DATA PROTECTION ACT 2018

An Act to establish a body to be known as An Coimisiún um Chosaint Sonraí or, in the English language, the Data Protection Commission; to give further effect to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); to give effect to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016² on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA; to give further effect to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January 1981 and for those and other purposes to amend the Data Protection Act 1988; to provide for the consequential amendment of certain other enactments; and to provide for related matters.

[24th May, 2018]

Be it enacted by the Oireachtas as follows:

PART 1 Preliminary and General

1. Short title, citation and commencement

1. (1) This Act may be cited as the Data Protection Act 2018.

• (2) This Act and the Data Protection Acts 1988 and 2003 may be cited together as the Data Protection Acts 1988 to 2018.

• (3) This Act shall come into operation on such day or days as the Minister may by order or orders appoint either generally or with reference to any particular purpose or provision and different days may be so appointed for different purposes or different provisions, and for the repeal of different enactments or provisions of enactments effected by section 7.

2. Interpretation

2. (1) In this Act—

“Act of 1988” means the Data Protection Act 1988;

“Act of 2014” means the Companies Act 2014;

“authorised officer” means a person appointed, or deemed to be appointed, to be an authorised officer under section 129;

“chairperson” means the chairperson of the Commission;

“civil servant” has the meaning assigned to it by the Civil Service Regulation Act 1956;

“Commission” has the meaning assigned to it by section 10;

“Commissioner” has the meaning assigned to it by section 15 and includes a member of staff authorised to act in place of a Commissioner under section 18;

“Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016⁴ on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA;

“enactment” has the same meaning as it has in the Interpretation Act 2005;

“local authority” means a local authority within the meaning of section 2 of the Local Government Act 2001;

F1[“Mayor of Limerick” has the meaning assigned to it by section 9 of the Local Government (Mayor of Limerick) and Miscellaneous Provisions Act 2024;]

“Minister” means the Minister for Justice and Equality;

“political party” means a political party registered in the Register of Political Parties in accordance with section 25 of the Electoral Act 1992;

“prescribe” means prescribe by regulations;

“public authority” means—

• (a) a Department of State,

• (b) a regional assembly,

• (c) a local authority,

• (d) the office of the Director of Corporate Enforcement,

• (e) the Irish Auditing and Accounting Supervisory Authority,

• (f) any other person established by or under an enactment (other than the Act of 2014 or a former enactment relating to companies within the meaning of section 5 of that Act) other than—

• (i) a recognised school or board within the meaning of section 2 of the Education Act 1998 but including a recognised school established and maintained by an education and training board and a board of a school so established and maintained, and

• (ii) a management committee established under section 37(3) of the Education Act 1998,

• (g) a person with whom the Health Service Executive has, under section 38(1) of the Health Act 2004, entered into an arrangement for the provision of a health or personal social service by that person on behalf of the Executive,

• (h) the Garda Síochána;

“public body” means—

• (a) a company (within the meaning of the Act of 2014 or a former enactment relating to companies within the meaning of section 5 of that Act) a majority of the shares in which are held by or on behalf of a Minister of the Government,

• (b) a subsidiary (within the meaning of section 7 of the Act of 2014) of a company referred to in paragraph (a);

“special categories of personal data”, other than in Part 5, means—

• (a) personal data revealing—

• (i) the racial or ethnic origin of the data subject,

• (ii) the political opinions or the religious or philosophical beliefs of the data subject, or

• (iii) whether the data subject is a member of a trade union,

• (b) genetic data,

• (c) biometric data for the purposes of uniquely identifying an individual,

• (d) data concerning health, or

• (e) personal data concerning an individual’s sex life or sexual orientation.

• (2) Subject to subsection (1), a word or expression used in this Act, other than in Part 5, that is also used in the Data Protection Regulation has, unless the context otherwise requires, the same meaning in this Act as it has in that Regulation.

• (3) Unless the context otherwise requires, a reference in this Act (other than in Part 5) to a numbered Article is a reference to the Article so numbered of the Data Protection Regulation.

3. Designation by appropriate authority

3. (1) An appropriate authority (within the meaning of the Civil Service Regulation Act 1956) may, as respects all or part of the personal data kept by the authority, designate a civil servant in relation to whom it is the appropriate authority to be a controller and while the designation is in force the civil servant so designated shall, other than for the purposes of sections 105(3) and 141(2) and (3), be deemed, for the purposes of this Act and the Data Protection Regulation, to be the controller in respect of the data concerned.

• (2) Without prejudice to subsection (1), the Minister for Defence may, as respects all or part of the personal data kept by him in relation to the Defence Forces, designate an officer of the Permanent Defence Force who holds a commissioned rank therein to be a controller and while the designation is in force the officer so designated shall, other than for the purposes of sections 105(3) and 141(2) and (3), be deemed, for the purposes of this Act and the Data Protection Regulation, to be the controller in respect of the data concerned.

• (3) For the purposes of this Act and the Data Protection Regulation—

• (a) where a designation by the relevant appropriate authority under subsection (1) is not in force, a civil servant in relation to whom that authority is the appropriate authority shall be deemed to be its employee and, where such a designation is in force, such a civil servant (other than the civil servant the subject of the designation) shall be deemed to be an employee of the last mentioned civil servant,

• (b) where a designation under subsection (2) is not in force, a member of the Defence Forces shall be deemed to be an employee of the Minister for Defence and, where such a designation is in force, such a member (other than the officer the subject of the designation) shall be deemed to be an employee of that officer, and

• (c) a member of the Garda Síochána (other than the Commissioner of the Garda Síochána) shall be deemed to be an employee of the Commissioner of the Garda Síochána.

