DATA PROTECTION ACT 2018

data shall be lawful where the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law.

47. Processing of special categories of personal data for purpose of legal advice and legal proceedings

47. The processing of special categories of personal data shall be lawful where the processing—

• (a) is necessary for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

• (b) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

48. Processing of personal data revealing political opinions for electoral activities and functions of Referendum Commission

48. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of personal data revealing political opinions shall be lawful where the processing is carried out—

• (a) in the course of electoral activities in the State for the purpose of compiling data on peoples’ political opinions by—

• (i) a political party, or

• (ii) a candidate for election to, or a holder of, elective political office in the State,

and

• F10[(b) by An Coimisiún Toghcháin in the performance of its functions.]

49. Processing of special categories of personal data for purposes of administration of justice and performance of functions

49. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing respects the essence of the right to data protection and is necessary and proportionate for—

• (a) the administration of justice, or

• (b) the performance of a function conferred on a person by or under an enactment or by the Constitution.

50. Processing of special categories of personal data for insurance and pension purposes

50. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of data concerning health shall be lawful where the processing is necessary and proportionate for the purposes of the following:

• (a) a policy of insurance or life assurance,

• (b) a policy of health insurance or health-related insurance,

• (c) an occupational pension, a retirement annuity contract or any other pension arrangement, or

• (d) the mortgaging of property.

51. Processing of special categories of personal data and Article 10 data for reasons of substantial public interest

51. (1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection (3).

• (2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).

• (3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following—

• (a) special categories of personal data, and

• (b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.

• (4) Without prejudice to the generality of subsection (3), regulations made under that subsection shall identify—

• (a) the substantial public interest concerned, and

• (b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

• (5) For the purposes of subsection (4)(b), subsections (2) to (8) of section 36 shall apply in like manner to regulations made under subsection (3) as they apply to regulations made under section 36.

• (6) Regulations may be made under subsection (3) by—

• (a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

• (b) any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

• (7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

• (a) the nature, scope and purposes of the processing,

• (b) the nature of the substantial public interest concerned,

• (c) any benefits likely to arise for the data subjects concerned,

• (d) any risks arising for the rights and freedoms of such subjects, and

• (e) the likelihood of any such risks arising and the severity of such risks.

• (8) Regulations made under subsection (3) shall—

• (a) respect the essence of the right to data protection, and

• (b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

• (9) In this section, “Article 10 data” has the meaning assigned to it by section 55.

52. Processing of special categories of personal data for purposes of Article 9(2)(h)

52. (1) Subject to subsection (2) and to suitable and specific measures being taken to safe-guard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary—

• (a) for the purposes of preventative or occupational medicine,

• (b) for the assessment of the working capacity of an employee,

• (c) for medical diagnosis,

• (d) for the provision of medical care, treatment or social care,

• (e) for the management of health or social care systems and services, or

• (f) pursuant to a contract with a health practitioner.

• (2) Processing shall be lawful in accordance with subsection (1) where it is undertaken by or under the responsibility of—

• (a) a health practitioner, or

• (b) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner.

• (3) In this section, “health practitioner” has the same meaning as it has in the Health Identifiers Act 2014.

53. Processing of special categories of personal data for purposes of public interest in the area of public health

53. Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary for public interest reasons in the area of public health including—

• (a) protecting against serious cross-border threats to health, and

• (b) ensuring high standards of quality and safety of health care and of medicinal products and medical devices.

54. Processing of special categories of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

54. Subject to compliance with section 42, the processing of special categories of personal data is lawful where such processing is necessary and proportionate for—

• (a) archiving purposes in the public interest,

• (b) scientific or historical research purposes, or

• (c) statistical purposes.

55. Processing of personal data relating to criminal convictions and offences

55. (1) Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to compliance with Article 6(1) and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, personal data referred to in Article 10 (in this section referred to as “Article 10 data”) may be processed—

• (a) under the control of official authority, or

• (b) where—

• (i) the data subject has given explicit consent to the processing for one or more specified purposes except where the law of the European Union or the law of the State prohibits such processing,

• (ii) processing is necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,

• (iii) processing is—

• (I) necessary for the purpose of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

• (II) otherwise necessary for the purposes of establishing, exercising or defending legal rights,

• (iv) processing is necessary to prevent injury or other damage to the data subject or another person or loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or another person, or

• (v) processing is permitted in regulations made under subsection (3) or is otherwise authorised by the law of the State.

• (2) Processing under the control of official authority referred to in subsection (1)(a) includes processing required for the following purposes:

• (a) the administration of justice;

• (b) the exercise of a regulatory, authorising or licensing function or determination of eligibility for benefits or services;

• (c) protection of the public against harm arising from dishonesty, malpractice, breaches of ethics or other improper conduct by, or the unfitness or incompetence of, persons who are or were authorised to carry on a profession or other activity;

• (d) enforcement actions aimed at preventing, detecting or investigating breaches of the law of the European Union or the law of the State that are subject to civil or admin-istrative sanctions;

• (e) archiving in the public interest, scientific or historical research purposes or statistical purposes where the processing is carried out in accordance with section 42 for those purposes by or on behalf of a public authority or public body.

