the liability of the data controller concerned on foot of a claim for the payment of a sum of money, whether in respect of damages or compensation, in any case in which the application of the section would be likely to prejudice the interests of the data controller in relation to the claim,
(g)in respect of which a claim of privilege could be maintained in proceedings in a court in relation to communications between a client and his professional legal advisers or between those advisers,
F23[(*gg*) kept by the Commissioner or the Information Commissioner for the purposes of his or her functions,]
(h)kept only for the purpose of preparing statistics or carrying out research if the data are not used or disclosed (other than to a person to whom a disclosure of such data may be made in the circumstances specified in *section 8* of this Act) for any other purpose and the resulting statistics or the results of the research are not made available in a form that identifies any of the data subjects, or
(i)that are back-up data.
(2)Regulations under *subsections (1) (d)* and *(3) (b)* of this section shall be made only after consultation with any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted.
(3)(a)Subject to *paragraph (b)* of this subsection, *section 4* of this Act, as modified by any other provisions thereof, shall apply notwithstanding any provision of or made under any enactment or rule of law that is in force immediately before the passing of this Act and prohibits or restricts the disclosure, or authorises the withholding, of information.
(b)If and whenever the Minister is of opinion that a prohibition, restriction or authorisation referred to in *paragraph (a)* of this subsection in relation to any information ought to prevail in the interests of the data subjects concerned or any other individuals and by regulations so declares, then, while the regulations are in force, the said *paragraph (a)* shall not apply as respects the provision or rule of law concerned and accordingly *section 4* of this Act, as modified as aforesaid, shall not apply in relation to that information.
##### 6. **Right of rectification or erasure.**
6.—(1)An individual shall, if he so requests in writing a data controller who keeps personal data relating to him, be entitled to have rectified or, where appropriate, F24[blocked or] erased any such data in relation to which there has been a contravention by the data controller of *section 2 (1)* of this Act; and the data controller shall comply with the request as soon as may be and in any event not more than 40 days after it has been given or sent to him:
Provided that the data controller shall, as respects data that are inaccurate or not kept up to date, be deemed—
(*a*) to have complied with the request if he supplements the data with a statement (to the terms of which the individual has assented) relating to the matters dealt with by the data, and
(*b*) if he supplements the data as aforesaid, not to be in contravention of *paragraph (b)* of the said *section 2 (1)*.
(2) On compliance by a data controller with a request under *subsection (1)* of this section, he shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him, notify—
(a)to have complied with the request if he supplements the data with a statement (to the terms of which the individual has assented) relating to the matters dealt with by the data, and
(b)if he supplements the data as aforesaid, not to be in contravention of *paragraph (b)* of the said *section 2 (1)*.
F25[(2) Where a data controller complies, or is deemed to have complied, with a request under*subsection (1)*of this section, he or she shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, notify—
(*a*) the individual making the request, and
(*b*) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period of 12 months immediately before the giving or sending of the request,
of the rectification, erasure or statement concerned.
##### 7 Duty of care owed by data controllers and data processors.
**7.**—For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned:
(*b*) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period of 12 months immediately before the giving or sending of the request unless such notification proves impossible or involves a disproportionate effort,]
##### 6A. **F26[Right of data subject to object to processing likely to cause damage or distress.**
**6A.**—(1) Subject to*subsection (3)*and unless otherwise provided by any enactment, an individual is entitled at any time, by notice in writing served on a data controller, to request him or her to cease within a reasonable time, or not to begin, processing or processing for a specified purpose or in a specified manner any personal data in respect of which he or she is the data subject if the processing falls within*subsection (2)*of this section on the ground that, for specified reasons—
(*a*) the processing of those data or their processing for that purpose or in that manner is causing or likely to cause substantial damage or distress to him or her or to another person, and
(*b*) the damage or distress is or would be unwarranted.
(2) This subsection applies to processing that is necessary—
(*a*) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or in a third party to whom the data are or are to be disclosed, or
(*b*) for the purposes of the legitimate interests pursued by the data controller to whom the data are or are to be disclosed, unless those interests are overridden by the interests of the data subject in relation to fundamental rights and freedoms and, in particular, his or her right to privacy with respect to the processing of personal data.
(3)*Subsection (1)*does not apply—
(*a*) in a case where the data subject has given his or her explicit consent to the processing,
(*b*) if the processing is necessary—
(i) for the performance of a contract to which the data subject is a party,
(ii) in order to take steps at the request of the data subject prior to his or her entering into a contract,
(iii) for compliance with any legal obligation to which the data controller or data subject is subject other than one imposed by contract, or
(iv) to protect the vital interests of the data subject,
(*c*) to processing carried out by political parties or candidates for election to, or holders of elective political office, in the course of electoral activities, or
(*d*) in such other cases, if any, as may be specified in regulations made by the Minister after consultation with the Commissioner.
(4) Where a notice under*subsection (1)*of this section is served on a data controller, he or she shall, as soon as practicable and in any event not later than 20 days after the receipt of the notice, serve a notice on the individual concerned—
(*a*) stating that he or she has complied or intends to comply with the request concerned, or
(*b*) stating that he or she is of opinion that the request is unjustified to any extent and the reasons for the opinion and the extent (if any) to which he or she has complied or intends to comply with it.
(5) If the Commissioner is satisfied, on the application to him or her in that behalf of an individual who has served a notice under*subsection (1)*of this section that appears to the Commissioner to be justified, or to be justified to any extent, that the data controller concerned has failed to comply with the notice or to comply with it to that extent and that not less than 40 days have elapsed since the receipt of the notice by him or her, the Commissioner may, by an enforcement notice served on the data controller, order him or her to take such steps for complying with the request, or for complying with it to that extent, as the Commissioner thinks fit and specifies in the enforcement notice, and that notice shall specify the reasons for the Commissioner being satisfied as aforesaid.]
##### 6B. **F27[Rights in relation to automated decision taking.**
**6B.**—(1) Subject to*subsection (2)*of this section, a decision which produces legal effects concerning a data subject or otherwise significantly affects a data subject may not be based solely on processing by automatic means of personal data in respect of which he or she is the data subject and which is intended to evaluate certain personal matters relating to him or her such as, for example (but without prejudice to the generality of the foregoing), his or her performance at work, creditworthiness, reliability or conduct.
(2)*Subsection (1)*of this section does not apply—
(*a*) in a case in which a decision referred to in that subsection—
(i) is made in the course of steps taken—
(I) for the purpose of considering whether to enter into a contract with the data subject,
(II) with a view to entering into such a contract, or
(III) in the course of performing such a contract,
or
(ii) is authorised or required by any enactment and the data subject has been informed of the proposal to make the decision, and
(iii) either—
(I) the effect of the decision is to grant a request of the data subject, or
(II) adequate steps have been taken to safeguard the legitimate interests of the data subject by, for example (but without prejudice to the generality of the foregoing), the making of arrangements to enable him or her to make representations to the data controller in relation to the proposal,
or
(*b*) if the data subject consents to the processing referred to in*subsection (1)*.]
##### 7. **Duty of care owed by data controllers and data processors.**
7.—For the purposes of the law of torts and to the extent that that law does not so provide, a person, being a data controller or a data processor, shall, so far as regards the collection by him of personal data or information intended for inclusion in such data or his dealing with such data, owe a duty of care to the data subject concerned:
Provided that, for the purposes only of this section, a data controller shall be deemed to have complied with the provisions of *section 2 (1) (b)* of this Act if and so long as the personal data concerned accurately record data or other information received or obtained by him from the data subject or a third party and include (and, if the data are disclosed, the disclosure is accompanied by)—
(*a*) an indication that the information constituting the data was received or obtained as aforesaid,
(*b*) if appropriate, an indication that the data subject has informed the data controller that he regards the information as inaccurate or not kept up to date, and
(*c*) any statement with which, pursuant to this Act, the data are supplemented.
##### 8 Disclosure of personal data in certain cases.
**8.**—Any restrictions in this Act on the disclosure of personal data do not apply if the disclosure is—
(*a*) in the opinion of a member of the Garda Síochána not below the rank of chief superintendent or an officer of the Permanent Defence Force who holds an army rank not below that of colonel and is designated by the Minister for Defence under this paragraph, required for the purpose of safeguarding the security of the State,
(*b*) required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid,
(*c*) required in the interests of protecting the international relations of the State,
(*d*) required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property,
(*e*) required by or under any enactment or by a rule of law or order of a court,
(*f*) required for the purposes of obtaining legal advice or for the purposes of, or in the course of, legal proceedings in which the person making the disclosure is a party or a witness,
(*g*) made to the data subject concerned or to a person acting on his behalf, or
(*h*) made at the request or with the consent of the data subject or a person acting on his behalf.