4. Obligation not to require data subject to exercise right of access under Data Protection Regulation and Directive in certain circumstances

4. (1) A person shall not, in connection with—

• (a) the recruitment of an individual as an employee,

• (b) the continued employment of the individual, or

• (c) a contract for the provision of services to the person by an individual,

require that individual to—

• (i) make a request under Article 15 or under section 91, or

• (ii) supply the person with data relating to that individual obtained as a result of such a request.

• (2) A person who contravenes subsection (1) shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

5. Expenses

5. The expenses incurred by the Commission and any Minister of the Government in the administration of this Act shall, to such an extent as may be sanctioned by the Minister for Public Expenditure and Reform, be paid out of moneys provided by the Oireachtas.

6. Regulations

6. (1) Regulations made under this Act may contain such incidental, supplementary and consequential provisions as appear to the person making the regulations to be necessary or expedient for the purposes of the regulations.

• (2) Every regulation made under this Act, other than under section 51, 60 or 73, shall be laid before each House of the Oireachtas as soon as may be after it is made.

• (3) Either House of the Oireachtas may, by a resolution passed within 21 sitting days after the day on which a regulation is laid before it under subsection (2), annul the regulation.

• (4) The annulment of a regulation under subsection (3) takes effect immediately on the passing of the resolution concerned but does not affect the validity of anything done under the regulation before the passing of the resolution.

• (5) Regulations may be made under section 51, 60 or 73 only if—

• (a) a draft of the proposed regulations has been laid before each House of the Oireachtas, and

• (b) a resolution approving the draft has been passed by each House.

7. Repeals and revocations

7. (1) Subject to subsection (4), the following provisions of the Act of 1988 are repealed:

• (a) in section 1—

• (i) subsection (1), the definition of “direct marketing”, “financial institution” and “the register”, and

• (ii) subsection (5);

• (b) section 2(7) and (8);

• (c) section 4(2), (6), (8) and (13);

• (d) section 5(1)(d);

• (e) section 9 and the Second Schedule;

• (f) section 11(3) and (4)(b);

• (g) sections 13, 14, 16, 17, 18, 19, 20, 22A and 33.

• (2) Subject to subsection (4), section 14(2) of the Data Protection (Amendment) Act 2003 is repealed.

• (3) Subject to subsection (4), the enactments specified in column (3) of Schedule 1 are revoked to the extent specified in column (4) of that Schedule.

• (4) The repeals and revocations effected by this section shall not apply for the purposes of subsections (1)(b), (2) and (3) of section 8.

8. Application of Data Protection Act 1988

8. (1) Subject to this section, the Act of 1988 shall, on and from the date on which this section comes into operation, cease to apply to the processing of personal data (within the meaning of that Act) other than—

• (a) the processing of such data for the purposes of safeguarding the security of the State, the defence of the State or the international relations of the State, or

• (b) the processing of such data under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018 to the extent that the Act of 1988 is applied in those Acts.

• (2) The Act of 1988 shall apply to—

• (a) a complaint by an individual under section 10 of that Act made before the commencement of this section, and

• (b) a contravention of that Act that occurred before such commencement.

• (3) An investigation under section 10 of the Act of 1988 that was begun but not completed before the commencement of this section shall be completed in accordance with that Act and that Act shall apply to such an investigation.

PART 2 Data Protection Commission

9. Establishment day

9. The Minister shall, by order, appoint a day to be the establishment day for the purposes of this Act.

10. Establishment of Data Protection Commission

10. (1) On the establishment day there shall stand established a body to be known as An Coimisiún um Chosaint Sonraí or, in the English language, the Data Protection Commission (in this Act referred to as the “Commission”).

• (2) Schedule 2 shall have effect in relation to the Commission.

11. Supervisory authority for Data Protection Regulation and Directive

11. The Commission shall be the supervisory authority within the meaning of, and for the purposes specified in—

• (a) the Data Protection Regulation, and

• (b) the Directive.

12. Functions of Commission

12. (1) In addition to the functions assigned to the Commission by virtue of its being the supervisory authority for the purposes of the Data Protection Regulation and the Directive, the general functions of the Commission shall include—

• (a) any functions assigned to it by or under this Act,

• (b) functions transferred to the Commission under section 14, and

• (c) such other functions as may be assigned to it from time to time by or under any other enactment.

• (2) The Commission shall monitor the lawfulness of processing of personal data in accordance with—

• F2[(a) Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024²⁹ on the establishment of “Eurodac” for the comparison of biometric data in order to effectively apply Regulations (EU) 2024/1351 and (EU) 2024/1350 of the European Parliament and of the Council and Council Directive 2001/55/EC and to identify illegally staying third-country nationals and stateless persons and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, amending Regulations (EU) 2018/1240 and (EU) 2019/818 of the European Parliament and of the Council and repealing Regulation (EU) No 603/2013 of the European Parliament and of the Council,]

• (b) Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 2013⁶ establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a F2[stateless person (recast), and]

• F3[(c) Regulation (EU) 2024/1351 of the European Parliament and of the Council of 14 May 2024³⁰ on asylum and migration management, amending Regulations (EU) 2021/1147 and (EU) 2021/1060 and repealing Regulation (EU) No 604/2013.]

• (3) The Commission is designated for the purposes of Chapter IV (Mutual assistance) of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January 1981.

• (4) The Minister may, following consultation with the Commission, make any regulations that he or she considers necessary or expedient for the purpose of enabling Chapter IV (as referred to in subsection (3)) to have full effect.

• (5) The Commission shall have all such powers as are necessary or expedient for the performance of its functions.

• (6) The Commission shall disseminate, to such extent and in such manner as it considers appropriate, information in relation to the functions performed by it.

• (7) The Commission shall be independent in the performance of its functions.

• (8) Subject to this Act, the Commission shall regulate its own procedures.