• (3) Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject and subject to subsection (7), regulations may be made permitting the processing of Article 10 data where the processing is necessary and proportionate to—

• (a) assess the risk of fraud or prevent fraud,

• (b) assess the risk of bribery or corruption, or both, or to prevent bribery or corruption, or both, or

• (c) ensure network and information systems security, and prevent attacks on and damage to computer and electronic communications systems.

• (4) Subject to subsection (5), regulations may be made under subsection (3)—

• (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

• (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

• (5) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (3).

• (6) The Commission may, on being consulted under subsection (5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

• (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

• (b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

• (7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to—

• (a) the nature, scope and purposes of the processing,

• (b) any risks arising for the rights and freedoms of individuals, and

• (c) the likelihood of any such risks arising and the severity of such risks.

• (8) A person who knowingly or recklessly contravenes this section or any regulations made under subsection (3) shall be guilty of an offence and shall be liable—

• (a) on summary conviction to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

• (9) In this section, “Article 10 data” shall include personal data relating to the alleged commission of an offence and any proceedings in relation to such an offence.

Chapter 3 Rights, and restrictions of rights, of data subject and restrictions on obligations of controllers

56. Right of access to results and scripts of examination and results of appeal

56. (1) Subject to subsection (3), a request by a data subject under Article 15 in relation to the result of an examination at which he or she was a candidate, or in relation to a script completed by him or her in the course of such an examination shall, for the purposes of that Article, be taken to have been made on the later of—

• (a) the date of the first publication of the results of the examination, or

• (b) the date of the request.

• (2) A request by a data subject under Article 15 in relation to the result of an appeal by the data subject against the result of an examination at which he or she was a candidate shall, for the purposes of that Article, be taken to have been made on the later of—

• (a) the date of the first publication of the results of the appeal, or

• (b) the date of the request.

• (3) Where—

• (a) a request by a data subject referred to in subsection (1) relates to a script completed by him or her in the course of an examination in the Leaving Certificate Examinations conducted by the State Examinations Commission, and

• (b) the data subject, whether before or after the making of that request, appeals the result of the examination referred to in paragraph (a),

that request shall be taken to have been made on the date of the first publication of the results of the appeal referred to in paragraph (b).

• (4) In this section—

“appeal” means any formal process to enable a candidate to request a recheck of an examination result which is specified by a person who operates the examination;

“examination” means any process for determining the knowledge, intelligence, skill or ability of a person by reference to his or her performance in any test, work or other activity;

“script” means any work produced by a candidate as part of an examination including any examination answer-book (whether in written or digital form), journal, portfolio, audio and visual recording, practical piece or artefact and, for the purposes of this definition, shall be deemed to include—

• (a) an audio or visual recording, produced in the course of an examination, of the performance of the candidate in the examination, and

• (b) any marks or comments added to the script, or made in relation to the script, by an examiner in the course of his or her marking of the script.

57. Rights in relation to automated decision making

57. (1) Subject to Article 22(4) and to suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject, for the purposes of Article 22(2)(b), the right of a data subject not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her shall, in addition to the grounds identified in Article 22(2)(a) and (c), not apply where—

• (a) the decision is authorised or required by or under an enactment, and

• (b) either—

• (i) the effect of that decision is to grant a request of the data subject, or

• (ii) in all other cases (where subparagraph (i) is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to—

• (I) make representations to the controller in relation to the decision,

• (II) request human intervention in the decision-making process,

• (III) request to appeal the decision.

• (2) In the case of requests made under subsection (1)(b)(ii)(II) or (III) the controller shall—

• (a) comply with the request, and

• (b) notify the data subject in writing of—

• (i) the steps taken to comply with the request, and

• (ii) in the case of an appeal under subsection (1)(b)(ii)(III), the outcome of the appeal.

58. Direct marketing for purposes of Article 21

58. For the purposes of the application of Article 21 in the State, the reference to “direct marketing” includes a reference to direct mailing other than direct mailing carried out—

• (a) in the course of electoral activities in the State by—

• (i) a political party or its members, or

• (ii) a candidate for election to, or a holder of, elective political office in the State,

and

• F11[(b) by An Coimisiún Toghcháin in the performance of its functions.]

59. Restriction on right of data subject to object to processing for election purposes and processing by Referendum Commission

59. The right of a data subject to object at any time to the processing of personal data concerning him or her under Article 21 shall not apply to processing carried out—

• (a) in the course of electoral activities in the State by—

• (i) a political party, or

• (ii) a candidate for election to, or a holder of, elective political office in the State,

and

• F12[(b) by An Coimisiún Toghcháin in the performance of its functions.]

60. Restrictions on obligations of controllers and rights of data subjects for important objectives of general public interest

60. (1) The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22—

• (a) are restricted to the extent specified in subsection (3), and

• (b) may be restricted in regulations made under subsections (5) or (6).

• (2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.