*The Data Protection Commissioner*
##### 9 The Commissioner.
**9.**—(1) For the purposes of this Act, there shall be a person (referred to in this Act as the Commissioner) who shall be known as an Coimisinéir Cosanta Sonraí or, in the English language, the Data Protection Commissioner; the Commissioner shall perform the functions conferred on him by this Act.
(2) The provisions of the *Second Schedule* to this Act shall have effect in relation to the Commissioner.
##### 10 Enforcement of data protection.
**10.**—(1) (*a*) The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened by a data controller or a data processor in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention.
(*b*) Where a complaint is made to the Commissioner under *paragraph (a)* of this subsection, the Commissioner shall—
(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious, and
(ii) as soon as may be, notify the individual concerned in writing of his decision in relation to the complaint and that the individual may, if aggrieved by his decision, appeal against it to the Court under *section 26* of this Act within 21 days from the receipt by him of the notification.
(2) If the Commissioner is of opinion that a person, being a data controller or a data processor, has contravened or is contravening a provision of this Act (other than a provision the contravention of which is an offence), the Commissioner may, by notice in writing (referred to in this Act as an enforcement notice) served on the person, require him to take such steps as are specified in the notice within such time as may be so specified to comply with the provision concerned.
(3) Without prejudice to the generality of *subsection (2)* of this section, if the Commissioner is of opinion that a data controller has contravened *section 2 (1)* of this Act, the relevant enforcement notice may require him—
(*a*) to rectify or erase any of the data concerned, or
(*b*) to supplement the data with such statement relating to the matters dealt with by them as the Commissioner may approve of; and as respects data that are inaccurate or not kept up to date, if he supplements them as aforesaid, he shall be deemed not to be in contravention of *paragraph (b)* of the said *section 2 (1)*.
(4) An enforcement notice shall—
(*a*) specify any provision of this Act that, in the opinion of the Commissioner, has been or is being contravened and the reasons for his having formed that opinion, and
(*b*) subject to *subsection (6)* of this section, state that the person concerned may appeal to the Court under *section 26* of this Act against the requirement specified in the notice within 21 days from the service of the notice on him.
(5) Subject to *subsection (6)* of this section, the time specified in an enforcement notice for compliance with a requirement specified therein shall not be expressed to expire before the end of the period of 21 days specified in *subsection (4) (b)* of this section and, if an appeal is brought against the requirement, the requirement need not be complied with and *subsection (9)* of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(6) If the Commissioner—
(*a*) by reason of special circumstances, is of opinion that a requirement specified in an enforcement notice should be complied with urgently, and
(a)an indication that the information constituting the data was received or obtained as aforesaid,
(b)if appropriate, an indication that the data subject has informed the data controller that he regards the information as inaccurate or not kept up to date, and
(c)any statement with which, pursuant to this Act, the data are supplemented.
##### 8. **Disclosure of personal data in certain cases.**
8.—Any restrictions in this Act on the F28[processing] of personal data do not apply if the F28[processing] is—
(a)in the opinion of a member of the Garda Síochána not below the rank of chief superintendent or an officer of the Permanent Defence Force who holds an army rank not below that of colonel and is designated by the Minister for Defence under this paragraph, required for the purpose of safeguarding the security of the State,
(b)required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid,
(c)required in the interests of protecting the international relations of the State,
(d)required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property,
(e)required by or under any enactment or by a rule of law or order of a court,
(f)required for the purposes of obtaining legal advice or for the purposes of, or in the course of, legal proceedings in which the person making the F28[processing] is a party or a witness,
(g)F29[…]
(h)made at the request or with the consent of the data subject or a person acting on his behalf.
##### 9. **The Commissioner.**
9.—F30[…]
##### 10. **Enforcement of data protection.**
10.—(1)(a)The Commissioner may investigate, or cause to be investigated, whether any of the provisions of this Act have been, are being or are likely to be contravened F33[…] in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention.
(b)Where a complaint is made to the Commissioner under *paragraph (a)* of this subsection, the Commissioner shall—
(i)investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious, and
F34[(ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter the subject of the complaint, notify in writing the individual who made the complaint of his or her decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it to the Court under section 26 of this Act within 21 days from the receipt by him or her of the notification.]
F35[(1A) The Commissioner may carry out or cause to be carried out such investigations as he or she considers appropriate in order to ensure compliance with the provisions of this Act and to identify any contravention thereof.]
(2)If the Commissioner is of opinion that a person F36[…] has contravened or is contravening a provision of this Act (other than a provision the contravention of which is an offence), the Commissioner may, by notice in writing (referred to in this Act as an enforcement notice) served on the person, require him to take such steps as are specified in the notice within such time as may be so specified to comply with the provision concerned.
(3)Without prejudice to the generality of *subsection (2)* of this section, if the Commissioner is of opinion that a data controller has contravened *section 2 (1)* of this Act, the relevant enforcement notice may require him—
F34[(*a*) to block, rectify, erase or destroy any of the data concerned, or]
(b)to supplement the data with such statement relating to the matters dealt with by them as the Commissioner may approve of; and as respects data that are inaccurate or not kept up to date, if he supplements them as aforesaid, he shall be deemed not to be in contravention of *paragraph (b)* of the said *section 2 (1)*.
(4)An enforcement notice shall—
(a)specify any provision of this Act that, in the opinion of the Commissioner, has been or is being contravened and the reasons for his having formed that opinion, and
(b)subject to *subsection (6)* of this section, state that the person concerned may appeal to the Court under *section 26* of this Act against the requirement specified in the notice within 21 days from the service of the notice on him.
(5)Subject to *subsection (6)* of this section, the time specified in an enforcement notice for compliance with a requirement specified therein shall not be expressed to expire before the end of the period of 21 days specified in *subsection (4) (b)* of this section and, if an appeal is brought against the requirement, the requirement need not be complied with and *subsection (9)* of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(6)If the Commissioner—
(a)by reason of special circumstances, is of opinion that a requirement specified in an enforcement notice should be complied with urgently, and
(b)includes a statement to that effect in the notice,
*subsections (4) (b)* and *(5)* of this section shall not apply in relation to the notice, but the notice shall contain a statement of the effect of the provisions of *section 26* (other than *subsection (3)*) of this Act and shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.
(7)On compliance by a data controller with a requirement under *subsection (3)* of this section, he shall, as soon as may be and in any event not more than 40 days after such compliance, notify—
(a)the data subject concerned, and
F34[(*b*) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period beginning 12 months before the date of the service of the enforcement notice concerned and ending immediately before such compliance unless such notification proves impossible or involves a disproportionate effort,
of the blocking, rectification, erasure, destruction or statement concerned.]
(8)The Commissioner may cancel an enforcement notice and, if he does so, shall notify in writing the person on whom it was served accordingly.
(9)A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an enforcement notice shall be guilty of an offence.
##### 11. **Prohibition on transfer of personal data outside State.**
**F37[11.**—(1) The transfer of personal data to a country or territory outside the European Economic Area may not take place unless that country or territory ensures an adequate level of protection for the privacy and the fundamental rights and freedoms of data subjects in relation to the processing of personal data having regard to all the circumstances surrounding the transfer and, in particular, but without prejudice to the generality of the foregoing, to—
(*a*) the nature of the data,
(*b*) the purposes for which and the period during which the data are intended to be processed,
(*c*) the country or territory of origin of the information contained in the data,
(*d*) the country or territory of final destination of that information,
(*e*) the law in force in the country or territory referred to in*paragraph (d)*,
(*f*) any relevant codes of conduct or other rules which are enforceable in that country or territory,
(*g*) any security measures taken in respect of the data in that country or territory, and
(*h*) the international obligations of that country or territory.
(2) (*a*) Where in any proceedings under this Act a question arises—
(i) whether the adequate level of protection specified in*subsection (1)*of this section is ensured by a country or territory outside the European Economic Area to which personal data are to be transferred, and
(ii) a Community finding has been made in relation to transfers of the kind in question,
the question shall be determined in accordance with that finding.
(*b*) In*paragraph (a)*of this subsection "Community finding" means a finding of the European Commission madefor the purposes of paragraph (4) or (6) of Article 25 of the Directive under the procedure provided for in Article 31(2) of the Directive in relation to whether the adequate level of protection specified in*subsection (1)*of this section is ensured by a country or territory outside the European Economic Area.
(3)F38[…]
(4) (*a*) This section shall not apply to a transfer of data if—
(i) the transfer of the data or the information constituting the data is required or authorised by or under—
(I) any enactment, or
(II) any convention or other instrument imposing an international obligation on the State,
(ii) the data subject has given his or her consent to the transfer,
(iii) the transfer is necessary—
(I) for the performance of a contract between the data subject and the data controller, or
(II) for the taking of steps at the request of the data subject with a view to his or her entering into a contract with the data controller,
(iv) the transfer is necessary—
(I) for the conclusion of a contract between the data controller and a person other than the data subject that—
(A) is entered into at the request of the data subject, and
(B) is in the interests of the data subject, or
(II) for the performance of such a contract,
(v) the transfer is necessary for reasons of substantial public interest,
(vi) the transfer is necessary for the purpose of obtaining legal advice or for the purpose of or in connection with legal proceedings or prospective legal proceedings or is otherwise necessary for the purposes of establishing or defending legal rights,
(vii) the transfer is necessary in order to prevent injury or other damage to the health of the data subject or serious loss of or damage to property of the data subject or otherwise to protect his or her vital interests, and informing the data subject of, or seeking his or her consent to, the transfer is likely to damage his or her vital interests,
(viii) the transfer is of part only of the personal data on a register established by or under an enactment, being—
(I) a register intended for consultation by the public, or
(II) a register intended for consultation by persons having a legitimate interest in its subject matter,
and, in the case of a register referred to in*clause (II)*of this subparagraph, the transfer is made, at the request of, or to, a person referred to in that clause and any conditions to which such consultation is subject are complied with by any person to whom the data are or are to be transferred, or
(ix) the transfer has been authorised by the Commissioner where the data controller adduces adequate safeguards with respect to the privacy and fundamental rights and freedoms of individuals and for the exercise by individuals of their relevant rights under this Act or the transfer is made on terms of a kind approved by the Commissioner as ensuring such safeguards.
(*b*)F38[…]
(*c*) The Commissioner shall comply with any decision of the European Commission under the procedure laid down in Article 31.2 of the Directive made for the purposes of paragraph 3 or 4 of Article 26 of the Directive.
(5) The Minister may, after consultation with the Commissioner, by regulations specify—
(*a*) the circumstances in which a transfer of data is to be taken for the purposes of*subsection (4)(a)(v)*of this section to be necessary for reasons of substantial public interest, and
(*b*) the circumstances in which such a transfer which is not required by or under an enactment is not to be so taken.
(6) Where, in relation to a transfer of data to a country or territory outside the European Economic Area, a data controller adduces the safeguards for the data subject concerned referred to in*subsection (4)(a)(ix)*of this section by means of a contract embodying the contractual clauses referred to in paragraph 2 or 4 of Article 26 of the Directive, the data subject shall have the same right—
(*a*) to enforce a clause of the contract conferring rights on him or her or relating to such rights, and
(*b*) to compensation or damages for breach of such a clause,
that he or she would have if he or she were a party to the contract.
(7) The Commissioner may, subject to the provisions of this section, prohibit the transfer of personal data from the State to a place outside the State unless such transfer is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the State.
(8) In determining whether to prohibit a transfer of personal data under this section, the Commissioner shall also consider whether the transfer would be likely to cause damage or distress to any person and have regard to the desirability of facilitating international transfers of data.
(9) A prohibition under*subsection (7)*of this section shall be effected by the service of a notice (referred to in this Act as a prohibition notice) on the person proposing to transfer the data concerned.
(10) A prohibition notice shall—
(*a*) prohibit the transfer concerned either absolutely or until the person aforesaid has taken such steps as are specified in the notice for protecting the interests of the data subjects concerned,
(*b*) specify the time when it is to take effect,
(*c*) specify the grounds for the prohibition, and
(*d*) subject to*subsection (12)*of this section, state that the person concerned may appeal to the Court under section 26 of this Act against the prohibition specified in the notice within 21 days from the service of the notice on him or her.
(11) Subject to*subsection (12)*of this section, the time specified in a prohibition notice for compliance with the prohibition specified therein shall not be expressed to expire before the end of the period of 21 days specified in*subsection (10)(d)*of this section and, if an appeal is brought against the prohibition, the prohibition need not be complied with and*subsection (15)*of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(12) If the Commissioner—
(*a*) by reason of special circumstances, is of opinion that a prohibition specified in a prohibition notice should be complied with urgently, and
(*b*) includes a statement to that effect in the notice,
*subsections (4) (b)* and *(5)* of this section shall not apply in relation to the notice, but the notice shall contain a statement of the effect of the provisions of *section 26* (other than *subsection (3)*) of this Act and shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.
(7) On compliance by a data controller with a requirement under *subsection (3)* of this section, he shall, as soon as may be and in any event not more than 40 days after such compliance, notify—
(*a*) the data subject concerned, and
(*b*) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period beginning 12 months before the date of the service of the enforcement notice concerned and ending immediately before such compliance,
of the rectification, erasure or statement concerned.
(8) The Commissioner may cancel an enforcement notice and, if he does so, shall notify in writing the person on whom it was served accordingly.
(9) A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an enforcement notice shall be guilty of an offence.
##### 11 Prohibition on transfer of personal data outside State.
**11.**—(1) The Commissioner may, subject to the provisions of this section, prohibit the transfer of personal data from the State to a place outside the State.
(2) The Commissioner, when considering whether to prohibit a proposed transfer of personal data from the State to a place in a state bound by the Convention, shall have regard to the provisions of Article 12 of the Convention.
(3) The Commissioner shall not prohibit a proposed transfer of personal data from the State to a place outside the State unless he is of opinion that the transfer would, if the place were in a state bound by the Convention, be likely to lead to a contravention of the basic principles for data protection set out in Chapter II of the Convention.
(4) In determining whether to prohibit a transfer of personal data under this section, the Commissioner shall also consider whether the transfer would be likely to cause damage or distress to any person and have regard to the desirability of facilitating international transfers of data.
(5) A prohibition under *subsection (1)* of this section shall be effected by the service of a notice (referred to in this Act as a prohibition notice) on the person proposing to transfer the data concerned.
(6) A prohibition notice shall—
(*a*) prohibit the transfer concerned either absolutely or until the person aforesaid has taken such steps as are specified in the notice for protecting the interests of the data subjects concerned,
(*b*) specify the time when it is to take effect,
(*c*) specify the grounds for the prohibition, and
(*d*) subject to *subsection (8)* of this section, state that the person concerned may appeal to the Court under *section 26* of this Act against the prohibition specified in the notice within 21 days from the service of the notice on him.
(7) Subject to *subsection (8)* of this section, the time specified in a prohibition notice for compliance with the prohibition specified therein shall not be expressed to expire before the end of the period of 21 days specified in *subsection (6) (d)* of this section and, if an appeal is brought against the prohibition, the prohibition need not be complied with and *subsection (13)* of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(8) If the Commissioner—
(*a*) by reason of special circumstances, is of opinion that a prohibition specified in a prohibition notice should be complied with urgently, and
(*b*) includes a statement to that effect in the notice,
*subsections (6) (d)* and *(7)* of this section shall not apply in relation to the notice but the notice shall contain a statement of the effect of the provisions of *section 26* (other than *subsection (3)*) of this Act and shall not require compliance with the prohibition before the end of the period of 7 days beginning on the date on which the notice is served.
(9) The Commissioner may cancel a prohibition notice and, if he does so, shall notify in writing the person on whom it was served accordingly.
(10) This section shall not apply to a transfer of data if the transfer of the data or the information constituting the data is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the State.
(11) For the purposes of this section, a place shall be deemed to be in a state bound by the Convention if it is in any territory in respect of which the state is so bound.
(12) (*a*) This section applies, with any necessary modifications, to a transfer of information from the State to a place outside the State for conversion into personal data as it applies to a transfer of personal data from the State to such a place.
(*b*) In *paragraph (a)* of this subsection “information” means information (not being data) relating to a living individual who can be identified from it.
(13) A person who, without reasonable excuse, fails or refuses to comply with a prohibition specified in a prohibition notice shall be guilty of an offence.
##### 12 Power to require information.
**12.**—(1) The Commissioner may, by notice in writing (referred to in this Act as an information notice) served on a person, require the person to furnish to him in writing within such time as may be specified in the notice such information in relation to matters specified in the notice as is necessary or expedient for the performance by the Commissioner of his functions.
(2) Subject to *subsection (3)* of this section—
(*a*) an information notice shall state that the person concerned may appeal to the Court under *section 26* of this Act against the requirement specified in the notice within 21 days from the service of the notice on him, and
(*b*) the time specified in the notice for compliance with a requirement specified therein shall not be expressed to expire before the end of the period of 21 days specified in *paragraph (a)* of this subsection and, if an appeal is brought against the requirement, the requirement need not be complied with and *subsection (5)* of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(3) If the Commissioner—
(*a*) by reason of special circumstances, is of opinion that a requirement specified in an information notice should be complied with urgently, and
(*b*) includes a statement to that effect in the notice,
*subsections (10)(d)*and*(11)*of this section shall not apply in relation to the notice but the notice shall contain a statement of the effect of the provisions of*section 26*(other than*subsection (3)*) of this Act and shall not require compliance with the prohibition before the end of the period of 7 days beginning on the date on which the notice is served.
(13) The Commissioner may cancel a prohibition notice and, if he or she does so, shall notify in writing the person on whom it was served accordingly.
(14) (*a*) This section applies, with any necessary modifications, to a transfer of information from the State to a place outside the State for conversion into personal data as it applies to a transfer of personal data from the State to such a place.
(*b*) In*paragraph (a)*of this subsection "information" means information (not being data) relating to a living individual who can be identified from it.
(15) A person who, without reasonable excuse, fails or refuses to comply with a prohibition specified in a prohibition notice shall be guilty of an offence.]
##### 12. **Power to require information.**
12.—(1)The Commissioner may, by notice in writing (referred to in this Act as an information notice) served on a person, require the person to furnish to him in writing within such time as may be specified in the notice such information in relation to matters specified in the notice as is necessary or expedient for the performance by the Commissioner of his functions.
(2)Subject to *subsection (3)* of this section—
(a)an information notice shall state that the person concerned may appeal to the Court under *section 26* of this Act against the requirement specified in the notice within 21 days from the service of the notice on him, and
(b)the time specified in the notice for compliance with a requirement specified therein shall not be expressed to expire before the end of the period of 21 days specified in *paragraph (a)* of this subsection and, if an appeal is brought against the requirement, the requirement need not be complied with and *subsection (5)* of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(3)If the Commissioner—
(a)by reason of special circumstances, is of opinion that a requirement specified in an information notice should be complied with urgently, and
(b)includes a statement to that effect in the notice,
*subsection (2)* of this section shall not apply in relation to the notice, but the notice shall contain a statement of the effect of the provisions of *section 26* (other than *subsection (3)*) of this Act and shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.
(4) (*a*) No enactment or rule of law prohibiting or restricting the disclosure of information shall preclude a person from furnishing to the Commissioner any information that is necessary or expedient for the performance by the Commissioner of his functions.
(*b*) *Paragraph (a)* of this subsection does not apply to information that in the opinion of the Minister or the Minister for Defence is, or at any time was, kept for the purpose of safeguarding the security of the State or information that is privileged from disclosure in proceedings in any court.
(5) A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an information notice or who in purported compliance with such a requirement furnishes information to the Commissioner that the person knows to be false or misleading in a material respect shall be guilty of an offence.
##### 13 Codes of practice.
**13.**—(1) The Commissioner shall encourage trade associations and other bodies representing categories of data controllers to prepare codes of practice to be complied with by those categories in dealing with personal data.
(2) The Commissioner may approve of any code of practice so prepared (referred to subsequently in this section as a code) if he is of opinion that it provides for the data subjects concerned a measure of protection with regard to personal data relating to them that conforms with that provided for by *sections 2, 3, 4* (other than *subsection (8)*) and *6* of this Act and shall encourage its dissemination to the data controllers concerned.
(3) Any such code that is so approved of may be laid by the Minister before each House of the Oireachtas and, if each such House passes a resolution approving of it, then—
(*a*) in so far as it relates to dealing with personal data by the categories of data controllers concerned—
(i) it shall have the force of law in accordance with its terms, and
(ii) upon its commencement, references (whether specific or general) in this Act to any of the provisions of the said sections shall be construed (or, if the code is in substitution for a code having the force of law by virtue of this subsection, continue to be construed) as if they were also references to the relevant provisions of the code for the time being having the force of law,
(4)(a)No enactment or rule of law prohibiting or restricting the disclosure of information shall preclude a person from furnishing to the Commissioner any information that is necessary or expedient for the performance by the Commissioner of his functions.
(b)*Paragraph (a)* of this subsection does not apply to information that in the opinion of the Minister or the Minister for Defence is, or at any time was, kept for the purpose of safeguarding the security of the State or information that is privileged from disclosure in proceedings in any court.
(5)A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an information notice or who in purported compliance with such a requirement furnishes information to the Commissioner that the person knows to be false or misleading in a material respect shall be guilty of an offence.
##### 12A. **F39[Prior checking of processing by Commissioner.**
**12A.**—(1) This section applies to any processing that is of a prescribed description, being processing that appears to the Commissioner to be particularly likely—
(*a*) to cause substantial damage or substantial distress to data subjects, or
(*b*) otherwise significantly to prejudice the rights and freedoms of data subjects.
(2) The Commissioner, on receiving—
(*a*) an application under*section 17*of this Act by a person to whom*section 16*of this Act applies for registration in the register and any prescribed information and any other information that he or she may require, or
(*b*) a request from a data controller in that behalf,
shall consider and determine—
(i) whether any of the processing to which the application or request relates is processing to which this section applies,
(ii) if it does, whether the processing to which this section applies is likely to comply with the provisions of this Act.
(3) Subject to*subsection (4)*of this section, the Commissioner shall, within the period of 90 days from the day on which he or she receives an application or a request referred to in*subsection (2)*of this section, serve a notice on the data controller concerned stating the extent to which, in the opinion of the Commissioner, the proposed processing is likely or unlikely to comply with the provisions of this Act.
(4) Before the end of the period referred to in*subsection (3)*, the Commissioner may, by reason of special circumstances, extend that period once only, by notice in writing served on the data controller concerned, by such further period not exceeding 90 days as the Commissioner may specify in the notice.
(5) If, for the purposes of his or her functions under this section, the Commissioner serves an information notice on the data controller concerned before the end of the period referred to in*subsection (3)*of this section or that period as extended under*subsection (4)*of this section—
(*a*) the period from the date of service of the notice to the date of compliance with the requirement in the notice, or
(*b*) if the requirement is set aside under*section 26*of this Act, the period from the date of such service to the date of such setting aside,
shall be added to the period referred to in the said*subsection (3)*or that period as so extended as aforesaid.
(6) Processing to which this section applies shall not be carried on unless—
(*a*) the data controller has—
(i) previously made an application under*section 17*of this Act and furnished the information specified in that section to the Commissioner, or
(ii) made a request under*subsection (2)*of this section,
and
(*b*) it shall be deemed to be a statutory instrument to which the Statutory Instruments Act, 1947, primarily applies.
(4) This section shall apply in relation to data processors as it applies in relation to categories of data controllers with the modification that the references in this section to the said sections shall be construed as references to *section 2 (1) (d)* of this Act and with any other necessary modifications.
##### 14 Annual report.
**14.**—(1) The Commissioner shall in each year after the year in which the first Commissioner is appointed prepare a report in relation to his activities under this Act in the preceding year and cause copies of the report to be laid before each House of the Oireachtas.
(2) Notwithstanding *subsection (1)* of this section, if, but for this subsection, the first report under that subsection would relate to a period of less than 6 months, the report shall relate to that period and to the year immediately following that period and shall be prepared as soon as may be after the end of that year.
##### 15 Mutual assistance between parties to Convention.
**15.**—(1) The Commissioner is hereby designated for the purposes of Chapter IV (which relates to mutual assistance) of the Convention.
(2) The Minister may make any regulations that he considers necessary or expedient for the purpose of enabling the said Chapter IV to have full effect.
(*b*) the data controller has complied with any information notice served on him or her in relation to the matter, and
(*c*)(i) the period of 90 days from the date of the receipt of the application or request referred to in*subsection (3)*of this section (or that period as extended under subsections (4) and (5) of this section or either of them) has elapsed without the receipt by the data controller of a notice under the said*subsection (3)*, or
(ii) the data controller has received a notice under the said*subsection (3)*stating that the particularprocessing proposed to be carried on is likely to comply with the provisions of this Act, or
(iii) the data controller—
(I) has received a notice under the said*subsection (3)*stating that, if the requirements specified by the Commissioner (which he or she is hereby authorised to specify) and appended to the notice are complied with by the data controller, the processing proposed to be carried on is likely to comply with the provisions of this Act, and
(II) has complied with those requirements.
(7) A person who contravenes*subsection (6)*of this section shall be guilty of an offence.
(8) An appeal against a notice under*subsection (3)*of this section or a requirement appended to the notice may be made to and heard and determined by the Court under section 26 of this Act and that section shall apply as if such a notice and such a requirement were specified in*subsection (1)*of the said*section 26*.
(9) The Minister, after consultation with the Commissioner, may by regulations amend*subsections (3)*,*(4)*and*(6)*of this section by substituting for the number of days for the time being specified therein a different number specified in the regulations.
(10) A data controller shall pay to the Commissioner such fee (if any) as may be prescribed in respect of the consideration by the Commissioner, in relation to proposed processing by the data controller, of the matters referred to in*paragraphs (i)*and*(ii)*of*subsection (2)*of this section and different fees may be prescribed in relation to different categories of processing.
(11) In this section a reference to a data controller includes a reference to a data processor.]
##### 13. **Codes of practice.**
13.—F40[…]
##### 14. **Annual report.**
14.—F43[…]
##### 15. **Mutual assistance between parties to Convention.**
15.—(1)The Commissioner is hereby designated for the purposes of Chapter IV (which relates to mutual assistance) of the Convention.
(2)The Minister may make any regulations that he considers necessary or expedient for the purpose of enabling the said Chapter IV to have full effect.
*Registration*
##### 16 The register.
**16.**—(1) This section applies to the following persons, that is to say:
(*a*) data controllers, being public authorities and other bodies and persons referred to in the *Third Schedule* to this Act,
(*b*) data controllers, being financial institutions, persons holding authorisations under the European Communities (Non-Life) Insurance Regulations, 1976 (S.I. No. 115 of 1976), or the European Communities (Life Assurance) Regulations, 1984 (S.I. No. 57 of 1984), or persons whose business consists wholly or mainly in direct marketing, providing credit references or collecting debts,
(*c*) any other data controllers who keep personal data relating to—
(i) racial origin,
(ii) political opinions or religious or other beliefs,
(iii) physical or mental health (other than any such data reasonably kept by them in relation to the physical or mental health of their employees in the ordinary course of personnel administration and not used or disclosed for any other purpose),
(iv) sexual life, or
(v) criminal convictions,
(*d*) data processors whose business consists wholly or partly in processing personal data on behalf of data controllers, and
(*e*) such categories of data controllers and data processors as may stand prescribed for the time being (which categories may include data controllers and data processors to whom this section would not otherwise apply and on whom enforcement notices, prohibition notices or information notices have been served if the notices are in force and either the time for bringing an appeal against them under *section 26* of this Act has expired without such an appeal having been brought or any such appeal has been withdrawn).
(2) The Commissioner shall establish and maintain a register (referred to in this Act as the register) of persons to whom this section applies and shall make, as appropriate, an entry or entries in the register in respect of each person whose application for registration therein is accepted by the Commissioner.
(3) (*a*) Members of the public may inspect the register free of charge at all reasonable times and may take copies of, or of extracts from, entries in the register.
(*b*) A member of the public may, on payment to the Commissioner of such fee (if any) as may be prescribed, obtain from the Commissioner a copy (certified by him or by a member of his staff to be a true copy) of, or of an extract from, any entry in the register.
(*c*) In any proceedings—
(i) a copy of, or of an extract from, an entry in the register certified by the Commissioner or by a member of his staff to be a true copy shall be evidence of the entry or extract, and
(ii) a document purporting to be such a copy, and to be certified, as aforesaid shall be deemed to be such a copy and to be so certified unless the contrary is proved.
(*d*) In any proceedings—
(i) a certificate signed by the Commissioner or by a member of his staff and stating that there is not an entry in the register in respect of a specified person as a data controller or as a data processor shall be evidence of that fact, and
(ii) a document purporting to be such a certificate, and to be signed, as aforesaid shall be deemed to be such a certificate and to be so signed unless the contrary is proved.
##### 17 Applications for registration.
17.—(1) (*a*) A person wishing to be registered in the register or to have a registration continued under *section 18* of this Act or to have the particulars in an entry in the register altered shall make an application in writing in that behalf to the Commissioner and shall furnish to him such information as may be prescribed and any other information that he may require.
(*b*) Where a data controller intends to keep personal data for two or more purposes, he may make an application for separate registration in respect of any of those purposes and, subject to the provisions of this Act, entries shall be made in the register in accordance with any such applications.
(2) Subject to *subsection (3)* of this section, the Commissioner shall accept an application for registration, made in the prescribed manner and in respect of which such fee as may be prescribed has been paid, from a person to whom *section 16* of this Act applies unless he is of opinion that—
(*a*) the particulars proposed for inclusion in an entry in the register are insufficient or any other information required by the Commissioner either has not been furnished or is insufficient, or
(*b*) the person applying for registration is likely to contravene any of the provisions of this Act.
(3) The Commissioner shall not accept such an application for registration as aforesaid from a data controller who keeps personal data specified in *section 16 (1) (c)* of this Act unless he is of opinion that appropriate safeguards for the protection of the privacy of the data subjects concerned are being, and will continue to be, provided by him.
(4) Where the Commissioner refuses an application for registration, he shall, as soon as may be, notify in writing the person applying for registration of the refusal and the notification shall—
(*a*) specify the reasons for the refusal, and
(*b*) state that the person may appeal to the Court under *section 26* of this Act against the refusal within 21 days from the receipt by him of the notification.
(5) If—
(*a*) the Commissioner, by reason of special circumstances, is of opinion that a refusal of an application for registration should take effect urgently, and
(*b*) the notification of the refusal includes a statement to that effect and a statement of the effect of the provisions of *section 26* (other than *subsection (3)*) of this Act,
*paragraph (b)* of *subsection (4)* of this section shall not apply in relation to the notification and *paragraph (b)* of *subsection (6)* of this section shall be construed and have effect as if for the words from and including “21 days” to the end of the paragraph there were substituted “7 days beginning on the date on which the notification was received,”.
(6) Subject to *subsection (5)* of this section, a person who has made an application for registration shall—
(*a*) until he is notified that it has been accepted or it is withdrawn, or
(*b*) if he is notified that the application has been refused, until the end of the period of 21 days within which an appeal may be brought under *section 26* of this Act against the refusal and, if such an appeal is brought, until the determination or withdrawal of the appeal,
be treated for the purposes of *section 19* of this Act as if the application had been accepted and the particulars contained in it had been included in an entry in the register on the date on which the application was made.
(7) *Subsections (2)* to *(6)* of this section apply, with any necessary modifications, to an application for continuance of registration and an application for alteration of the particulars in an entry in the register as they apply to an application for registration.
##### 18 Duration and continuance of registration.
**18.**—(1) A registration (whether it is the first registration or a registration continued under this section) shall be for the prescribed period and on the expiry thereof the relevant entry shall be removed from the register unless the registration is continued as aforesaid.
(2) The prescribed period (which shall not be less than one year) shall be calculated—
(*a*) in the case of a first registration, from the date on which the relevant entry was made in the register, and
(*b*) in the case of a registration which has been continued under this section, from the date from which it was so continued.
(3) The Commissioner shall, subject to the provisions of this Act, continue a registration, whether it has previously been continued under this section or not.
(4) Notwithstanding the foregoing provisions of this section, the Commissioner may at any time, at the request of the person to whom an entry relates, remove it from the register.
##### 19 Effect of registration.
**19.**—(1) A data controller to whom *section 16* of this Act applies shall not keep personal data unless there is for the time being an entry in the register in respect of him.
(2) A data controller in respect of whom there is an entry in the register shall not—
(*a*) keep personal data of any description other than that specified in the entry,
(*b*) keep or use personal data for a purpose other than the purpose or purposes described in the entry,
(*c*) if the source from which such data, and any information intended for inclusion in such data, are obtained is required to be described in the entry, obtain such data or information from a source that is not so described,
(*d*) disclose such data to a person who is not described in the entry (other than a person to whom a disclosure of such data may be made in the circumstances specified in *section 8* of this Act),
(*e*) directly or indirectly transfer such data to a place outside the State other than one named or described in the entry.
(3) An employee or agent (not being a data processor) of a data controller mentioned in *subsection (2)* of this section shall, as respects personal data kept or, as the case may be, to be kept by the data controller, be subject to the same restrictions in relation to the use, source, disclosure or transfer of the data as those to which the data controller is subject under that subsection.
(4) A data processor to whom *section 16* applies shall not process personal data unless there is for the time being an entry in the register in respect of him.
(5) If and whenever a person in respect of whom there is an entry in the register changes his address, he shall thereupon notify the Commissioner of the change.
(6) A person who contravenes *subsection (1), (4)* or *(5)*, or knowingly contravenes any other provision, of this section shall be guilty of an offence.
##### 20 Regulations for registration.
**20.**—(1) The following matters, and such other matters (if any) as may be necessary or expedient for the purpose of enabling *sections 16* to *19* of this Act to have full effect, may be prescribed:
(*a*) the procedure to be followed in relation to applications by persons for registration, continuance of registration or alteration of the particulars in an entry in the register or for withdrawal of such applications,
(*b*) the information required to be furnished to the Commissioner by such persons, and
(*c*) the particulars to be included in entries in the register,
and different provision may be made in relation to the matters aforesaid as respects different categories of persons.
(2) A person who in purported compliance with a requirement prescribed under this section furnishes information to the Commissioner that the person knows to be false or misleading in a material respect shall be guilty of an offence.
##### 16. **The register.**
16.—F46[…]
##### 17. **Applications for registration.**
17.—F48[…]
##### 18. **Duration and continuance of registration.**
18.—F51[…]
##### 19. **Effect of registration.**
19.—F53[…]
##### 20. **Regulations for registration.**
20.—F54[…]
*Miscellaneous*
##### 21 Unauthorised disclosure by data processor.
**21.**—(1) Personal data processed by a data processor shall not be disclosed by him, or by an employee or agent of his, without the prior authority of the data controller on behalf of whom the data are processed.
(2) A person who knowingly contravenes *subsection (1)* of this section shall be guilty of an offence.
##### 22 Disclosure of personal data obtained without authority.
**22.**—(1) A person who—
(*a*) obtains access to personal data, or obtains any information constituting such data, without the prior authority of the data controller or data processor by whom the data are kept, and
(*b*) discloses the data or information to another person,
##### 21. **Unauthorised disclosure by data processor.**
21.—(1)Personal data processed by a data processor shall not be disclosed by him, or by an employee or agent of his, without the prior authority of the data controller on behalf of whom the data are processed.
(2)A person who knowingly contravenes *subsection (1)* of this section shall be guilty of an offence.
##### 22. **Disclosure of personal data obtained without authority.**
22.—(1)A person who—
(a)obtains access to personal data, or obtains any information constituting such data, without the prior authority of the data controller or data processor by whom the data are kept, and
(b)discloses the data or information to another person,
shall be guilty of an offence.
(2) *Subsection (1)* of this section does not apply to a person who is an employee or agent of the data controller or data processor concerned.
##### 23 Provisions in relation to certain non-residents and to data kept or processed outside State.
**23.**—(1) Subject to the provisions of this section, this Act does not apply to a data controller in respect of data kept, or to a data processor in respect of data processed, outside the State.
(2) For the purposes of this section, data shall be deemed to be—
(*a*) kept by a data controller in the place where he controls their contents and use, and
(*b*) processed by a data processor in the place where the relevant data equipment is located.
(3) Where a person who is not resident in the State controls the contents and use of personal data kept within the State, or processes any such data, through an employee or agent in the State, this Act shall apply as if that control was exercised or, as the case may be, the data were processed by the employee or agent acting on his own account.
(4) This Act does not apply to data processed wholly outside the State unless the data are used or intended to be used in the State.
(5) *Section 19 (2) (e)* of this Act does not apply to the transfer of data that are already outside the State.
##### 24 Powers of authorised officers.
**24.**—(1) In this section “authorised officer” means a person authorised in writing by the Commissioner to exercise, for the purposes of this Act, the powers conferred by this section.
(2) An authorised officer may, for the purpose of obtaining any information that is necessary or expedient for the performance by the Commissioner of his functions, on production of the officer's authorisation, if so required—
(*a*) at all reasonable times enter premises that he reasonably believes to be occupied by a data controller or a data processor, inspect the premises and any data therein (other than data consisting of information specified in *section 12 (4) (b)* of this Act) and inspect, examine, operate and test any data equipment therein,
(*b*) require any person on the premises, being a data controller, a data processor or an employee of either of them, to disclose to the officer any such data and produce to him any data material (other than data material consisting of information so specified) that is in that person's power or control and to give to him such information as he may reasonably require in regard to such data and material,
(*c*) either on the premises or elsewhere, inspect and copy or extract information from such data, or inspect and copy or take extracts from such material, and
(*d*) require any person mentioned in *paragraph (b)* of this subsection to give to the officer such information as he may reasonably require in regard to the procedures employed for complying with the provisions of this Act, the sources from which such data are obtained, the purposes for which they are kept, the persons to whom they are disclosed and the data equipment in the premises.
(3) Subject to *subsection (5)* of this section, *subsection (2)* of this section shall not apply in relation to a financial institution.
(4) Whenever the Commissioner considers it necessary or expedient for the performance by him of his functions that an authorised officer should exercise, in relation to a financial institution, the powers conferred by *subsection (2)* of this section, the Commissioner may apply to the High Court for an order under this section.
(5) Whenever, on an application to it under *subsection (4)* of this section, the High Court is satisfied that it is reasonable to do so and is satisfied that the exigencies of the common good so warrant, it may make an order authorising an authorised officer to exercise the powers conferred by *subsection (2)* of this section in relation to the financial institution concerned, subject to such conditions (if any) as it thinks proper and specifies in the order.
(6) A person who obstructs or impedes an authorised officer in the exercise of a power, or, without reasonable excuse, does not comply with a requirement, under this section or who in purported compliance with such a requirement gives information to an authorised officer that he knows to be false or misleading in a material respect shall be guilty of an offence.
##### 25 Service of notices.
**25.**—Any notice authorised by this Act to be served on a person by the Commissioner may be served—
(*a*) if the person is an individual—
(i) by delivering it to him or
(ii) by sending it to him by post addressed to him at his usual or last-known place of residence or business, or
(iii) by leaving it for him at that place,
(*b*) if the person is a body corporate or an unincorporated body of persons, by sending it to the body by post to, or addressing it to and leaving it at, in the case of a company, its registered office (within the meaning of the Companies Act, 1963) and, in any other case, its principal place of business.
##### 26 Appeals to Circuit Court.
**26.**—(1) An appeal may be made to and heard and determined by the Court against—
(*a*) a requirement specified in an enforcement notice or an information notice,
(*b*) a prohibition specified in a prohibition notice,
(*c*) a refusal by the Commissioner under *section 17* of this Act, notified by him under that section, and
(*d*) a decision of the Commissioner in relation to a complaint under *section 10 (1) (a)* of this Act,
(2)*Subsection (1)* of this section does not apply to a person who is an employee or agent of the data controller or data processor concerned.
##### 22A. **F55[Journalism, literature and art.**
**22A.**—F56[…]]
##### 23. **Provisions in relation to certain non-residents and to data kept or processed outside State.**
23.—F57[…]
##### 24. **Powers of authorised officers.**
24.—F58[(1) In this section "authorised officer" has the same meaning that it has insection 2(1) of the Data Protection Act 2018.]
(2)An authorised officer may, for the purpose of obtaining any information that is necessary or expedient for the performance by the Commissioner of his functions, on production of the officer’s authorisation, if so required—
(a)at all reasonable times enter premises that he reasonably believes to be occupied by a data controller or a data processor, inspect the premises and any data therein (other than data consisting of information specified in *section 12 (4) (b)* of this Act) and inspect, examine, operate and test any data equipment therein,
(b)require any person on the premises, being a data controller, a data processor or an employee of either of them, to disclose to the officer any such data and produce to him any data material (other than data material consisting of information so specified) that is in that person’s power or control and to give to him such information as he may reasonably require in regard to such data and material,
(c)either on the premises or elsewhere, inspect and copy or extract information from such data, or inspect and copy or take extracts from such material, and
(d)require any person mentioned in *paragraph (b)* of this subsection to give to the officer such information as he may reasonably require in regard to the procedures employed for complying with the provisions of this Act, the sources from which such data are obtained, the purposes for which they are kept, the persons to whom they are disclosed and the data equipment in the premises.
(3)F59[…]
(4)F59[…]
(5)F59[…]
(6)A person who obstructs or impedes an authorised officer in the exercise of a power, or, without reasonable excuse, does not comply with a requirement, under this section or who in purported compliance with such a requirement gives information to an authorised officer that he knows to be false or misleading in a material respect shall be guilty of an offence.
##### 25. **Service of notices.**
25.—Any notice authorised by this Act to be served on a person by the Commissioner may be served—
(a)if the person is an individual—
(i)by delivering it to him or
(ii)by sending it to him by post addressed to him at his usual or last-known place of residence or business, or
(iii)by leaving it for him at that place,
(b)if the person is a body corporate or an unincorporated body of persons, by sending it to the body by post to, or addressing it to and leaving it at, in the case of a company, its registered office (within the meaning of the Companies Act, 1963) and, in any other case, its principal place of business.
##### 26. **Appeals to Circuit Court.**
26.—(1)An appeal may be made to and heard and determined by the Court against—
(a)a requirement specified in an enforcement notice or an information notice,
(b)a prohibition specified in a prohibition F60[notice, and]
(c)F61[…]
(d)a decision of the Commissioner in relation to a complaint under *section 10 (1) (a)* of this Act,
and such an appeal shall be brought within 21 days from the service on the person concerned of the relevant notice or, as the case may be, the receipt by such person of the notification of the relevant refusal or decision.
(2) The jurisdiction conferred on the Court by this Act shall be exercised by the judge for the time being assigned to the circuit where the appellant ordinarily resides or carries on any profession, business or occupation or, at the option of the appellant, by a judge of the Court for the time being assigned to the Dublin circuit.
(3) (*a*) Subject to *paragraph (b)* of this subsection, a decision of the Court under this section shall be final.
(*b*) An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.
(4) Where—
(*a*) a person appeals to the Court pursuant to *paragraph (a), (b)* or *(c)* of *subsection (1)* of this section,
(*b*) the appeal is brought within the period specified in the notice or notification mentioned in *paragraph (c)* of this subsection, and
(*c*) the Commissioner has included a statement in the relevant notice or notification to the effect that by reason of special circumstances he is of opinion that the requirement or prohibition specified in the notice should be complied with, or the refusal specified in the notification should take effect, urgently,
then, notwithstanding any provision of this Act, if the Court, on application to it in that behalf, so determines, non-compliance by the person with a requirement or prohibition specified in the notice, or, as the case may be, a contravention by him of *section 19* of this Act, during the period ending with the determination or withdrawal of the appeal or during such other period as may be determined as aforesaid shall not constitute an offence.
##### 27 Evidence in proceedings.
**27.**—(1) In any proceedings—
(*a*) a certificate signed by the Minister or the Minister for Defence and stating that in his opinion personal data are, or at any time were, kept for the purpose of safeguarding the security of the State shall be evidence of that opinion,
(*b*) a certificate—
(i) signed by a member of the Garda Síochána not below the rank of chief superintendent or an officer of the Permanent Defence Force who holds an army rank not below that of colonel and is designated by the Minister for Defence under *section 8 (a)* of this Act, and
(ii) stating that in the opinion of the member or, as the case may be, the officer a disclosure of personal data is required for the purpose aforesaid,
(2)The jurisdiction conferred on the Court by this Act shall be exercised by the judge for the time being assigned to the circuit where the appellant ordinarily resides or carries on any profession, business or occupation or, at the option of the appellant, by a judge of the Court for the time being assigned to the Dublin circuit.
(3)(a)Subject to *paragraph (b)* of this subsection, a decision of the Court under this section shall be final.
(b)An appeal may be brought to the High Court on a point of law against such a decision; and references in this Act to the determination of an appeal shall be construed as including references to the determination of any such appeal to the High Court and of any appeal from the decision of that Court.
(4)Where—
(a)a person appeals to the Court pursuant to *F62[paragraph (a) or (b)*of*subsection (1)*of this section],
(b)the appeal is brought within the period specified in the notice or notification mentioned in *paragraph (c)* of this subsection, and
(c)the Commissioner has included a statement in the relevant notice or notification to the effect that by reason of special circumstances he is of opinion that the requirement or prohibition specified in the notice should be complied with, or the refusal specified in the notification should take effect, urgently,
then, notwithstanding any provision of this Act, if the Court, on application to it in that behalf, so determines, non-compliance by the person F62[with a requirement or prohibition specified in the notice] during the period ending with the determination or withdrawal of the appeal or during such other period as may be determined as aforesaid shall not constitute an offence.
##### 27. **Evidence in proceedings.**
27.—(1)In any proceedings—
(a)a certificate signed by the Minister or the Minister for Defence and stating that in his opinion personal data are, or at any time were, kept for the purpose of safeguarding the security of the State shall be evidence of that opinion,
(b)a certificate—
(i)signed by a member of the Garda Síochána not below the rank of chief superintendent or an officer of the Permanent Defence Force who holds an army rank not below that of colonel and is designated by the Minister for Defence under *section 8 (a)* of this Act, and
(ii)stating that in the opinion of the member or, as the case may be, the officer a disclosure of personal data is required for the purpose aforesaid,
shall be evidence of that opinion, and
(*c*) a document purporting to be a certificate under *paragraph (a)* or *(b)* of this subsection and to be signed by a person specified in the said *paragraph (a)* or *(b)*, as appropriate, shall be deemed to be such a certificate and to be so signed unless the contrary is proved.
(2) Information supplied by a person in compliance with a request under *section 3* or *4 (1)* of this Act, a requirement under this Act or a direction of a court in proceedings under this Act shall not be admissible in evidence against him or his spouse in proceedings for an offence under this Act.
##### 28 Hearing of proceedings.
**28.**—The whole or any part of any proceedings under this Act may, at the discretion of the court, be heard otherwise than in public.
##### 29 Offences by directors, etc., of bodies corporate.
**29.**—(1) Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of or to be attributable to any neglect on the part of a person, being a director, manager, secretary or other officer of that body corporate, or a person who was purporting to act in any such capacity, that person, as well as the body corporate, shall be guilty of that offence and be liable to be proceeded against and punished accordingly.
(2) Where the affairs of a body corporate are managed by its members, *subsection (1)* of this section shall apply in relation to the acts and defaults of a member in connection with his functions of management as if he were a director or manager of the body corporate.
##### 30 Prosecution of summary offences by Commissioner.
**30.**—(1) Summary proceedings for an offence under this Act may be brought and prosecuted by the Commissioner.
(2) Notwithstanding section 10 (4) of the Petty Sessions (Ireland) Act, 1851, summary proceedings for an offence under this Act may be instituted within one year from the date of the offence.
##### 31 Penalties.
**31.**—(1) A person guilty of an offence under this Act shall be liable—
(*a*) on summary conviction, to a fine not exceeding £1,000, or
(*b*) on conviction on indictment, to a fine not exceeding £50,000.
(2) Where a person is convicted of an offence under this Act, the court may order any data material which appears to the court to be connected with the commission of the offence to be forfeited or destroyed and any relevant data to be erased.
(3) The court shall not make an order under *subsection (2)* of this section in relation to data material or data where it considers that some person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data unless such steps as are reasonably practicable have been taken for notifying that person and giving him an opportunity to show cause why the order should not be made.
(4) Section 13 of the Criminal Procedure Act, 1967, shall apply in relation to an offence under this Act that is not being prosecuted summarily as if, in lieu of the penalties provided for in subsection (3) (*a*) of that section, there were specified therein the fine provided for in *subsection (1) (a)* of this section and the reference in subsection (2) (*a*) of the said section 13 to the penalties provided for by subsection (3) shall be construed and have effect accordingly.
##### 32 Laying of regulations before Houses of Oireachtas.
**32.**—Every regulation made under this Act (other than *section 2*) shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the regulation is passed by either such House within the next 21 days on which that House has sat after the regulation is laid before it, the regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder.
##### 33 Fees.
**33.**—(1) Fees under this Act shall be paid into or disposed of for the benefit of the Exchequer in accordance with the directions of the Minister for Finance.
(2) The Public Offices Fees Act, 1879, shall not apply in respect of any fees under this Act.
##### 34 Expenses of Minister.
**34.**—The expenses incurred by the Minister in the administration of this Act shall, to such extent as may be sanctioned by the Minister for Finance, be paid out of moneys provided by the Oireachtas.
##### 35 Short title and commencement.
**35.**—(1) This Act may be cited as the Data Protection Act, 1988.
(2) This Act shall come into operation on such day or days as, by order or orders made by the Minister under this section, may be fixed therefor either generally or with reference to any particular purpose or provision and different days may be so fixed for different purposes and different provisions.
## FIRST SCHEDULE Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January, 1981
PREAMBLE
The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve greater unity between its members, based in particular on respect for the rule of law, as well as human rights and fundamental freedoms;
Considering that it is desirable to extend the safeguards for everyone's rights and fundamental freedoms, and in particular the right to the respect for privacy, taking account of the increasing flow across frontiers of personal data undergoing automatic processing;
Reaffirming at the same time their commitment to freedom of information regardless of frontiers;
Recognising that it is necessary to reconcile the fundamental values of the respect for privacy and the free flow of information between peoples,
Have agreed as follows:
## SECOND SCHEDULE The Data Protection Commissioner
1. The Commissioner shall be a body corporate and shall be independent in the performance of his functions.
2. (1) The Commissioner shall be appointed by the Government and, subject to the provisions of this Schedule, shall hold office upon such terms and conditions as the Government may determine.
(2) The Commissioner—
(*a*) may at any time resign his office as Commissioner by letter addressed to the Secretary to the Government and the resignation shall take effect on and from the date of receipt of the letter,
(*b*) may at any time be removed from office by the Government if, in the opinion of the Government, he has become incapable through ill-health of effectively performing his functions or has committed stated misbehaviour, and
(*c*) shall, in any case, vacate the office of Commissioner on reaching the age of 65 years.
3. The term of office of a person appointed to be the Commissioner shall be such term not exceeding 5 years as the Government may determine at the time of his appointment and, subject to the provisions of this Schedule, he shall be eligible for re-appointment to the office.
4. (1) Where the Commissioner is—
(*a*) nominated as a member of Seanad Éireann,
(*b*) elected as a member of either House of the Oireachtas, the European Parliament or a local authority, or
(*c*) regarded pursuant to section 15 (inserted by the European Assembly Elections Act, 1984) of the European Assembly Elections Act, 1977, as having been elected to such Parliament to fill a vacancy,
he shall thereupon cease to be the Commissioner.
(2) A person who is for the time being—
(i) entitled under the standing orders of either House of the Oireachtas to sit therein,
(ii) a member of the European Parliament, or
(iii) entitled under the standing orders of a local authority to sit therein,
shall, while he is so entitled or is such a member, be disqualified for holding the office of Commissioner.
5. The Commissioner shall not hold any other office or employment in respect of which emoluments are payable.
6. There shall be paid to the Commissioner, out of moneys provided by the Oireachtas, such remuneration and allowances for expenses as the Minister, with the consent of the Minister for Finance, may from time to time determine.
7. (*a*) The Minister shall, with the consent of the Minister for Finance, make and carry out, in accordance with its terms, a scheme or schemes for the granting of pensions, gratuities or other allowances on retirement or death to or in respect of persons who have held the office of Commissioner.
(*b*) The Minister may, with the consent of the Minister for Finance, at any time make and carry out, in accordance with its terms, a scheme or schemes amending or revoking a scheme under this paragraph.
(*c*) A scheme under this paragraph shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the scheme is passed by either such House within the next 21 days on which that House has sat after the scheme is laid before it, the scheme shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder.
8. (1) The Minister may appoint to be members of the staff of the Commissioner such number of persons as may be determined from time to time by the Minister, with the consent of the Minister for Finance.
(2) Members of the staff of the Commissioner shall be civil servants.
(3) The functions of the Commissioner under this Act may be performed during his temporary absence by such member of the staff of the Commissioner as he may designate for that purpose.
(4) The Minister may delegate to the Commissioner the powers exercisable by him under the Civil Service Commissioners Act, 1956, and the Civil Service Regulation Acts, 1956 and 1958, as the appropriate authority in relation to members of the staff of the Commissioner and, if he does so, then so long as the delegation remains in force—
(*a*) those powers shall, in lieu of being exercisable by the Minister, be exercisable by the Commissioner, and
(*b*) the Commissioner shall, in lieu of the Minister, be for the purposes of this Act the appropriate authority in relation to members of the staff of the Commissioner.
9. (1) The Commissioner shall keep in such form as may be approved of by the Minister, with the consent of the Minister for Finance, all proper and usual accounts of all moneys received or expended by him and all such special accounts (if any) as the Minister, with the consent of the Minister for Finance, may direct.
(2) Accounts kept in pursuance of this paragraph in respect of each year shall be submitted by the Commissioner in the following year on a date (not later than a date specified by the Minister) to the Comptroller and Auditor General for audit and, as soon as may be after the audit, a copy of those accounts, or of such extracts from those accounts as the Minister may specify, together with the report of the Comptroller and Auditor General on the accounts, shall be presented by the Commissioner to the Minister who shall cause copies of the documents presented to him to be laid before each House of the Oireachtas.
## THIRD SCHEDULE Public Authorities and Other Bodies and Persons
1. The Government.
2. A Minister of the Government.
3. The Attorney General.
4. The Comptroller and Auditor General.
5. The Ombudsman.
6. A local authority, a health board and any other body (other than the Garda Síochána and the Defence Forces) established—
(1) by or under any enactment (other than the Companies Acts, 1963 to 1987), or
(2) under the Companies Acts, 1963 to 1987, in pursuance of powers conferred by or under another enactment,
and financed wholly or partly by means of moneys provided, or loans made or guaranteed, by a Minister of the Government or the issue of shares held by or on behalf of a Minister of the Government; and a subsidiary of any such body.
7. A company the majority of the shares in which are held by or on behalf of a Minister of the Government.
8. A body (other than a body mentioned in *paragraph 6* or *7* of this Schedule) appointed by the Government or a Minister of the Government.
9. An individual (other than an individual remunerated by a body mentioned in *paragraph 6, 7* or *8* of this Schedule or in relation to whom the Government or a Minister of the Government is the appropriate authority) who is appointed by the Government or a Minister of the Government to an office established by or under any enactment.
10. Any other public authority, body or person standing prescribed for the time being and financed or remunerated wholly or partly out of moneys provided by the Oireachtas.
(c)a document purporting to be a certificate under *paragraph (a)* or *(b)* of this subsection and to be signed by a person specified in the said *paragraph (a)* or *(b)*, as appropriate, shall be deemed to be such a certificate and to be so signed unless the contrary is proved.
(2)Information supplied by a person in compliance with a request under *section 3* or *4 (1)* of this Act, a requirement under this Act or a direction of a court in proceedings under this Act shall not be admissible in evidence against him or his spouse in proceedings for an offence under this Act.
##### 28. **Hearing of proceedings.**
28.—The whole or any part of any proceedings under this Act may, at the discretion of the court, be heard otherwise than in public.
##### 29. **Offences by directors, etc., of bodies corporate.**
29.—(1)Where an offence under this Act has been committed by a body corporate and is proved to have been committed with the consent or connivance of or to be attributable to any neglect on the part of a person, being a director, manager, secretary or other officer of that body corporate, or a person who was purporting to act in any such capacity, that person, as well as the body corporate, shall be guilty of that offence and be liable to be proceeded against and punished accordingly.
(2)Where the affairs of a body corporate are managed by its members, *subsection (1)* of this section shall apply in relation to the acts and defaults of a member in connection with his functions of management as if he were a director or manager of the body corporate.
##### 30. **Prosecution of summary offences by Commissioner.**
30.—(1)Summary proceedings for an offence under this Act may be brought and prosecuted by the Commissioner.
(2)Notwithstanding section 10 (4) of the Petty Sessions (Ireland) Act, 1851, summary proceedings for an offence under this Act may be instituted within on e year from the date of the offence.
##### 31. **Penalties.**
31.—(1)A person guilty of an offence under this Act shall be liable—
(a)on summary conviction, to a fine not exceeding F63[€3,000], or
(b)on conviction on indictment, to a fine not exceeding F63[€100,000].
(2)Where a person is convicted of an offence under this Act, the court may order any data material which appears to the court to be connected with the commission of the offence to be forfeited or destroyed and any relevant data to be erased.
(3)The court shall not make an order under *subsection (2)* of this section in relation to data material or data where it considers that some person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data unless such steps as are reasonably practicable have been taken for notifying that person and giving him an opportunity to show cause why the order should not be made.
(4)Section 13 of the Criminal Procedure Act, 1967, shall apply in relation to an offence under this Act that is not being prosecuted summarily as if, in lieu of the penalties provided for in subsection (3) (*a*) of that section, there were specified therein the fine provided for in *subsection (1) (a)* of this section and the reference in subsection (2) (*a*) of the said section 13 to the penalties provided for by *subsection (3)* shall be construed and have effect accordingly.
##### 32. **Laying of regulations before Houses of Oireachtas.**
32.—Every regulation made under this Act (other than *section 2*) shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the regulation is passed by either such House within the next 21 days on which that House has sat after the regulation is laid before it, the regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder.
##### 33. **Fees.**
33.—F64[…]
##### 34. **Expenses of Minister.**
34.—The expenses incurred by the Minister in the administration of this Act shall, to such extent as may be sanctioned by the Minister for Finance, be paid out of moneys provided by the Oireachtas.
##### 35. **Short title and commencement.**
35.—(1)This Act may be cited as the Data Protection Act, 1988.
(2)This Act shall come into operation on such day or days as, by order or orders made by the Minister under this section, may be fixed therefor either generally or with reference to any particular purpose or provision and different days may be so fixed for different purposes and different provisions.
1988-07-13
Data Protection Act , 1988
original version
Text at this date