13. Performance of functions of Commission by Commissioner or member of staff

13. (1) Where more than one Commissioner stands appointed under section 15, the functions of the Commission, other than the functions specified in subsection (3), may be performed through or by a Commissioner where he or she is authorised in that behalf by the Commission.

• (2) The functions of the Commission, other than the functions specified in subsection (3), may be performed through or by any member of staff of the Commission where he or she is authorised in that behalf by the Commission.

• (3) The functions referred to in subsections (1) and (2) are the functions of the Commission under sections 12(8), 21, 28, 43, 84(9) and (10), 129, 134(1) and (4), 135(1), 149 (other than subsection (1)), paragraph 1 of Schedule 2 and its function, as supervisory authority, under Article 35(4) and (5) of the Data Protection Regulation.

• (4) A Commissioner or member of staff of the Commission who performs any of the functions of the Commission is presumed in any proceedings to have been authorised to do so on its behalf unless the contrary is shown.

14. Transfer of functions of Data Protection Commissioner to Commission

14. (1) All functions that, immediately before the establishment day, were vested in the Data Protection Commissioner are transferred to the Commission.

• (2) A reference in any enactment or instrument under an enactment to the Data Protection Commissioner or to the Office of the Data Protection Commissioner shall be construed as a reference to the Commission.

• (3) A reference in the Act of 1988 (other than in section 1(3)(c)(iii) in so far as it refers to to the Commissioner of the Garda Síochána) to the Commissioner shall be construed as a reference to the Commission.

• (4) This section shall come into operation on the establishment day.

15. Membership of Commission

15. (1) The Commission shall consist of such and so many members (not being more than 3) as the Government determines.

• (2) Each member of the Commission shall be known as a Commissioner for Data Protection (in this Act referred to as a “Commissioner”).

• (3) Subject to subsections (4), (8) and (9) and section 18, a Commissioner shall be appointed by the Government on the recommendation of the Public Appointments Service and the appointment shall be for a period of not less than 4 and not more than 5 years from the date of his or her appointment.

• (4) If, immediately before the establishment day, there is a person holding office as the Data Protection Commissioner, he or she shall, on the establishment day, be a Commis-sioner for the remainder of the term of office, and upon the same terms and conditions, for which he or she was appointed as the Data Protection Commissioner.

• (5) Subject to subsection (7), the Public Appointments Service shall recommend a person for appointment as Commissioner following an open selection competition held by the Service for that purpose.

• (6) The Public Appointments Service shall appoint a selection panel to assist it in holding an open selection competition.

• (7) The Public Appointments Service shall ensure that a person is recommended under subsection (5) for appointment only if it is satisfied that the person has the qualifications, experience and skills necessary to enable the Commission to effectively perform its functions.

• (8) A Commissioner to whom subsection (3) applies and whose term of office expires by the efflux of time may be reappointed to the Commission by the Government for one

further period of not less than 4 and not more than 5 years without the need for a further recommendation by the Public Appointments Service.

• (9) A Commissioner to whom subsection (4) applies and whose term of office expires by the efflux of time may be reappointed to the Commission by the Government for one further period of not less than 4 and not more than 5 years.

• (10) A Commissioner shall—

• (a) act on a full-time basis subject to such terms and conditions (other than the payment of remuneration and allowances for expenses) as the Government may determine,

• (b) be paid by the Commission such remuneration and allowances for expenses (if any) as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time determine,

• (c) not hold any other office or occupy any other position in respect of which emoluments are payable or carry on any business, and

• F4[(d) cease to be a Commissioner on attaining the age of 70 years or, where a higher age is prescribed by order under section 3A(2) of the Public Service Superannuation (Miscellaneous Provisions) Act 2004 for the purposes of that Act, that age but, where the person is a new entrant (within the meaning of that Act) appointed on or after 1 April 2004, the requirement to cease to be a Commissioner on grounds of age shall not apply.]

16. Appointment of chairperson of Commission

16. (1) The Minister shall, where the Commission consists of more than one Commissioner, appoint one of the Commissioners to be chairperson and such allowance (if any) may be paid by the Commission to the chairperson as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time determine.

• (2) The chairperson shall have a casting vote in the case of decisions to be taken by the Commission in the event of a tied vote.

• (3) Where a chairperson stands appointed under subsection (1), and is unavailable to perform his or her duties due to absence or incapacity, the Minister shall appoint another existing Commissioner to act as chairperson for the duration of the period of absence or incapacity.

17. Resignation, removal, disqualification of Commissioner, ineligibility to become Commissioner

17. (1) A Commissioner may resign from office by giving notice in writing to the Government of his or her resignation and the resignation shall take effect from such date as is specified in the notice which date shall be at least 90 days after the giving of the notice to the Government.

• (2) The Government may remove a Commissioner from office if they are satisfied that one or more of the grounds referred to in subsection (3) apply to the Commissioner.

• (3) The grounds referred to in subsection (2) are that a Commissioner—

• (a) has become incapable through ill health or otherwise of effectively performing the functions of the office, or

• (b) has engaged in serious misconduct.

• (4) Where the Government propose to remove a Commissioner under subsection (2), they shall notify the Commissioner concerned in writing of their proposal.

• (5) A notification under subsection (4) shall include a statement—

• (a) of the reasons for the proposed removal,

• (b) that the Commissioner may, within a period of 30 working days from the sending of the notification or such other period as the Government may, having regard to the requirements of natural justice, specify in the notice, make representations to the

Government in such form and manner as may be specified by the Government, as to why the Commissioner should not be removed from office, and

• (c) that where no representations are received within the period referred to in paragraph (b) the Government will, without further notice to the Commissioner, proceed with the removal of the Commissioner from office in accordance with this section.

• (6) In considering whether to remove a Commissioner from office under subsection (2), the Government shall take into account—

• (a) any representations made by the Commissioner under subsection (5)(b) within the period referred to in that subsection, and

• (b) any other matter the Government consider relevant for the purpose of their decision.