• (3) Subject to subsection (4), the rights and obligations referred to in subsection (1) are restricted to the extent that—

• (a) the restrictions are necessary and proportionate—

• (i) to safeguard cabinet confidentiality, parliamentary privilege, national security, defence and the international relations of the State,

• (ii) for the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties,

• (iii) for the administration of any tax, duty or other money due or owing to the State or a local authority in any case in which the non-application of the restrictions concerned would be likely to prejudice the aforementioned administration,

• (iv) in contemplation of or for the establishment, exercise or defence of, a legal claim, prospective legal claim, legal proceedings or prospective legal proceedings whether before a court, statutory tribunal, statutory body or an administrative or out-of-court procedure,

• (v) for the enforcement of civil law claims, including matters relating to any liability of a controller or processor in respect of damages, compensation or other liabilities or debts related to the claim, or

• (vi) for the purposes of estimating the amount of the liability of a controller on foot of a claim for the payment of a sum of money, whether in respect of damages or compensation, in any case in which the application of those rights or obligations would be likely to prejudice the commercial interests of the controller in relation to the claim,

• (b) the personal data relating to the data subject consist of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential to a person who has a legitimate interest in receiving the information, or

• F13[(c) the restrictions are, having regard to the matters specified in subsection (3A), necessary and proportionate to safeguard the performance—

• (i) by the Commission of its functions,

• (ii) by the Information Commissioner of his or her functions, or

• (iii) by the Comptroller and Auditor General of his or her functions.]

• F14[(3A) In determining, for the purposes of subsection (3)(c), whether the restriction of a right or an obligation is necessary and proportionate to safeguard the performance of a function, the Commission, Information Commissioner or Comptroller and Auditor General, as the case may be, shall have regard to—

• (i) the extent to which the exercise of the right or compliance with the obligation concerned would prejudice the performance of the function, including by—

• (I) disclosing that a particular function is being performed, in a case in which such disclosure may prejudice the performance of the function concerned,

or

• (II) preventing the processing of personal data for a period of time where any delay to the processing may prejudice the performance of that function,

• (ii) the need to respect the essence of the right to data protection of a data subject,

and

• (iii) the risks to the rights and freedoms of a data subject which may result from such a restriction.]

• (4) The Minister may prescribe requirements to be complied with when the rights and obligations referred to in subsection (1) are restricted in accordance with subsection (3).

• (5) Subject to subsection (9), regulations may be made by a Minister of the Government where he or she considers it necessary for the protection of a data subject or the rights and freedoms of others restricting the rights and obligations referred to in subsection (1)—

• (a) (i) if the application of those rights and obligations would be likely to cause serious harm to the physical or mental health of the data subject, and

• (ii) to the extent to which, and for as long as, such application would be likely to cause such serious harm,

and

• (b) in relation to personal data kept for, or obtained in the course of, the carrying out of social work by a public authority, public body, a voluntary organisation or other body.

• (6) Subject to subsection (9), regulations may be made restricting the rights and obligations referred to in subsection (1) where such restrictions are necessary for the purposes of safeguarding important objectives of general public interest and such regulations shall include, where appropriate, specific provisions required by Article 23(2).

• (7) Important objectives of general public interest referred to in subsection (6) include:

• (a) preventing threats to public security and public safety;

• (b) avoiding obstructions to any official or legal inquiry, investigation or process, including any out-of-court redress procedure, proceedings pending or due before a court, tribunal of inquiry or commission of investigation;

• (c) preventing, detecting, investigating and prosecuting breaches of discipline by, or the unfitness or incompetence of, persons who are or were authorised by law to carry on a profession or any other regulated activity and the imposition of sanctions for same;

• (d) preventing, detecting, investigating or prosecuting breaches of ethics for regulated professions;

• (e) taking any action for the purposes of considering and investigating a complaint made to a regulatory body in respect of a person carrying out a profession or other regulated activity where the profession or activity is regulated by that body and the imposition of sanctions on foot of such a complaint;

• (f) preventing, detecting, investigating or prosecuting, whether in the State or elsewhere, breaches of the law which are subject to civil or administrative sanctions and enforcing such sanctions;

• (g) the identification of assets which are derived from, or are suspected to derive from, criminal conduct and the taking of appropriate action to deprive or deny persons of those assets or the benefits of those assets and any investigation or preparatory work in relation to any related proceedings;

• (h) ensuring the effective operation of the immigration system, the system for granting persons international protection in the State and the system for the acquisition by persons of Irish citizenship, including by preventing, detecting and investigating abuses of those systems or breaches of the law relating to those systems;

• (i) safeguarding the economic or financial interests of the European Union or the State, including on monetary, budgetary and taxation matters;

( j) safeguarding monetary policy, the smooth operation of payment systems, the resolution of regulated financial service providers (within the meaning of the Central Bank Act 1942), the operation of deposit-guarantee schemes, the protection of consumers and the effective regulation of financial service providers (within the meaning of the Central Bank Act 1942);

• (k) protecting members of the public against—

• (i) financial loss or detriment due to the dishonesty, malpractice or other improper conduct of, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate or other entities,

• (ii) financial loss or detriment due to the conduct of individuals who have been adju-dicated bankrupt, or

• (iii) financial loss or detriment due to the conduct of individuals who have been involved in the management of a body corporate which has been the subject of a receivership, examinership or liquidation under the Act of 2014;

• (l) protecting—

• (i) the health, safety, dignity, well-being of individuals at work against risks arising out of or in connection with their employment, and

• (ii) members of the public against discrimination or unfair treatment in the provision of goods or services to them;

• (m) the keeping of public registers for reasons of general public interest, whether the registers are accessible to the public on a general or restricted basis;

• (n) safeguarding the integrity and security of examinations systems;

• (o) safeguarding public health, social security, social protection and humanitarian activ-ities.