• (7) Where, having taken into account the matters referred to in subsection (6), the Government decide the Commissioner should be removed from office in accordance with this section, they shall notify the Commissioner in writing of their decision and the reasons for their decision.

• (8) Where the Government decide to remove a Commissioner from office in accordance with this section, they shall prepare a statement of the reason or reasons for such removal and cause that statement to be laid before each House of the Oireachtas as soon as practicable after the decision is made.

• (9) A Commissioner shall cease to hold office if he or she—

• (a) is convicted on indictment of an offence,

• (b) is convicted of an offence involving fraud or dishonesty,

• (c) has a declaration made against him or her under section 819 of the Act of 2014 or is deemed to be subject to such a declaration by virtue of Chapter 5 of Part 14 of that Act, or

• (d) is subject to, or is deemed to be subject to, a disqualification order within the meaning of Chapter 4 of Part 14 of the Act of 2014 whether by virtue of that Chapter or of any other provision of that Act.

• (10) A person shall not be eligible for appointment as a Commissioner if any of paragraphs (a) to (d) of subsection (9) are applicable in respect of the person.

18. Acting Commissioner

18. (1) Where one Commissioner only stands appointed for the time being under section 15, the Minister may authorise a member of staff of the Commission to perform the functions of a Commissioner during any period when that Commissioner is absent from duty or absent from the State or is, for any other reason, unable to perform the functions of a Commissioner.

• (2) Where a vacancy occurs in the office of Commissioner and no Commissioner stands appointed for the time being under section 15, the Minister may authorise a member of staff of the Commission to perform the functions of a Commissioner during the period of that vacancy, but an authorisation under this subsection shall cease upon the appointment of a Commissioner under section 15 whether or not such appointment was made for the purpose of filling that vacancy.

• (3) An authorisation under subsection (2) shall not remain in force for a period of more than 6 months unless the Minister is satisfied that it is not reasonably practicable for an appointment under section 15 to be made within that period, in which case he or she may extend that period by such further period as he or she is satisfied is a period within which it is reasonably practicable for an appointment to be made under that section.

• (4) The Minister may at any time terminate an authorisation under this section.

• (5) A member of staff of the Commission in respect of whom an authorisation under this section is in force may perform the functions of a Commissioner under this Act, and, for that purpose, references to a Commissioner in this Act (other than in sections 15(3), 17(2) to (8) and 22) shall be construed as including references to such member of staff.

19. Accountability of Commissioner to Oireachtas Committees

19. (1) In this section, “Committee” means a Committee appointed by either House of the Oireachtas or jointly by both Houses of the Oireachtas (other than a committee referred to in section 19(1) of the Comptroller and Auditor General (Amendment) Act 1993 or the Committee on Members’ Interests of Dáil Éireann or the Committee on Members’ Interests of Seanad Éireann) or a sub-committee of such a Committee.

• (2) Subject to subsection (3), a Commissioner shall, at the request in writing of a Committee, attend before it to give account for the general administration of the Commission.

• (3) The Commissioner shall not be required to give account before a Committee for any matter which is or has been or may at a future time be the subject of proceedings before a court or tribunal.

• (4) Where the Commissioner is of the opinion that a matter in respect of which he or she is requested to give an account before a Committee is a matter to which subsection (3) applies, he or she shall inform the Committee of that opinion and the reasons for the opinion and, unless the information is conveyed to the Committee at a time when the Commissioner is before it, the information shall be so conveyed in writing.

• (5) Where the Commissioner has informed a Committee of his or her opinion in accordance with subsection (4) and the Committee does not withdraw the request referred to in subsection (2) in so far as it relates to a matter the subject of that opinion—

• (a) the Commissioner may, not later than 21 days after being informed by the Committee of its decision not to do so, apply to the High Court in a summary manner for determination of the question whether the matter is one to which subsection (3) applies, or

• (b) the Chairperson of the Committee may, on behalf of the Committee, make such an application,

and the High Court shall determine the matter.

• (6) Pending the determination of an application under subsection (5), the Commissioner shall not attend before the Committee to give account for the matter the subject of the application.

• (7) If the High Court determines that the matter concerned is one to which subsection (3) applies, the Committee shall withdraw the request referred to in subsection (2), but if the High Court determines that subsection (3) does not apply, the Commissioner shall attend before the Committee and give account for the matter.

• (8) In this section, a reference to “Commissioner” shall, where more than one Commissioner has been appointed under section 15, be taken to be a reference to the chairperson.

20. Assignment and transfer of staff to Commission

20. (1) Every civil servant who, immediately before the establishment day, stands assigned to act as a member of staff of the Data Protection Commissioner shall, on the establish-ment day, stand assigned to act as a member of staff of the Commission.

• (2) The Minister may, as he or she considers appropriate, designate in writing such and so many persons who stand assigned under subsection (1) to act as members of staff of the Commission to become and be members of staff of the Commission on and from such date as the Minister may specify in the designation (in this section referred to as the “effective date”).

• (3) A member of staff designated in accordance with subsection (2) shall become and be a member of staff of the Commission on and from the effective date.

21. Staff of Commission

21. (1) The Commission may, subject to the approval of the Minister given with the consent of the Minister for Public Expenditure and Reform, appoint such number of persons to be members of its staff as it may determine.

• (2) The Commission shall, subject to the approval of the Minister given with the consent of the Minister for Public Expenditure and Reform, determine the grades of members of its staff and the numbers in each grade.

• (3) Members of staff of the Commission shall be civil servants.

22. Superannuation of Commissioners

22. (1) The Minister may, with the consent of the Minister for Public Expenditure and Reform, make a scheme or schemes for—

• (a) the granting of superannuation benefits to or in respect of a Commissioner ceasing to hold office, or

• (b) the making of contributions to a pension scheme approved of by the Minister with the consent of the Minister for Public Expenditure and Reform which has been entered into by the Commissioner.

• (2) The Minister may, with the consent of the Minister for Public Expenditure and Reform, make a scheme amending or revoking a scheme made under subsection (1), including a scheme amended under this subsection.

• (3) If any dispute arises as to the claim of a Commissioner to, or the amount of, any superannuation benefit payable in pursuance of a scheme made under subsection (1), such dispute shall be submitted to the Minister who shall refer it to the Minister for Public Expenditure and Reform for determination by him or her.

• (4) A scheme made under subsection (1) shall be carried out by the Minister in accordance with its terms.

• (5) No superannuation benefit shall be granted by the Minister to or in respect of any Commissioner ceasing to hold office otherwise than—

• (a) in accordance with a scheme under subsection (1), or

• (b) with the consent of the Minister for Public Expenditure and Reform.

• (6) A scheme made under subsection (1) shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the scheme is passed by either such House within the next 21 days on which that House has sat after the scheme is laid before it, the scheme shall be annulled accordingly but without prejudice to the validity of anything previously done under that scheme prior to the resolution.

• (7) In this section, “superannuation benefits” means pensions, gratuities and other allowances payable on resignation, retirement or death.

23. Accounts of Commission

23. (1) The Commission shall keep, in such form as may be approved by the Minister with the consent of the Minister for Public Expenditure and Reform, all proper and usual accounts of all money received or expended by it and, in particular, shall keep in such form as aforesaid all such special accounts as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time direct.

• (2) Accounts kept in accordance with this section shall be submitted, not later than 1 April in the year immediately following the financial year to which they relate or on such earlier date as the Minister may from time to time specify, by the Commission to the Comptroller and Auditor General for audit and, immediately after the audit, a copy of the accounts, and of such other special accounts (if any) kept in accordance with this section as the Minister, after consultation with the Minister for Public Expenditure and Reform, may direct and a copy of the Comptroller and Auditor General’s report on the accounts shall be presented to the Minister and the Commission shall, as soon as may be thereafter, cause copies thereof to be laid before each House of the Oireachtas.

• (3) Subject to subsections (4) and (5), subsections (1) and (2) shall cease to have effect on the date of the coming into operation of section 176(b).

• (4) Accounts kept in accordance with this section that relate to the period specified under subsection (5) shall be submitted by the Commission to the Comptroller and Auditor General for audit not later than 3 months after the date of the coming into operation of section 176(b).

• (5) The Minister may, for the purposes of subsection (4), specify a period which—

• (a) shall end on the date immediately preceding the date of the coming into operation of section 176(b), and

• (b) may be longer or shorter than a financial year of the Commission.

24. Annual report

24. (1) The Commission shall, not later than 30 June in each year—

• (a) prepare a report on its activities in the immediately preceding year, and

• (b) cause copies of the report to be laid before each House of the Oireachtas.

• (2) Notwithstanding subsection (1), if but for this subsection, the first report under this section would relate to a period of less than 6 months, the report shall relate to that period and to the year immediately following that period and shall be made as soon as may be, but not later than 6 months after the end of that year.

• (3) The Commission may, at any time after subsection (1)(b) has been complied with, publish its annual report in such form and manner as it considers appropriate.

• (4) For the purposes of the law of defamation, a report under subsection (1) shall be absolutely privileged.

25. Accountability for accounts of Commission

25. (1) The Commissioner, or where more than one Commissioner has been appointed under section 15, the chairperson, is the accounting officer in relation to the appropriation accounts of the Commission for the purpose of the Comptroller and Auditor General Acts 1866 to 1998.

• (2) Section 19(2) of the Comptroller and Auditor General (Amendment) Act 1993 shall, in so far as it relates to data protection matters, not apply to the Commissioner or chair-person who is the accounting officer pursuant to subsection (1).

26. Prohibition on disclosure of confidential information

26. (1) A relevant person shall not disclose confidential information obtained by him or her while performing functions under this Act or the Data Protection Regulation unless he or she is required or permitted by law, or duly authorised by the Commission, to do so.

• (2) Subsection (1) shall not operate to prevent the disclosure by a relevant person of information—

• (a) in a report to the Commission or a Commissioner,

• (b) to a Minister of the Government, and

• (c) to a public authority, whether in the State or otherwise, for the purposes of facilitating cooperation between the Commission and such authority in the performance of their respective functions.

• (3) Subject to section 154, a person who contravenes subsection (1) commits an offence and is liable on summary conviction to a class A fine.

• (4) In this section—

“confidential information” includes information that is expressed by the Commission to be confidential either as regards particular information or as regards information of a particular class or description;

“relevant person” means—

• (a) a Commissioner,

• (b) a member of staff of the Commission,

• (c) an authorised officer,

• (d) any other person engaged under a contract for services by the Commission or a member of the staff of such a person, or

• (e) a person who has acted in a capacity referred to in any of paragraphs (a) to (d).

26A. F5[Prohibition on disclosure of confidential information by persons engaging with Commission in connection with relevant function

26A. (1) The Commission may, where it or an authorised officer is authorised by law to provide information to a person (in this section referred to as a “relevant person”) in connection with the performance of a relevant function, by notice in writing given to the person—

• (a) identify information that is provided, or to be provided, to the person by the Commission or an authorised officer, as the case may be, in connection with the performance of a relevant function by the Commission, an authorised officer, or both, as confidential information,

• (b) specify, by reference to paragraph (a), (b) or (c) of the definition of “confidential information”, the reason the information so identified is confidential, and

• (c) direct that the person shall, subject to subsection (2), not disclose that confidential information.