• (8) Where the rights and obligations referred to in subsection (1) are restricted in regulations made under subsection (6) on the basis of important objectives of general public interest of the State, other than the objectives referred to in subsection (7), the important objective or objectives of general public interest shall be identified in those regulations.

• (9) Subject to subsection (10), regulations may be made under subsection (5) or (6)—

• (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

• (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

• (10) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (5) or (6).

• (11) The Commission may, on being consulted under subsection (10), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

• (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

• (b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

• (12) Regulations made under this section shall—

• (a) respect the essence of the right to data protection and protect the interests of the data subject, and

• (b) restrict the exercise of data subjects’ rights only in so far as is necessary and proportionate to the aim sought to be achieved.

61. Restriction on exercise of data subjects’ rights: archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

61. (1) Subject to subsection (3), where processing of data is for archiving purposes in the public interest, the rights of a data subject set out in Articles 15, 16, 18, 19, 20 and 21 are restricted to the extent that—

• (a) the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and

• (b) such restriction is necessary for the fulfilment of those purposes.

• (2) Subject to subsection (4), where processing of data is for scientific or historical research purposes or statistical purposes, the rights of a data subject set out in Articles 15, 16, 18 and 21 are restricted to the extent that—

• (a) the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and

• (b) such restriction is necessary for the fulfilment of those purposes.

• (3) Where data is being processed for purposes referred to in subsection (1) and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection.

• (4) Where data is being processed for purposes referred to in subsection (2) and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection.

PART 4 Provisions Consequent on Repeal of Certain Provisions of Data Protection Act 1988

62. Transfer of property of Data Protection Commissioner to Commission

62. (1) On the establishment day, all property (other than land), including choses-in-action, that immediately before that day was vested in the Data Protection Commissioner shall stand vested in the Commission.

• (2) Every chose-in-action vested in the Commission by virtue of subsection (1) may, on and from the establishment day, be sued on, recovered or enforced by the Commission in

its own name, and it shall not be necessary for the Commission to give notice to any person bound by the chose-in-action of the vesting effected by that subsection.

• (3) On the establishment day all records that, immediately before that day, were records of the Data Protection Commissioner shall be records of the Commission and shall, accordingly, be transferred to the Commission.

63. Transfer of rights and liabilities of Data Protection Commissioner to Commission

63. (1) All rights and liabilities of the Data Protection Commissioner subsisting immediately before the establishment day and arising by virtue of any contract or commitment (express or implied) shall on that day stand transferred to the Commission.

• (2) Every right and liability transferred by subsection (1) to the Commission may, on and after the establishment day, be sued on, recovered or enforced by or against the Commission in its own name, and it shall not be necessary for the Commission to give notice to the person whose right or liability is transferred by that subsection of such transfer.

64. Liability for loss occurring before establishment day

64. (1) A claim in respect of any loss or injury alleged to have been suffered by any person arising out of the performance before the establishment day of any of the functions of the Data Protection Commissioner shall after that day, lie against the Commission and not against the Data Protection Commissioner.

• (2) Any legal proceedings pending immediately before the establishment day to which the Data Protection Commissioner is a party, shall be continued, with the substitution in the proceedings of the Commission for the Data Protection Commissioner.

• (3) Where, before the establishment day, agreement has been reached between the parties concerned in settlement of a claim to which subsection (1) relates, the terms of which have not been implemented, or judgment in such a claim has been given in favour of a person but has not been enforced, the terms of the agreement or judgment, as the case may be, shall, in so far as they are enforceable against the Data Protection Commissioner, be enforceable against the Commission and not the Data Protection Commissioner.

• (4) Any claim made or proper to be made by the Data Protection Commissioner in respect of any loss or injury arising from the act or default of any person before the establishment day shall be regarded as having been made by or proper to be made by the Commission and may be pursued and sued for by the Commission as if the loss or injury had been suffered by the Commission.

65. Provisions consequent upon transfer of functions, assets, rights and liabilities to Commission

65. (1) Anything commenced and not completed before the establishment day by or under the authority of the Data Protection Commissioner may, in so far as it relates to a function transferred to the Commission under section 14, be carried on or completed on or after the establishment day by the Commission.

• (2) Every instrument made under an enactment and every document (including any certificate or notice) granted, made or issued, in the performance of a function transferred by section 14, shall, if and in so far as it was operative immediately before the establishment day, have effect on and after that day as if it had been granted, made or issued by the Commission.

• (3) References to the Data Protection Commissioner in the memorandum or articles of association of any company shall, on and after the establishment day, be construed as references to the Commission.

• (4) A certificate signed by the Minister that any property, right or liability has or, as the case may be, has not vested in the Commission under section 62 or 63 shall be sufficient evidence, unless the contrary is shown, of the fact so certified for all purposes.