• (2) A relevant person who receives a notice under subsection (1) may disclose confidential information referred to in the notice where such disclosure is—

• (a) required or permitted by law, or

• (b) authorised by the Commission in writing.

• (3) A relevant person who fails to comply with a direction under subsection (1)(c) commits an offence and is liable on summary conviction to a class A fine.

• (4) Where information, specified in a notice under subsection (1), is confidential by reference to paragraph (c) only of the definition of “confidential information”, the information shall cease to be confidential and the direction under subsection (1)(c) shall cease to apply to the relevant person concerned—

• (a) subject to paragraph (b), where the information is confidential by reason of the fact disclosure could reasonably be expected to prejudice the effectiveness of the performance by an authorised officer of a relevant function, upon the completion of the performance by the authorised officer of the function, or

• (b) where the information is confidential by reason of the fact disclosure could reasonably be expected to prejudice the effectiveness of the performance by the Commission of a relevant function or the effectiveness of the performance by the Commission of a relevant function and an authorised officer of a relevant function, upon the completion of the performance by the Commission of its relevant function.

• (5) In this section—

“confidential information” means—

• (a) commercially sensitive information within the meaning of section 149(7),

• (b) information given in confidence and on the understanding that it will be treated by the Commission or an authorised officer, as the case may be, as confidential and where, in the opinion of the Commission—

• (i) the disclosure of such information would be likely to prejudice the giving to the Commission or an authorised officer of further information by the person or information by another person, and

• (ii) it is important that the Commission or an authorised officer, as the case may be, continues to receive such information for the purpose of the performance of a relevant function,

or

• (c) information the disclosure of which could, in the opinion of the Commission, reasonably be expected to prejudice the effectiveness of the performance of a relevant function by it, an authorised officer, or both, as the case may be;

“relevant function” means a function—

• (a) of the Commission in relation to—

• (i) carrying out an investigation within the meaning of section 105,

• (ii) handling a complaint within the meaning of section 107,

• (iii) conducting an inquiry within the meaning of section 107,

• (iv) handling a complaint within the meaning of section 118,

• (v) conducting an inquiry within the meaning of section 118,

• (vi) carrying out an audit under section 136(1), or

• (vii) carrying out a data protection audit within the meaning of section 136(4),

or

• (b) of an authorised officer under section 137(5) or 139(1).]

27. Civil proceedings for contravention of section 26

27. (1) A person who suffers loss or harm as a result of a contravention of section 26(1) may, subject to section 154, bring proceedings against the person specified in subsection (2) seeking relief by way of—

• (a) an injunction or declaration, or

• (b) damages,

or both.

• (2) The person specified for the purposes of subsection (1) is—

• (a) where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking an injunction or declaration, the Commissioner, member of staff or authorised officer concerned,

• (b) where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking damages, the Commission, and

• (c) where it is alleged that the contravention was committed by a person other than a Commissioner, member of staff of the Commission or an authorised officer, that person.

• (3) Proceedings under subsection (1), in so far as they seek the relief referred to in paragraph (b) of that subsection, shall be founded on tort.

PART 3 Data Protection Regulation

Chapter 1 General

28. Fees

28. The Commission may, with the consent of the Minister, prescribe the fees to be paid to it—

• (a) for the performance of its functions under Article 57(1)(r) and (s), and

• (b) in relation to requests that are manifestly unfounded or excessive in accordance with Article 57(4).

29. Child for purposes of application of Data Protection Regulation

29. For the purposes of the application of the Data Protection Regulation in the State, a reference to “child” in the Regulation shall be taken to be a reference to a person under the age of 18 years.

30. Micro-targeting and profiling of children

30. It shall be an offence under this Act for any company or corporate body to process the personal data of a child as defined by section 29 for the purposes of direct marketing, profiling or micro-targeting. Such an offence shall be punishable by an administrative fine under section 141.

31. Consent of child in relation to information society services

31. (1) The age of a child specified for the purposes of Article 8 is 16 years of age.

• (2) For the purposes of the application of Article 8 in the State, the reference in that Article to “information society services” does not include a reference to preventative or coun-selling services.

• (3) The Minister shall—

• (a) not later than 3 years after the coming into operation of this section, commence a review of the operation of subsection (1), and

• (b) complete that review not later than one year after its commencement.

32. Codes of conduct: children

32. (1) Without prejudice to the generality of Article 40, the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of the Data Protection Regulation with regard to—

• (a) the protection of children,

• (b) the information to be provided by a controller to children,

• (c) the manner in which the consent of the holders of parental responsibility over a child is to be obtained for the purposes of Article 8,

• (d) integrating the necessary safeguards into processing in order to protect the rights of children in an age-appropriate manner for the purpose of Article 25, and

• (e) the processing of the personal data of children for the purposes of direct marketing and creating personality and user profiles.

• (2) For the purpose of considering whether a draft code of conduct or an extension or amendment to an existing code of conduct referred to in Article 40 provides sufficient appropriate safeguards referred to in that Article, the Commission may, where the draft, extension or amendment, as the case may be, concerns the application of the Data Protection Regulation to children, consult with such persons as it considers appropriate including—

• (a) children and bodies who appear to the Commission to represent the interests of children,

• (b) the holders of parental responsibility over children, and

• (c) the Ombudsman for Children.

33. Right to be forgotten: children

33. (1) Subject to subsection (3), in accordance with Article 17, a controller shall, at the request of a data subject, without undue delay erase personal data of the data subject where the data have been collected in relation to the offer to that data subject of information society services referred to in Article 8(1).

• (2) Subject to subsection (3), where a controller has disclosed the personal data which are the subject of a request under subsection (1) to another controller or controllers, the first-mentioned controller shall, taking account of available technology and the cost of implementation, take all reasonable steps, including technical measures, to inform the other controller or controllers which are processing that personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

• (3) Subsections (1) and (2) shall not apply to the extent that the processing of the personal data concerned is necessary for the purposes set out in Article 17(3).

34. Designation of data protection officer

34. (1) The Minister may, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations requiring controllers, processors, associations or other bodies representing categories of controllers or processors to designate a data protection officer in accordance with Article 37(4).

• (2) Regulations under subsection (1) may apply to—

• (a) one or more than one class of controller,

• (b) one or more than one class of processor, or

• (c) one or more than one class of association or other body representing categories of controllers or processors.

• (3) In making regulations under subsection (1) the Minister shall have regard to the need for the protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall have regard in particular to—

• (a) the nature, scope, context and purposes of the processing,

• (b) risks arising for the rights and freedoms of individuals,

• (c) the likelihood and the severity of such risk for the individuals concerned, and

• (d) the costs of implementation of any requirement if it were imposed under that subsection.

35. Accreditation of certification bodies by Irish National Accreditation Board

35. The Irish National Accreditation Board is the accreditation body for the purposes of Article 43(1).

36. Suitable and specific measures for processing

36. (1) Where a requirement that suitable and specific measures be taken to safeguard the fundamental rights and freedoms of data subjects in processing personal data of those subjects is imposed by this Act or regulations made under this Act, those measures may include in particular the following—

• (a) explicit consent of the data subject for the processing of his or her personal data for one or more specified purposes,

• (b) limitations on access to the personal data undergoing processing within a workplace in order to prevent unauthorised consultation, alteration, disclosure or erasure of personal data,

• (c) strict time limits for the erasure of personal data and mechanisms to ensure that such limits are observed,

• (d) specific targeted training for those involved in processing operations, and

• (e) having regard to the state of the art, the context, nature, scope and purposes of data processing and the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subjects—

• (i) logging mechanisms to permit verification of whether and by whom the personal data have been consulted, altered, disclosed or erased,

• (ii) in cases in which it is not mandatory under the Data Protection Regulation, designation of a data protection officer,

• (iii) where the processing involves data relating to the health of a data subject, a requirement that the processing is undertaken by a person referred to in section 52(2),

• (iv) pseudonymisation of the personal data, and

• (v) encryption of the personal data.

• (2) Regulations may be made for either or both of the following purposes—

• (a) to identify additional suitable and specific measures (to those referred to in paragraphs (a) to (e) of subsection (1)) that may be taken to safeguard the fundamental rights and freedoms of data subjects in the processing of personal data of those subjects for the purposes of the requirement referred to in subsection (1),

• (b) to specify that a measure or measures referred to in paragraphs (a) to (e) of subsection (1) or an additional measure or measures identified under paragraph (a), or both, is or are mandatory in respect of the processing to which they are stated to apply.

• (3) Without prejudice to the generality of subsection (2)(a), additional suitable and specific measures identified in regulations made under that subsection may relate to—

• (a) governance structures,

• (b) processes or procedures for risk assessment purposes,

• (c) processes or procedures for the management and conduct of research projects, and

• (d) other technical and organisational measures designed to ensure that the processing is carried out in accordance with the Data Protection Regulation and processes for testing and evaluating the effectiveness of such measures.

• (4) Regulations under subsection (2) may—

• (a) identify different measures for different categories of personal data, different categories of controllers, different types of processing or categories of processing, and

• (b) specify that a measure or measures referred to in subsection (2)(b) is or are mandatory in respect of the processing of different categories of personal data,

processing by different categories of controllers and in respect of different types of processing or categories of processing.

• (5) Subject to subsection (6), regulations may be made under subsection (2)—

• (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

• (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

• (6) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (2).

• (7) The Commission may, on being consulted under subsection (6), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

• (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

• (b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

• (8) In making regulations under subsection (2), the Minister or any other Minister of the Government, as the case may be, shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing shall have regard to—

• (a) the nature, scope, context and purposes of the processing,

• (b) risks arising for the rights and freedoms of individuals, and

• (c) the likelihood and the severity of the risks for the individuals concerned.

37. Limitation on transfers of personal data outside the European Union

37. (1) The Minister may, in the absence of an adequacy decision under Article 45, following consultation with such other Minister of the Government as he or she considers appro-priate and the Commission, make regulations restricting the transfer of categories of personal data to a third country or an international organisation for important reasons of public policy.

• (2) Regulations under subsection (1) shall specify the important reasons of public policy for restricting the transfer concerned and may be expressed to apply by reference to one or more of the following—

• (a) a category or categories of personal data,

• (b) a third country or classes of third country, or

• (c) an international organisation.

• (3) In making regulations under subsection (1), the Minister shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall in particular have regard to—

• (a) the nature, scope, context and purposes of the processing,

• (b) the desirability of facilitating international transfers of data,

• (c) risks arising for the rights and freedoms of individuals, and

• (d) the likelihood and the severity of such risks for individuals concerned.

38. Processing for a task carried out in the public interest or in the exercise of official authority

38. (1) The processing of personal data shall be lawful to the extent that such processing is necessary and proportionate for—

• (a) the performance of a function of a controller conferred by or under an enactment or by the Constitution, or

• (b) the administration by or on behalf of a controller of any non-statutory scheme, programme or funds where the legal basis for such administration is a function of a controller conferred by or under an enactment or by the Constitution.

• (2) Subject to subsection (3), the processing of personal data and disclosure of that data to a person for the purposes of preserving the Common Travel Area, or any part of that Area, shall be lawful where the controller is an Irish air carrier, an air carrier or a sea carrier.

• (3) The Minister shall, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations for the purposes of subsection (2) specifying—

• (a) the part of the Common Travel Area to which the regulations apply,

• (b) the personal data that may be processed,

• (c) the circumstances in which the personal data may be disclosed, including specifying the person to whom the data may be disclosed, and

• (d) such other conditions (if any) as the Minister considers appropriate to impose on such processing.