66. Final accounts and final annual report of Data Protection Commissioner

66. (1) The Commission shall, in respect of the period specified under subsection (3), prepare final accounts of the Data Protection Commissioner.

• (2) The Commission shall submit the final accounts to the Comptroller and Auditor General for audit not later than 3 months after the establishment day.

• (3) For the purposes of subsection (1), the Minister may specify a period that is longer or shorter than a financial year of the Data Protection Commissioner.

• (4) The Commission shall prepare the final annual report for the Data Protection Commis-sioner and cause a copy of the report to be laid before each House of the Oireachtas not later than 6 months after the establishment day.

67. Saver for scheme relating to superannuation

67. A scheme made under section 9 and paragraph 7(a) of the Second Schedule to the Act of 1988 that was in force immediately prior to coming into operation of section 7 in so far as it relates to the repeal of section 9 and paragraph 7(a) of the Second Schedule to the Act of 1988 shall continue in force on and after that coming into operation as if the scheme had been made under section 22 and—

• (a) a person who was a member of the scheme on that coming into operation shall continue to be a member, and

• (b) the provisions of that section shall apply accordingly.

68. Saver for regulations under Act of 1988

68. (1) Notwithstanding subsection (1) of section 8, the Data Protection Act 1988 (Section 2A) Regulations 2013 (S.I. No. 313 of 2013) and the Data Protection Act 1988 (Section 2A) Regulations 2016 (S.I. No. 220 of 2016) shall, in addition to applying for the purposes referred to in that subsection, apply for all other purposes for which they applied immediately before the commencement of that subsection and, in so far only as they apply for the second-mentioned purposes, they shall be deemed to have been made under section 38 and may be amended or revoked accordingly.

• (2)
• (a) The Data Protection Health Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 60(5)(a).

• (b) The Data Protection Health Regulations are amended—

• (i) in Regulation 3, by—

• (I) the deletion of the definition of “the Act”,

• (II) the deletion of the definition of “health professional”, and

• (III) the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘health practitioner’ has the same meaning as it has in the Health Identifiers Act 2014.”,

• (ii) in Regulation 4(1), by—

• (I) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and

• (II) the substitution of “the physical or mental health of the data subject, but this restriction on providing information applies only to the extent to which, and for so long as, that likelihood pertains.” for “the physical or mental health of the data subject.”,

• (iii) in Regulation 5, by—

• (I) the substitution of “health practitioner” for “health professional” in each place it occurs,

• (II) the substitution, in paragraph (1)(a), of “a request under the said Article 15 of the Data Protection Regulation” for “a request under the said section 4(1)(a)”, and

• (III) the substitution, in paragraph (2)(a), of “within the meaning of section 2 of the Medical Practitioners Act 2007 or a medical practitioner practising medicine pursuant to section 50 of that Act” for “within the meaning of the Medical Practitioners Act 1978 (No. 4 of 1978), or registered dentist, within the meaning of the Dentists Act 1985 (No. 9 of 1985)”,

and

• (iv) by the deletion of Regulation 6.

• (c) A request referred to in Regulation 4(1) of the Data Protection Health Regulations which includes a request for health data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.

• (3)
• (a) The Data Protection Social Work Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 60(5)(b).

• (b) The Data Protection Social Work Regulations are amended—

• (i) in Regulation 3, by—

• (I) the deletion of the definition of “the Act”,

• (II) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁰ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

and

• (III) the substitution of the following definition for the definition of “social work data”:

“ ‘social work data’ means personal data kept for, or obtained in the course of, carrying out social work by a public authority, public body, voluntary organisation or other body but excludes any health data within the meaning of the Data Protection (Access Modification) (Health) (Regulations) 1989 (S.I. No. 82 of 1989) and ‘social work’ shall be construed accordingly.”,

• (ii) in Regulation 4—

• (I) in paragraph (1), by—

• (A) the substitution of “a request under Article 15 of the Data Protection Regu-lation” for “a request under section 4(1)(a) of the Act”, and

• (B) the substitution of “the physical or mental health or emotional condition of the data subject, but this restriction on providing information applies only to the extent to which, and for as long as, that likelihood pertains.” for “the physical or mental health or emotional condition of the data subject.”,

and

• (II) in paragraph (3), by the substitution of “under Article 15 of the Data Protection Regulation” for “under section 4(1)(a) of the Act”,

and

• (iii) the deletion of Regulation 5.

• (c) A request referred to in Regulation 4(1) of the Data Protection Social Work Regulations which includes a request for social work data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.

• (4) The Regulations of 2011 shall apply to—

• (a) each special category of personal data that, immediately before the coming into operation of this section—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement,

and

• (b) Article 10 data that, immediately before such coming into operation—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.

• (5) The Regulations of 2011 are amended—

• (a) in Regulation 3, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”,

• (b) in Regulation 4, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”, and

• (c) by the insertion of the following Regulation after Regulation 6:

“7. In these Regulations, “suitable and specific measures to safeguard the funda-mental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.

• (6) The Regulations of 2015 shall, in addition to applying to sensitive personal data to which the Act of 1988 applies, apply to—

• (a) each special category of personal data that, immediately before the coming into operation of this section—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement,

and

• (b) Article 10 data that, immediately before such coming into operation—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.

• (7) The Regulations of 2015 are amended—

• (a) in Regulation 2, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing” for “ The processing”, and

• (b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the funda-mental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.

• (8) The Regulations of 2016 shall, in addition to applying to sensitive personal data to which the Act of 1988 applies, apply to—

• (a) each special category of personal data that, immediately before the coming into operation of this section—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement,

and

• (b) Article 10 data that, immediately before such coming into operation—

• (i) constituted sensitive personal data to which those Regulations applied, or

• (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.

• (9) The Regulations of 2016 are amended—

• (a) in Regulation 2, by the substitution of “Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing” for “ The processing”, and

• (b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the funda-mental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.

• (10) In this section—

“Article 10 data” has the meaning assigned to it in section 55;

“Data Protection Health Regulations” means the Data Protection (Access Modification) (Health) Regulations 1989 (S.I. No. 82 of 1989);

“Data Protection Social Work Regulations” means the Data Protection (Access Modification) (Social Work) Regulations 1989 (S.I. No. 83 of 1989);

“Regulations of 2011” means the Data Protection Act 1988 (Section 2B) Regulations 2011 (S.I. No. 486 of 2011);

“Regulations of 2015” means the Data Protection Act 1988 (Section 2B) Regulations 2015 (S.I. No. 240 of 2015);

“Regulations of 2016” means the Data Protection Act 1988 (Section 2B) (No. 2) Regulations 2016 (S.I. No. 427 of 2016);

“sensitive personal data” has the meaning assigned to it by the Act of 1988.

PART 5 Processing of Personal Data for Law Enforcement Purposes

Chapter 1 Preliminary and general (Part 5)

69. Interpretation (Part 5)

69. (1) In this Part—

“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual that allow or confirm the unique identification of the individual, including facial images or dactylo-scopic data;

“competent authority”, subject to subsection (2), means—

• (a) a public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security, or

• (b) any other body or entity authorised by law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security;

“controller”, subject to subsection (2), means—

• (a) a competent authority that, whether alone or jointly with others, determines the purposes and means of the processing of personal data, or

• (b) where the purposes and means of the processing of personal data are determined by the law of the European Union or otherwise by the law of the State, a controller nominated—

• (i) by that law, or

• (ii) in accordance with criteria specified in that law;

“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services to the individual, that reveal information about the status of his or her health;

“data protection impact assessment” has the meaning assigned to it by section 84(1);

“data protection officer” has the meaning assigned to it by section 88(1);

“data subject” means an individual to whom personal data relate;

“genetic data” means personal data relating to the inherited or acquired genetic charac-teristics of an individual that give unique information about the physiology or the health of the individual and that result, in particular, from an analysis of a biological sample from the individual in question;

“international organisation” means—

• (a) an organisation, and subordinate bodies of an organisation, governed by public international law, or

• (b) any other body that is established by, or on the basis of, an agreement between two or more states;

“joint controller” has the meaning assigned to it by section 79(1);

“online identifier” includes an internet protocol address, a cookie identifier or other identifier such as a radio frequency identification tag;

“personal data” means information relating to—

• (a) an identified living individual, or

• (b) a living individual who can be identified from the data, directly or indirectly, in particular by reference to—

• (i) an identifier such as a name, an identification number, location data or an online identifier, or

• (ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual;

“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

“processing”, of or in relation to personal data, means an operation or a set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, including—

• (a) the collection, recording, organisation, structuring or storing of the data,

• (b) the adaptation or alteration of the data,

• (c) the retrieval, consultation or use of the data,

• (d) the disclosure of the data by their transmission, dissemination or otherwise making the data available,

• (e) the alignment or combination of the data, or

• (f) the restriction, erasure or destruction of the data;

“processor” means an individual who, or a legal person, public authority, agency or other body that, processes personal data on behalf of a controller, but does not include an employee of a controller who processes such data in the course of his or her employment;

“profiling” means any form of automated processing of personal data consisting of the use of the data to evaluate certain personal aspects relating to an individual, including to analyse or predict aspects concerning the individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“pseudonymisation” means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that—

• (a) such additional information is kept separately from the data, and

• (b) is subject to technical and organisational measures to ensure that the data are not attributed to an identified or identifiable individual;

“rectification”, of or in relation to personal data, includes, where the data concerned are incomplete, the completion of the data, whether by means of a supplementary statement or otherwise;

“recipient”, of or in relation to personal data, means an individual to whom, or a legal person, public authority, agency or other body to which, the data are disclosed, and includes a third party;

“relevant filing system” means a set of personal data, whether centralised, decentralised or dispersed on a functional or geographical basis, where the set is structured according to specific criteria in such a way that the data are readily accessible according to those criteria;

“restrict”—

• (a) in relation to the exercise of the right of a data subject—

• (i) under section 87(1) to be notified of a personal data breach,

• (ii) under section 92(10) to be notified of the restriction of the processing of personal data under subsection (9) of that section, or

• (iii) under section 92(11) to be notified of a decision not to rectify or erase data pursuant to a request under subsection (1) or (3) of that section, as the case may be,

means—

• (I) to delay the notification concerned,

• (II) to limit the information contained in the notification concerned, or

• (III) not to make the notification concerned,

and

• (b) in relation to the exercise of the right of a data subject—

• (i) under section 90(1) in so far as relates to the provision to the data subject of information specified in subsection (2)(f) of that section, or

• (ii) under section 91(1)(a) or (b),

means—

• (I) to delay the provision of the information concerned,

• (II) to limit the information concerned provided to the data subject, or

• (III) not to provide the information concerned;

“restriction of processing” means the marking, by or on behalf of a controller, of personal data for which the controller is responsible for the purpose of limiting their processing in the future;

“special categories of personal data” means—

• (a) personal data revealing—

• (i) the racial or ethnic origin of the data subject,

• (ii) the political opinions or the religious or philosophical beliefs of the data subject, or

• (iii) whether the data subject is a member of a trade union,

• (b) genetic data,

• (c) biometric data for the purposes of uniquely identifying an individual,

• (d) data concerning health, or

• (e) personal data concerning an individual’s sex life or sexual orientation.

• (2) Where a reference is made in this Part—

• (a) to a controller in a Member State other than the State, for the purposes of that reference—

• (i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the Member State concerned”, and

• (ii) in the definition of “controller” in subsection (1), the reference to “the law of the State” shall be construed as meaning “the law of the Member State concerned”,

or

• (b) to a controller in a third country, for the purposes of that reference—

• (i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the state concerned”, and

• (ii) in the definition of “controller” in subsection (1), the reference to “the law of the European Union or the law of the State” shall be construed as meaning “the law of the state concerned”.

• (3) A word or expression that is used in this Part and is also used in the Directive has, unless the context otherwise requires, the same meaning in this Part as it has in the Directive.

70. Application of Part 5

70. (1) This Part applies, subject to subsection (2), to the processing of personal data by or on behalf of a controller where the processing is carried out—

• (a) for the purposes of—

• (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security, or

• (ii) the execution of criminal penalties,

and

• (b) by means that—

• (i) are wholly or partly automated, or

• (ii) where the personal data form part of, or are intended to form part of, a relevant filing system, are not automated.

• (2) This Part shall not apply to the processing of personal data—

• (a) that occurs in the course of an activity falling outside the scope of the law of the European Union,

• (b) by an institution, body, office or agency of the European Union, or

• (c) to which section 8(1)(b) applies.

Chapter 2 General principles of data protection

71. Processing of personal data

71. (1) A controller shall, as respects personal data for which it is responsible, comply with the following provisions:

• (a) the data shall be processed lawfully and fairly;

• (b) the data shall be collected for one or more specified, explicit and legitimate purposes and shall not be processed in a manner that is incompatible with such purposes;

• (c) the data shall be adequate, relevant and not excessive in relation to the purposes for which they are processed;

• (d) the data shall be accurate, and, where necessary, kept up to date, and every reason-able step shall be taken to ensure that data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

• (e) the data shall be kept in a form that permits the identification of a data subject for no longer than is necessary for the purposes for which the data are processed;

• (f) the data shall be processed in a manner that ensures appropriate security of the data, including, by the implementation of appropriate technical or organisational measures, protection against—

• (i) unauthorised or unlawful processing, and

• (ii) accidental loss, destruction or damage.

• (2) The processing of personal data shall be lawful where, and to the extent that—

• (a) the processing is necessary for the performance of a function of a controller for a purpose specified in section 70(1)(a) and the function has a legal basis in the law of the European Union or the law of the State, or

• (b) the data subject has, subject to subsection (3), given his or her consent to the processing.

• (3) Where the processing of personal data is to be carried out on the basis of the consent of the data subject referred to in subsection (2)(b), the processing shall be lawful only where, and to the extent that—

• (a) having been informed of the intended purpose of the processing and the identity of the controller, the data subject gives his or her consent freely and explicitly,

• (b) the request for consent is expressed in clear and plain language, and where such consent is given in the context of a written statement that also concerns other matters, the request for consent is presented to the data subject in a manner that is clearly distinguishable from those other matters, and

• (c) the data subject may withdraw his or her consent at any time, and he or she shall be informed of this possibility prior to giving consent.

• (4) Where a data subject withdraws his or her consent to the processing of personal data pursuant to subsection (3)(c), the withdrawal of consent shall not affect the lawfulness of processing based on that consent prior to the consent being withdrawn.

• (5) Where a controller collects personal data for a purpose specified in section 70(1)(a), the controller or another controller may process the data for a purpose so specified other than the purpose for which the data were collected, in so far as—

• (a) the controller is authorised to process such personal data for such a purpose in accordance with the law of the European Union or the law of the State, and

• (b) the processing is necessary and proportionate to the purpose for which the data are being processed.

• (6) A controller may process personal data, whether the data were collected by the controller or another controller, for—

• (a) archiving purposes in the public interest,

• (b) scientific or historical research purposes, or

• (c) statistical purposes,

provided that the said processing—

• (i) is for a purpose specified in section 70(1)(a), and

• (ii) is subject to appropriate safeguards for the rights and freedoms of data subjects.

• (7) A controller shall ensure, in relation to personal data for which it is responsible, that an appropriate time limit is established for—

• (a) the erasure of the data, or

• (b) the carrying out of periodic reviews of the need for the retention of the data.

• (8) Where a time limit is established in accordance with subsection (7), the controller shall ensure, by means of procedural measures, that the time limit is observed.

• (9) A processor, or any person acting under the authority of the controller or of the processor who has access to personal data, shall not process the data unless the processor or person is—

• (a) authorised to do so by the controller, or

• (b) required to do so by the law of the European Union or the law of the State,

and then only to the extent so authorised or required, as the case may be.

• (10) A controller shall ensure that it is in a position to demonstrate that the processing of personal data for which it is responsible is in compliance with subsections (1) to (8) of this section.

72. Security measures for personal data

72. (1) In determining appropriate technical or organisational measures for the purposes of section 71(1)(f), a controller shall ensure that the measures provide a level of security appropriate to the harm that might result from accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, the data concerned.

• (2) A controller or processor shall take all reasonable steps to ensure that—

• (a) persons employed by the controller or the processor, as the case may be, and

• (b) other persons at the place of work concerned,

are aware of and comply with the relevant technical or organisational measures referred to in subsection (1).

73. Processing of special categories of personal data (Part 5)

73. (1) The processing of a special category of personal data shall be lawful only where—

• (a) section 71 is complied with, and

• (b) at least one of the following conditions is met:

• (i) where the processing is to be carried out on the basis of the consent of the data subject pursuant to section 71(2)(b), the consent referred to in that paragraph explicitly refers to the special category of personal data concerned;

• (ii) the processing is necessary—

• (I) to prevent injury or other damage to the data subject or another individual,

• (II) to prevent loss in respect of, or damage to, property, or

• (III) otherwise to protect the vital interests of the data subject or another individual;

• (iii) the personal data to which the processing relates have been made public as a result of steps deliberately taken by the data subject;

• (iv) the processing is necessary for—

• (I) the administration of justice,

• (II) the performance of a function conferred on a person by or under an enactment, or

• (III) the performance of a function of the Government or a Minister of the Government;

• (v) the processing—

• (I) is required for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

• (II) is otherwise required for the purposes of establishing, exercising or defending legal rights;

• (vi) the processing is necessary for medical purposes and is carried out by, or under the responsibility of—

• (I) a health practitioner, or

• (II) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner;

• (vii) the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law;

• (viii) the processing is carried out pursuant to section 71(6);

• (ix) the processing is authorised by regulations made under subsection (2).

• (2) Regulations may be made permitting the processing of special categories of personal data for the purposes of subsection (1)(b)(ix) where the processing is necessary for reasons of substantial public interest, and without prejudice to the generality of the foregoing, such regulations shall identify the public interest concerned.

• (3) Subject to subsection (4), regulations may be made under subsection (2)—

• (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

• (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

• (4) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (2).

• (5) The Commission may, on being consulted under subsection (4), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

• (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

• (b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

• (6) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (2) shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to—

• (a) the nature, scope and purposes of the processing,

• (b) the nature of the substantial public interest concerned,

• (c) any benefits likely to arise for the data subjects concerned,

• (d) any risks arising for the rights and freedoms of such subjects, and

• (e) the likelihood of any such risks arising and the severity of such risks.

• (7) Where a special category of personal data is processed in accordance with this section, the controller shall ensure that the processing is carried out with appropriate safeguards for the rights and freedoms of the data subject.

• (8) In this section—

“health practitioner” has the same meaning as it has in the Health Identifiers Act 2014;

“medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of medical care and treatment and the management of healthcare services.

74. Data quality

74. (1) A controller shall, where relevant and in so far as is possible, make a distinction between the personal data of different categories of data subject.

• (2) A controller shall, in so far as is possible, ensure that personal data based on facts are distinguished from personal data based on personal assessments.

• (3) A controller shall—

• (a) take all reasonable steps to ensure that personal data that are inaccurate, incomplete or no longer up to date are not transmitted or otherwise made available,

• (b) verify, in so far as is possible, the quality of personal data before they are transmitted or otherwise made available, and

• (c) provide, in so far as is possible, in a transmission of personal data, the information necessary for the recipient to assess the accuracy, completeness and reliability of the data and the extent to which the data are up to date.

• (4) Other than where section 92 applies, where a controller becomes aware that incorrect personal data have been transmitted or personal data have been unlawfully transmitted—

• (a) the controller shall ensure that the recipient of the personal data is notified without delay of that fact, and

• (b) the recipient shall ensure that the personal data are rectified or erased or the processing of the data is restricted, as may be appropriate.

Chapter 3 Obligations of controllers and processors

75. General obligations of controller with regard to technical and organisational measures

75. (1) A controller shall implement appropriate technical and organisational measures for the purposes of—

• (a) ensuring that the processing of personal data for which it is responsible is performed in compliance with this Part, and

• (b) demonstrating such compliance.

• (2) A controller shall ensure that measures implemented in accordance with subsection (1) are reviewed at regular intervals and, where required, updated.

• (3) The measures referred to in subsection (1) shall include the implementation of an appropriate data protection policy by the controller, where such implementation is proportionate in relation to the processing activities carried out by the controller.