• (4) Subject to subsection (5), the processing of personal data which is necessary for the performance of a task carried out in the public interest by a controller or which is necessary in the exercise of official authority vested in a controller may be specified in regulations made—

• (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

• (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

• (5) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (4).

• (6) The Commission may, on being consulted under subsection (5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

• (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

• (b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

• (7) Regulations made under subsection (4) shall specify—

• (a) the personal data that may be processed,

• (b) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

• (c) such other conditions (if any) as the Minister or any other Minister of the Government, as the case may be, considers appropriate to impose on such processing.

• (8) In this section—

“air carrier” means an undertaking established in the State that provides air services;

“air service” has the meaning it has in Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 2008⁷ on common rules for the operation of air services in the Community (Recast);

“Common Travel Area” means the State, the United Kingdom of Great Britain and Northern Ireland, the Channel Islands and the Isle of Man;

“Irish air carrier” means an undertaking with a valid operating licence, within the meaning of Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 2008⁸, granted by the Commission for Aviation Regulation;

“passenger” means a person carried by an air carrier on an aircraft, or as the case may be, a sea carrier in a passenger ship, other than a member of the crew of the aircraft or passenger ship concerned;

“passenger ship” means a sea-going ship that carries more than 12 passengers;

“sea carrier” means an undertaking established in the State that, for remuneration, carries passengers by sea in a passenger ship.

39. Communication with data subjects by political parties, candidates for and holders of certain elective political offices

39. (1) A specified person may, in the course of that person’s electoral activities in the State, use the personal data of a data subject for the purpose of communicating in writing (including by way of newsletter or circular) with the data subject.

• (2) Communicating in accordance with subsection (1) shall, for the purposes of Article 6(1)(e), be considered to be the performance of a task carried out in the public interest.

• (3) In this section, “specified person” means—

• (a) a political party,

• (b) a member of either House of the Oireachtas, the European Parliament or a local authority, or

• F6[(c) a candidate for election to the office of President of Ireland, or Mayor of Limerick, or for membership of either House of the Oireachtas, the European Parliament or a local authority.]

• (4) In this section and in sections 48, 58 and 59, “electoral activities” includes the dissem-ination of information, including information as to a person’s activities and policies, that might reasonably be of interest to electors.

40. Processing of personal data and special categories of personal data by elected represent- atives

40. (1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.

• (2) A person may make a request or representation on behalf of a data subject where the data subject—

• (a) has given his or her consent to the making of the request or representation, as the case may be, or

• (b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

• (3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

• (4) For the purpose referred to in subsection (1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or represent-ation is made, as the case may be, to enable that representative respond to that request or representation.

• (5) In this section, “elected representative” means—

• (a) a member of either House of the Oireachtas,

• (b) a member of the European Parliament,

• (c) a member of a local authority.

41. Processing for purpose other than purpose for which data collected

41. Without prejudice to the processing of personal data for a purpose other than the purpose for which the data has been collected which is lawful under the Data Protection Regulation, the processing of personal data and special categories of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing is necessary and proportionate for the purposes—

• (a) of preventing a threat to national security, defence or public security,

• (b) of preventing, detecting, investigating or prosecuting criminal offences, or

• (c) set out in paragraph (a) or (b) of section 47.

42. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

42. (1) Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, personal data may be processed, in accordance with Article 89, for—

• (a) archiving purposes in the public interest,

• (b) scientific or historical research purposes, or

• (c) statistical purposes.

• (2) Processing of personal data for the purposes referred to in subsection (1) shall respect the principle of data minimisation.

• (3) Where the purposes referred to in paragraph (a), (b) or (c) of subsection (1) can be fulfilled by processing which does not permit, or no longer permits, identification of data subjects, the processing of information for such purposes shall be fulfilled in that manner.

43. Data processing and freedom of expression and information

43. (1) The processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with a provision of the Data Protection Regulation specified in subsection (2) where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes.

• (2) The provisions of the Data Protection Regulation specified for the purposes of subsection (1) are Chapter II (principles), other than Article 5(1)(f), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries and international organisations), Chapter VI (independent supervisory authorities) and Chapter VII (cooperation and consistency).

• (3) The Commission may, on its own initiative, refer any question of law which involves consideration of whether processing of personal data is exempt in accordance with subsection (1) to the High Court for its determination.

• (4) An appeal shall, by leave of the High Court, lie from a determination of that Court on a question of law under subsection (3) to the Court of Appeal.

• (5) In order to take account of the importance of the right to freedom of expression and information in a democratic society that right shall be interpreted in a broad manner.

44. Data processing and public access to official documents

44. (1) For the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to the record is granted under and in accordance with the Act of 2014 pursuant to an FOI request.

• (2) For the purposes of Article 86, personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the Access to Information on the Environment Regulations pursuant to a request within the meaning of those Regulations.

• (3) In this section—

“Access to Information on the Environment Regulations” means the European Communities (Access to Information on the Environment) Regulations 2007 (S.I. No. 133 of 2007);

“Act of 2014” means the Freedom of Information Act 2014;

“environmental information” has the same meaning as it has in the Access to Information on the Environment Regulations;

“FOI request” has the same meaning as it has in the Act of 2014;

“record” has the same meaning as it has in the Act of 2014.

Chapter 2 Processing of special categories of personal data and processing of personal data relating to criminal convictions and offences

45. Processing of special categories of personal data

45. Subject to compliance with the Data Protection Regulation and any other relevant enactment or rule of law, the processing of special categories of personal data shall be lawful to the extent the processing is—

• (a) authorised by section 41 and sections 46 to 54, or

• (b) otherwise authorised by Article 9.

46. Processing of special categories of personal data for purposes of employment and social welfare law

46. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal