DATA PROTECTION ACT 2018

• (a) nominated by the controller or processor, within such period as is specified in the notice given under subsection (1), and approved by the Commission, or

• (b) nominated by the Commission, where—

• (i) no person is nominated by the controller or processor within the period specified in the notice under subsection (1), or

• (ii) the Commission is not satisfied with the person so nominated.

• (5) When considering whether to approve a nomination under subsection (4)(a) or make a nomination under subsection (4)(b), the Commission shall have regard to the circumstances giving rise to the requirement for a report and whether the person it proposes to so approve or nominate as reviewer appears to have—

• (a) the competence and expertise necessary to prepare the report,

• (b) the ability to complete the report within the period specified by the Commission in the notice given under subsection (1),

• (c) any relevant specialised knowledge, including specialised knowledge of the data processing activities carried on by the controller or processor and the matters to be reported on,

• (d) any potential conflict of interest in reviewing the matters to be reported on,

• (e) sufficient detachment, having regard to any existing professional or commercial relationship, to give an objective opinion, and

• (f) any previous experience in preparing reports under this section or reports of a similar nature.

• (6) Where the Commission approves a nomination under subsection (4)(a) or makes a nomination under subsection (4)(b), it shall notify the controller or processor, in writing, accordingly.

• (7) Where the nomination of a reviewer is approved or made by the Commission under subsection (4), the controller or processor shall enter into a contract with the reviewer.

• (8) It shall be a term of the contract referred to in subsection (7)—

• (a) that the reviewer is required to prepare for the controller or processor a report in accordance with the notice given under subsection (1),

• (b) that the reviewer is required and permitted to provide to the Commission the following where the Commission so requests:

• (i) periodic updates on progress and issues arising;

• (ii) interim reports; and

• (iii) copies of any draft reports given to the controller or processor,

and

• (c) that the contract is governed by the law of the State.

• (9) If the Commission considers it appropriate, it may request the controller or processor to provide the Commission with a copy of the draft contract before it is made and the Commission may require such modifications to the draft contract as it considers appro-priate.

• (10) The costs of and incidental to the preparation of a report under this section shall be borne by the controller or processor.

• (11) A controller or processor shall give all such assistance to a reviewer as he or she may reasonably require for the purposes of the preparation of a report under this section.

• (12) A reviewer shall, where requested by the Commission, in such form and within such period as the Commission may specify, provide an explanation of all or any part of a report under this section or the recommendations, if any, made in the report, or of such other matters relating to the report as the Commission considers appropriate.

• (13) The Commission shall not be bound by the content of a report under this section and such a report shall not be taken to be a decision or opinion of the Commission for any purpose.

• (14) The Commission shall not be liable for any acts or omissions of a reviewer or controller or processor relating to a report under this section.

• (15) A person who—

• (a) obstructs or impedes a reviewer in the preparation of a report under this section,

• (b) in relation to the preparation of a report under this section, gives information to a reviewer that the person knows to be false or misleading in a material respect, or

• (c) is a reviewer and in relation to the preparation of a report under this section gives information to the Commission which the reviewer knows to be false or misleading in a material respect,

shall be guilty of an offence and shall be liable—

• (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

136. Data Protection Audit

136. (1) Where Part 5 applies to a controller or processor, the Commission may carry out or cause to be carried out such examination in the form of an audit as it considers appropriate in order to determine whether the practices and procedures of the controller or processor are in compliance with that Part and regulations made under it.

• (2) The Commission may, for the purposes of an audit under subsection (1) or a data protection audit, require the controller or processor concerned to produce any documents, records, statements or other information within that person’s possession or control, or within that person’s procurement, that are relevant to or required for the conduct of the audit.

• (3) Before commencing an audit under subsection (1), or a data protection audit, the Commission shall give the controller or processor concerned notice of its proposal to conduct such an audit, which notice shall—

• (a) specify the matters to which the proposed audit will relate, and

• (b) specify the date, which shall be not earlier than 7 days from the date on which the notice is given on which the audit will be commenced.

• (4) In this section, “data protection audit” means a data protection audit conducted for the purpose of Article 58(1)(b) of the Data Protection Regulation.

Chapter 5 Investigations

137. Investigations

137. (1) The Commission may, for the purposes of an inquiry referred to in section 110(1) or 123(1), cause such investigation as it thinks fit to be carried out.

• (2) The Commission may, for the purposes of subsection (1), direct one or more authorised officers—

• (a) to carry out the investigation, and

• (b) to submit to the Commission an investigation report following the completion of the investigation.

• (3) The Commission may define the scope and terms of the investigation to be carried out, whether as respects the matters or the period to which it is to extend or otherwise, and may, in particular, limit the investigation to matters connected with particular circum-stances.

• (4) Where more than one authorised officer has been directed to carry out an investigation, the investigation report shall be prepared jointly by the authorised officers so directed and this section and sections 138 to 140 shall, with all necessary modifications, be construed accordingly.

• (5) As soon as is practicable after being appointed to carry out an investigation, the authorised officer shall—

• (a) give the controller or processor concerned notice in writing—

• (i) where the examination concerned is being carried out in respect of a complaint within the meaning of Chapter 2 or 3, setting out the particulars of the complaint concerned, or

• (ii) where the examination is being carried out of the Commission’s own volition, setting out the matters to which the investigation relates,

and

• (b) afford to the controller or processor an opportunity to respond to the notice under paragraph (a) within 7 days from the date on which the notice was given (or such further period not exceeding 28 days as the authorised officer allows).

138. Conduct of investigation under section 137

138. (1) An authorised officer who has been directed under section 137(2) to carry out an investigation may, for the purposes of the investigation—

• (a) require a person, being a controller or processor, or an employee or agent of such controller or processor, who, in the authorised officer’s opinion—

• (i) possesses information that is relevant to the investigation, or

• (ii) has any record or document within the person’s possession or control or within the person’s procurement that are relevant to the investigation,

to provide that record or document, as the case may be, to the authorised officer, and

• (b) where the authorised officer thinks fit, require that person to attend before him or her for the purpose of so providing that information, record or document, as the case may be,

and the person shall comply with the requirement.

• (2) A requirement under subsection (1) shall specify—

• (a) a period within which, or a date and time on which, the person the subject of the requirement is to comply with the requirement, and

• (b) as the authorised officer concerned thinks fit—

• (i) the place at which the person shall attend to give the information concerned or to which the person shall deliver the record or document concerned, or

• (ii) the place to which the person shall send the information, record or document concerned.

• (3) A person required to attend before an authorised officer under subsection (2)—

• (a) is also required to answer fully and truthfully any question put by the authorised officer, and

• (b) if so required by the authorised officer, shall answer any such question under oath.

• (4) Where it appears to an authorised officer that a person has failed or is failing to comply or fully comply with a requirement under subsection (2) or (3), the authorised officer may, on notice to the person and with the consent of the Commission, apply in a summary manner to the Circuit Court for an order under subsection (5).

• (5) The Circuit Court, on hearing an application under subsection (4), where satisfied that the person concerned has failed or is failing to comply or fully comply with the require-ment concerned, may—

• (a) make an order requiring the person, within such period as the Court may specify, to comply or fully comply, as the case may be, with the requirement, or

• (b) substitute a different requirement for the requirement concerned.

• (6) The administration of an oath referred to in subsection (3)(b) by an authorised officer is hereby authorised.

• (7) A person the subject of a requirement under subsection (1) or (3) shall be entitled to the same immunities and privileges in respect of compliance with such requirement as if the person were a witness before the High Court.

• (8) Any statement or admission made by a person pursuant to a requirement under subsection (1) or (3) shall not be admissible in evidence in proceedings for an offence (other than an offence under subsection (12)) brought against the person, and this shall be explained to the person in ordinary language by the authorised officer concerned.

• (9) Nothing in this section shall be taken to compel the production by any person of state-ments, records or other documents or other information which would be exempt from production in proceedings in a court on the ground of legal professional privilege.

• (10) For the purposes of an investigation, an authorised officer may, if he or she thinks it proper to do so, of his or her own volition conduct an oral hearing.

• (11) Schedule 3 shall have effect for the purposes of an oral hearing referred to in subsection (10).

• (12) Subject to subsection (9), a person who—

• (a) withholds, destroys, conceals or refuses to provide any information or statements, records or other documents required for the purposes of an investigation,

• (b) fails or refuses to comply with any requirement of an authorised officer under this section,

• (c) in purported compliance with a requirement under this section, gives to an authorised officer information, documents or records which the person knows to be false or misleading in a material respect, or

• (d) otherwise obstructs or hinders an authorised officer in the performance of functions under this Act,

shall be guilty of an offence and shall be liable—

• (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

• (13) In this section, a reference to a document or record includes a reference to copies of such document or record.

• (14) The powers conferred under this section on an authorised officer to whom subsection (1) applies are in addition to the powers conferred on such an authorised officer under Chapter 4.

139. Investigation report

139. (1) Where an authorised officer has completed an investigation, he or she shall, as soon as is practicable after having considered, in so far as they are relevant to the investigation—

• (a) any information, records or other documents provided to him or her,

• (b) any statement or admission made by any person,

• (c) any submissions made, and

• (d) any evidence presented (whether at an oral hearing or otherwise),

prepare a draft, in writing, of the investigation report (“draft investigation report”) and give, or cause to be given, to the controller or processor to which the investigation relates—

• (i) a copy of the draft investigation report, and

• (ii) a notice in writing stating that the controller or processor concerned may, not later than 28 days from the date on which the notice was served on it (or such further period not exceeding 28 days as the authorised officer allows), make submissions in writing to the authorised officer on the content of the draft investigation report.

• (2) An authorised officer shall—

• (a) as soon as is practicable after the expiration of the period referred to in subsection (1)(ii), and

• (b) having—

• (i) considered the submissions (if any) made in accordance with subsection (1)(ii), and

• (ii) made any revisions to the draft investigation report which, in the opinion of the authorised officer, are warranted following such consideration,

prepare the investigation report and submit it to the Commission with any such submis-sions annexed to it.

• (3) An investigation report and a draft investigation report under this section shall be in writing and shall state—

• (a) whether the authorised officer—

• (i) is satisfied that an infringement of a relevant provision or, as the case may be, a relevant enactment by the controller or processor to which the investigation relates has occurred or is occurring, or

• (ii) is not so satisfied,

• (b) where paragraph (a)(i) applies, the grounds on which the authorised officer is so satisfied, and

• (c) where paragraph (a)(ii) applies—

• (i) the basis on which the authorised officer is not so satisfied, and

• (ii) the authorised officer’s opinion, in view of such basis, on whether or not a further investigation of the controller or processor is warranted and, if warranted, the authorised officer’s opinion on the principal matters to which the further investig-ation should relate.

• (4) Where an investigation report or a draft investigation report contains a statement referred to in subsection (3)(a)(i), the authorised officer shall not make any recommend-ation, or express any opinion, in such report as to the corrective power under Chapter 2 or 3, as applicable, that he or she considers ought to be exercised in respect of the controller or processor in respect of such infringement in the event that the Commission is also satisfied that an infringement has occurred or is occurring.

140. Commission to consider investigation report

140. (1) The Commission, on receipt under section 139(2) of an investigation report, shall, for the purposes of the inquiry concerned, consider the report and any submissions annexed to it.

• (2) Where the Commission, in considering the documents referred to in subsection (1), forms the view that further information is required for the purpose of enabling it to make a decision under section 111, 112, 124 or 125, or a draft decision under section 113, as the case may be, it may, as it considers appropriate, do one or more than one of the following:

• (a) conduct an oral hearing;

• (b) give the controller or processor to which the investigation concerned relates—

• (i) a copy of the investigation report, and

• (ii) a notice in writing stating that the controller or processor concerned may, within 21 days from the date on which the notice was served on it (or such further period not exceeding 21 days as the Commission allows), make submissions in writing to the Commission in relation to such matters as the Commission may specify in the notice;

or

• (c) direct an authorised officer to conduct such further investigation into such matters as the Commission considers necessary having regard to the investigation report and submissions (if any) annexed to it.

• (3) Schedule 3 shall, with any necessary modification, have effect for the purposes of an oral hearing referred to in subsection (2)(a).

• (4) Sections 138 and 139 and this section shall apply to a further investigation conducted in compliance with a direction under subsection (2)(c), as if the reference to an authorised officer in those sections was a reference to an authorised officer directed under subsection (2)(c) to conduct the further investigation.

Chapter 6 Administrative Fines

141. Power of Commission to decide to impose administrative fine: General

141. (1) The Commission, in considering—

• (a) whether to make a decision to impose an administrative fine, and

• (b) where applicable, the amount of such a fine,

shall act in accordance with this section and Article 83.

• (2) Where a controller to whom section 111(2)(b), 112(2)(b) or 133(9) applies is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3, a decision by the Commission to impose an administrative fine in respect of the infringement or failure concerned shall be a decision to impose an administrative fine on the appropriate authority that, or, as the case may be, the Minister who, made the designation, and not on the controller.

• (3) Where subsection (2) applies, a reference in sections 115(1)(a), 133(9)(b) and this Chapter to a controller shall be construed as a reference to the appropriate authority or Minister concerned.

• (4) Where the Commission decides to impose an administrative fine on a controller or processor that—

• (a) is a public authority or a public body, but

• (b) is not a public authority or a public body that acts as an undertaking within the meaning of the Competition Act 2002,

the amount of the administrative fine concerned shall not exceed €1,000,000.

• (5) The Commission, as soon as practicable after—

• (a) a decision to impose an administrative fine is confirmed under section 142(3)(a) or 143(2), or

• (b) the court decides, under section 142(3)(b), to impose a different fine,

shall give the controller or processor concerned a notice in writing, requiring the controller or processor to pay the amount of the fine concerned to the Commission within the period of 28 days commencing on the date of the notice.

• (6) A controller or processor shall comply with a requirement referred to in subsection (5).

• (7) All payments received by the Commission under this section shall be paid into or disposed of for the benefit of the Exchequer in such manner as the Minister for Finance may direct.

• (8) In this section and section 142, a reference to a decision to impose an administrative fine shall be construed as a reference to a decision by the Commission, under section 111, 112, 113 or 133 (9), to impose such a fine.

142. Appeal against administrative fine

142. (1) Without prejudice to section 150, a controller or processor that is the subject of a decision under section 111, 112, 113 or 133(9) to impose an administrative fine may, within 28 days from the date on which notice of the decision concerned was given to it under section 116 or, as the case may be, section 133(9)(b) appeal to the court against the decision.

• (2) The court, on hearing an appeal under subsection (1), may consider any evidence adduced or argument made by the controller or processor concerned, whether or not already adduced or made to an authorised officer or the Commission.

• (3) Subject to subsections (4) and (5), the court may, on the hearing of an appeal under subsection (1)—

• (a) confirm the decision the subject of the appeal,

• (b) replace the decision with such other decision as the court considers just and appro-priate, including a decision to impose a different fine or no fine, or

• (c) annul the decision.

• (4) The court shall, for the purposes of subsection (3), act in accordance with Article 83.

• (5) Where the decision the subject of the appeal is one to which section 141(4) applies, and the court decides under subsection (3)(b) to impose a different fine, the amount of the fine imposed by the court shall not exceed €1,000,000.

• (6) In this section, “court” means—

• (a) the Circuit Court, where the amount of the administrative fine the subject of the appeal does not exceed €75,000, or

• (b) in any other case, the High Court.

143. Circuit Court to confirm decision to impose administrative fine

143. (1) Where a controller or processor does not appeal in accordance with section 142(1) against a decision by the Commission to impose an administrative fine on the controller or processor, the Commission shall, as soon as is practicable after the expiration of the period referred to in that subsection, and on notice to the controller or processor

concerned, make an application in a summary manner to the Circuit Court for confirmation of the decision.

• (2) The Circuit Court shall, on the hearing of an application under subsection (1), confirm the decision the subject of the application unless the Court sees good reason not to do so.

Chapter 7 Offences

144. Unauthorised disclosure by processor

144. (1) Personal data processed by a processor shall not be disclosed by the processor or by an employee or agent of the processor, without the prior authority of the controller on behalf of whom the data are processed.

• (2) A person who knowingly or recklessly contravenes subsection (1) shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

• (3) Subsection (1) does not apply to a person who shows that the disclosing concerned was required or authorised by or under any enactment, rule of law or order of a court.

145. Disclosure of personal data obtained without authority

145. (1) A person who, without the prior authority of the controller or processor—

• (a) obtains personal data, and

• (b) discloses the data or information to another person,

shall be guilty of an offence and shall be liable—

• (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (ii) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

• (2) Subsection (1) does not apply to a person who shows that the disclosing was required or authorised by or under any enactment, rule of law or order of a court.

• (3) A person who sells personal data that were disclosed to the person in contravention of subsection (1) shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

• (4) A person who offers to sell personal data obtained without the prior authority of the controller or processor shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

146. Offences by directors, etc., of bodies corporate

146. Where an offence under this Act is committed by a body corporate and is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of, a person being a director, manager, secretary or other officer of the body corporate or a person who was purporting to act in any such capacity, that person, as well as the body corporate, shall be guilty of that offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first-mentioned offence.

147. Prosecution of summary offences by Commission

147. (1) Summary proceedings for an offence under this Act may be brought and prosecuted by the Commission.

• (2) Notwithstanding section 10(4) of the Petty Sessions (Ireland) Act 1851, summary proceedings for an offence under this Act may be brought—

• (a) at any time within 3 years from the date on which the offence was alleged to have been committed, or

• (b) if, at the expiry of that period, the person against whom the proceedings are to be brought is outside the State, within 6 months of the date on which he or she next enters the State,

whichever is the later, provided that no such proceedings shall be commenced later than 5 years from the date on which the offence concerned was alleged to have been committed.

• (3) Where a person is convicted of an offence under this Act, the court may, where it is satisfied that there are good reasons for so doing, order the person to pay the costs and expenses, measured by the court, incurred by the Commission in relation to the invest-igation, detection and prosecution of the offence, including the expenses of and incidental to an examination of any information provided to the Commission or an authorised officer.

• (4) An order for costs and expenses under subsection (3) is in addition to and not instead of any fine or other penalty the court may impose.

Chapter 8 Miscellaneous

148. General provisions relating to complaints

148. (1) Subject to subsection (2), sections 108 and 121 shall cease to apply where the complaint concerned is withdrawn, or deemed to have been withdrawn, by the data subject concerned, or on behalf of the data subject by a body mandated by the data subject in accordance with Article 80(1) of the Data Protection Regulation or section 120, as the case may be.

• (2) Where subsection (1) applies, nothing in that subsection shall be construed as preventing the Commission, where it is satisfied that there is good and sufficient reason for so doing, from proceeding or, as the case may be, continuing to examine, in accordance with Chapter 2 or 3, as applicable, the subject matter of the complaint.

• (3) Where it has reasonable doubts concerning the identity of a complainant, the Commission may request from the complainant or, where applicable, the supervisory authority with which the complaint was lodged, such additional information as is necessary to confirm such identity.

149. Publication of convictions, sanctions, etc.

149. (1) The Commission shall publish particulars of any—

• (a) conviction of a person for a contravention of this Act,

• (b) exercise by it of its power—

• (i) to impose an administrative fine, or

• (ii) to order the suspension of data transfers to a recipient in a third country or to an international organisation, under Article 58(2)( j),

or

• (c) order of the Court under section 134.

• (2) The publication under subsection (1) of the particulars referred to in that subsection shall be in such form and manner and in respect of such period as the Commission thinks fit.

• (3) The Commission may publish particulars, in such form and manner and in respect of such period as it thinks fit, of the exercise by it of its corrective powers under Article 58(2) (other than those referred to in subsection (1)) or section 127.

• (4) Subject to subsection (5), the Commission may, if it considers it in the public interest to do so, publish particulars of any report under section 135, report by the Commission of any investigation or audit carried out, or other function performed, by it under the Data Protection Regulation or this Act, or any matter relating to or arising in the course of such an investigation, audit or performance.

• (5) The Commission shall ensure that the publication under subsection (4) of information referred to in that subsection is done in such a manner that commercially sensitive information relating to a person is not disclosed.

• (6) The publication by the Commission of particulars of any report or matters referred to in subsection (3) or (4) and any other report of the Commission shall, for the purposes of the law of defamation, be absolutely privileged.

• (7) In this section, “commercially sensitive information” means—

• (a) financial, commercial, scientific, technical or other information the disclosure of which could reasonably be expected to result in a material financial loss or gain to the person to whom it relates, or could prejudice the competitive position of that person in the conduct of his or her business or otherwise in his or her occupation, or

• (b) information the disclosure of which could prejudice the conduct or outcome of contractual or other negotiations of the person to whom it relates.

150. Right to effective judicial remedy (Part 6)

150. (1) A controller or processor on which an information notice or enforcement notice or a notice under section 135(1) is served may, within 28 days from the date on which the notice is served, appeal against a requirement specified in the notice.

• (2) The court, on hearing an appeal under subsection (1), shall—

• (a) annul the requirement concerned,

• (b) substitute a different requirement for the requirement concerned, or

• (c) dismiss the appeal.

• (3) This subsection applies to an appeal brought under subsection (1)—

• (a) against a requirement specified in an information notice to which section 132(3) applies, or an enforcement notice to which section 133(6) applies, and

• (b) that is brought within the period specified in the notice concerned.

• (4) Notwithstanding any provision of this Act, the court, on hearing an appeal to which subsection (3) applies, may on application to it in that behalf, determine that non-compliance by the controller or processor concerned with a requirement specified in the notice, during the period ending with the determination or withdrawal of the appeal or during such other period as the court may determine, shall not constitute an offence.

• (5) A data subject or other person affected by a legally binding decision of the Commission under Chapter 2 or 3 may, within 28 days from the date on which notice of the decision is received by him or her, appeal against the decision.

• (6) The court, on hearing an appeal under subsection (5), shall—

• (a) annul the decision concerned,

• (b) substitute its own determination for the decision, or

• (c) dismiss the appeal.

• (7) Where the Commission, being the competent supervisory authority in respect of a complaint within the meaning of Chapter 2 or 3, does not comply with section 108(2) or, as the case may be, section 121(2), the complainant concerned may apply to the court for an order under subsection (8)(a).

• (8) The court, on hearing an application under subsection (7), shall—

• (a) order the Commission to comply with the provision concerned, or

• (b) dismiss the application.

• (9) The Circuit Court shall, concurrently with the High Court, have jurisdiction to hear and determine proceedings under this section.

• (10) The jurisdiction conferred on the Circuit Court by this section shall be exercised by the judge for the time being assigned to the circuit where—

• (a) in the case of an appeal under subsection (1), the controller or processor is established,

• (b) in the case of an appeal under subsection (5), the data subject or other person resides or is established, or

• (c) in the case of an application under subsection (7), the data subject resides,

or, at the option of the controller, processor, data subject or person concerned, by a judge of the Circuit Court for the time being assigned to the Dublin circuit.

• (11) A decision of the Circuit Court or High Court, as the case may be, under this section shall be final save that an appeal shall lie to the High Court or Court of Appeal, as the case may be, on a point of law.

• (12) For the purposes of this section, a “legally binding decision” means a decision—

• F23[(a) under paragraph (a), (b) or (da) of section 109(5) or paragraph (a), (b) or (da) of section 122(4),]

• F23[(b) under section 111(1)(a), 112(1), 113(2)(b) or (6)(aa), 114, 124(1)(a) or 125(1), or]

• (c) to exercise a corrective power under Chapter 2 or 3.

151. Privileged legal material

151. (1) Where a controller or processor, when requested under this Part to produce information, or provide access to it, refuses to do so on the grounds that the information contains privileged legal material, the Commission or an authorised officer may, at any time within 28 days or such longer period as the High Court may allow of the date of such refusal, apply to the High Court for a determination as to whether the information, or any part of the information, is privileged legal material where—

• (a) in relation to the information concerned—

• (i) the Commission or authorised officer has reasonable grounds for believing that it is not privileged legal material, or

• (ii) due to the manner or extent to which such information is presented together with any other information, it is impossible or impractical to extract only such informa-tion,

and

• (b) the Commission or authorised officer has reasonable grounds to suspect that the information contains evidence relating to an infringement of a relevant enactment or a relevant provision.

• (2) A controller or processor referred to in subsection (1) who refuses to produce information or provide access to it on the grounds that the information contains privileged legal material shall preserve the information and keep it in a safe and secure place and manner pending the determination of an application under subsection (1) and shall, if the information is so determined not to be privileged legal material, produce it in accordance with such order as the High Court considers appropriate.

• (3) A person shall be considered to have complied with the requirement under subsection (2) to preserve information where the person has complied with such requirements as may be imposed by an authorised officer under paragraph (d) of section 130(1).

• (4) Where an application is made by the Commission or an authorised officer under subsection (1), the High Court may give such interim or interlocutory directions as it considers appropriate including, without prejudice to the generality of the foregoing, directions as to the appointment of a person with suitable legal qualifications possessing the level of experience and independence from any interest falling to be determined between the parties concerned, that the Court considers to be appropriate for the purpose of—

• (a) examining the information, and

• (b) preparing a report for the Court with a view to assisting or facilitating the Court in the making of its determination as to whether the information is privileged legal material.

• (5) An application under subsection (1) shall be by motion and may, if so directed, be heard otherwise than in public.

152. Presumptions

152. (1) The presumptions specified in this section shall apply in any proceedings under the Data Protection Regulation or this Act.

• (2) Where a document purports to have been created by a person it shall be presumed, unless the contrary is shown, that the document was created by that person and that any statement or record contained in it, unless the document expressly attributes its making to some other person, was made by that person.

• (3) Where a document purports to have been created by a person and addressed and sent to a second person, it shall be presumed, unless the contrary is shown, that the document or record was created and sent by the first person and received by the second person, and that any statement or record contained in it—

• (a) unless the document or record expressly attributes its making to some other person, was made by the first person, and

• (b) came to the notice of the second person.

• (4) Where a document or record is retrieved from an electronic storage and retrieval system, it shall be presumed, unless the contrary is shown, that the author of the document is the person who ordinarily uses that electronic storage and retrieval system in the course of his or her business.

• (5) Where an authorised officer who, in the exercise of his or her powers, has removed one or more documents or records from any premises or place, gives evidence in any proceedings that, to the best of his or her knowledge and belief, the material is the property of any person, then the material shall be presumed, unless the contrary is shown, to be the property of that person.

• (6) Where, in accordance with subsection (5), material is presumed in proceedings to be the property of a person and the authorised officer concerned gives evidence that, to the best of his or her knowledge and belief, the material is material which relates to any trade, profession, or, as the case may be, other activity, carried on by that person, the material shall be presumed, unless the contrary is proved, to be material which relates to that trade, profession, or, as the case may be, other activity, carried on by that person.

• (7) References in this section to a document or record are references to a document or record in written or electronic form and, for this purpose “written” includes any form of notation or code whether by hand or otherwise and regardless of the method by which, or medium in or on which, the document or record concerned is recorded.

153. Expert evidence

153. (1) In any proceedings under the Data Protection Regulation or this Act, the opinion of any witness who appears to possess the appropriate qualifications or experience as respects the matter to which his or her evidence relates shall, subject to subsection (2), be admissible in evidence as regards any matter calling for expertise or special knowledge that is relevant to the proceedings and, in particular and without prejudice to the generality of the foregoing, the following matters, namely—

• (a) the effects that types of data processing such as profiling may have, or have had, on the protection of personal data, and

• (b) an explanation of any relevant practices or the application of such practice, where such an explanation would assist the proceedings.

• (2) Notwithstanding subsection (1), a court may, where in its opinion the interests of justice require it to so direct in the proceedings concerned, direct that evidence of a general or specific kind referred to in that subsection shall not be admissible in proceedings or shall be admissible in such proceedings for specified purposes only.

154. Immunity from suit

154. Civil or criminal proceedings shall not lie in any court against the Commission, a Commissioner, an authorised officer or a member of the staff of the Commission in respect of anything said or done in good faith by the Commission, Commissioner, authorised officer or member of staff in the course of the performance or purported performance of a function of the Commission, Commissioner, authorised officer or member of staff.

155. Jurisdiction of Circuit Court

155. An application under section 138(4), 142(1), 143(1) or paragraph 5 of Schedule 3 shall be made to a judge of that Court for the circuit in which the person to whom the application relates ordinarily resides or, if a controller or processor, has an establishment or, at the option of the person, by a judge of the Circuit Court for the time being assigned to the Dublin circuit.

156. Hearing of proceedings

156. The whole or any part of any proceedings under this Part may, at the discretion of the court, be heard otherwise than in public.

PART 7 Miscellaneous Provisions

157. Supervisory authority for courts acting in judicial capacity

157. (1) The judge (“assigned judge”) for the time being assigned for that purpose by the Chief Justice shall be competent for supervision of data processing operations of the courts when acting in their judicial capacity.

• (2) The assigned judge shall, in particular—

• (a) promote awareness among judges of the provisions of the Data Protection Regulation, the Directive and any enactment, rule made under section 158(3) or other rule of law that gives further effect to the Data Protection Regulation or effect to the Directive, and ensure compliance with those provisions, and

• (b) handle, and investigate to the extent appropriate, complaints in relation to data processing operations of the courts when acting in their judicial capacity.

158. Restrictions on obligations of controllers and rights of data subjects for objective of safeguarding judicial independence and court proceedings

158. (1) The rights and obligations provided for in—

• (a) Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22, and

• (b) sections 87, 90, 91, 92 and 93, and section 71 in so far as it relates to those sections,

are restricted to the extent that the restrictions are necessary and proportionate to safeguard judicial independence and court proceedings.

• (2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.

• (3) Without prejudice to the generality of subsection (1), a panel may make such rules as it considers necessary for the purpose of ensuring the effective application of a restriction under that subsection.

• (4) Rules made under subsection (3) may relate to such matters as the panel considers appropriate for the purpose referred to in that subsection and, without prejudice to the generality of that subsection, may—

• (a) relate to one or more than one of the following:

• (i) a class or classes of data subject;

• (ii) a category or categories of personal data;

• (iii) civil or criminal proceedings, or both;

• (iv) a class or classes of civil or criminal proceedings, or both;

• (v) the circumstances in which, or the conditions under which, a restriction under subsection (1) shall apply,

• (b) include, where relevant, specific provisions as to the matters referred to in Article 23(2), and

• (c) make provision for such incidental, supplementary and consequential matters as appear to the panel to be necessary or expedient for the purposes of the rule.

• (5) Rules under subsection (3) shall be published in such manner (which may include publication on the website of the Courts Service) as the panel considers appropriate.

• (6) In this section, “panel” means a panel of three judges nominated by the Chief Justice for the purposes of this section.

159. Processing of personal data where court is controller

159. (1) The Superior Courts Rules Committee may make processing rules in respect of personal data that are contained in a record of a superior court of record.

• (2) The Circuit Court Rules Committee may make processing rules in respect of personal data that are contained in a record of the Circuit Court.

• (3) The District Court Rules Committee may make processing rules in respect of personal data that are contained in a record of the District Court.

• (4) The panel referred to in section 158(6) may make processing rules in respect of personal data—

• (a) that are not personal data to which subsection (1), (2) or (3) applies, and

• (b) in respect of which a court, when acting in its judicial capacity, is a controller.

• (5) Processing rules made under this section shall be binding on a processor of personal data in respect of which the rules are made.

• (6) Processing rules made under subsection (4) shall be published in such manner (which may include publication on the website of the Courts Service) as the panel referred to in that subsection considers appropriate.

• (7) Subject to subsection (8), a Committee referred to in subsection (1), (2) or (3) may make rules—

• (a) authorising the disclosure, for the purpose of facilitating the fair and accurate reporting of the proceedings, to a bona fide member of the Press or broadcast media and at the member’s request, of information contained in a record of proceedings before a court for which the Committee is the rule-making authority, and

• (b) prescribing any conditions subject to which such disclosure is to be made.

• (8) Rules made under subsection (7)—

• (a) shall not apply to proceedings required by law to be held otherwise than in public, and

• (b) shall apply subject to any order made or direction given by a court in the proceedings concerned.

• (9) In this section, “processing rules”, in relation to personal data, means rules made for the purposes of Article 28(3) of the Data Protection Regulation and Article 22(3) of the Directive, governing the processing by a processor of the personal data.

160. Publication of judgment or decision of court or court list

160. The processing of personal data shall be lawful where that processing—

• (a) consists of the publication of—

• (i) a judgment or decision of a court, or

• (ii) a list or schedule of court proceedings or hearings in court proceedings,

or

• (b) is necessary for the purposes of such publication.

161. Rules of court for data protection actions

161. (1) It shall be the function of the courts in data protection actions to ensure that parties to such actions comply with such rules of court as apply in relation to such actions so that the trial of data protection actions within a reasonable period of their having been commenced is secured.

• (2) Where rules of court prescribe a period of time for the service of a document, or the doing of any other thing, in relation to a data protection action, the period within which that document may be served or thing may be done, shall not be extended beyond the period so prescribed unless—

• (a) the parties to the action agree to the period being extended, or

• (b) the court considers that—

• (i) in all the circumstances the extension of the period by such further period as it may direct is necessary or expedient to enable the action to be properly prosecuted or defended, and

• (ii) the interests of justice require the extension of the period by that further period.

• (3) For the purposes of ensuring compliance by a party to a data protection action with rules of court, a court may make such orders as to the payment of costs as it considers appropriate.

• (4) Nothing in this section shall be construed as limiting or reducing the power of an authority, having (for the time being) power to make rules regulating the practice and procedure of a court, to—

• (a) make such rules in relation to data protection actions provided such rules do not derogate from, and are not inconsistent with, any provision of the Data Protection Regulation or this Act, or

• (b) make such rules in relation to proceedings or actions other than data protection actions.

• (5) In this section, “data protection action” means a data protection action under section 117 or section 128.

• (6) In subsections (1) and (2), a reference to the courts or the court includes a reference to the Master of the High Court and a county registrar.

162. Legal privilege

162. The rights and obligations provided for in—

• (a) Articles 12 to 22 and 34 of the Data Protection Regulation (as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22), and

• (b) sections 87, 90, 91, 92 and 93 and section 71, insofar as it relates to those sections,

do not apply—

• (i) to personal data processed for the purpose of seeking, receiving or giving legal advice,

• (ii) to personal data in respect of which a claim of privilege could be made for the purpose of or in the course of legal proceedings, including personal data consisting of communications between a client and his or her legal advisers or between those advisers, or

• (iii) where the exercise of such rights or performance of such obligations would constitute a contempt of court.

163. Application to High Court concerning adequate level of protection or appropriate safeguards

163. (1) The Commission, where it considers that a place to which personal data are to be transferred does not ensure an adequate level of protection, may apply to the High Court for a determination as to whether the level of protection ensured by the place is adequate.

• (2) An application under subsection (1) may be made notwithstanding that the place concerned is the subject of an implementing act pursuant to Article 45(3) of the Data Protection Regulation or, as the case may be, Article 36(3) of the Directive.

• (3) The Commission, where it considers that a standard data protection clause does not provide for appropriate safeguards, may apply to the High Court for a determination as to whether the standard data protection clause provides for appropriate safeguards.

• (4) For the purposes of this section, the adequacy of the level of protection referred to in subsection (1) shall be assessed in accordance with, as the case may be, Article 45(2) of the Regulation or Article 36(2) of the Directive.

• (5) In this section—

“place” means a third country, a territory or one or more specified sectors within a third country, or an international organisation;

“standard data protection clause” means a standard data protection clause to which point (c) or (d) of Article 46(2) of the Data Protection Regulation applies.

164. Court may order destruction, erasure of data

164. (1) Where a person is convicted of an offence under this Act, the court may order any personal data that appears to the court to be connected with the commission of the offence to be destroyed or erased.

• (2) The court shall not make an order under subsection (1) where it considers that a person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data concerned, unless such steps as are reasonably practic-able have been taken for notifying that person and giving him or her an opportunity to show cause why the order should not be made.

PART 8 Amendments of other Acts of Oireachtas

165. Reference to personal data in enactment

165. Subject to this Act, a reference in any enactment to personal data within the meaning of the Act of 1988 shall be construed as including a reference to personal data within the meaning of—

• (a) the Data Protection Regulation, and

• (b) Part 5.

166. Reference to processing in enactment

166. Subject to this Act, a reference in any enactment to processing within the meaning of the Act of 1988 shall be construed as including a reference to processing within the meaning of—

• (a) the Data Protection Regulation, and

• (b) Part 5.

167. Amendment of Firearms Act 1925

167. The Firearms Act 1925 is amended by the insertion of the following section after section 27A:

“Provision of information by Commissioner to Minister for purposes of Act and Firearms (Firearm Certificates For Non-Residents) Act 2000

27B. (1) The Minister may request the Commissioner to provide any information necessary for the performance of the Minister’s functions under sections 9, 10, 11 and 17 and under section 2 of the Firearms (Firearm Certificates For Non- Residents) Act 2000, and the Commissioner shall, notwithstanding anything

contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with that request.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

168. Amendment of section 33AK of Central Bank Act 1942

168. Section 33AK(5) of the Central Bank Act 1942 is amended—

• (a) in paragraph (az), by the substitution of “(S.I. No. 349 of 2016), or” for “(S.I. No. 349 of 2016).”,

• (b) by the insertion of the following paragraph:

• “(ba) to the Data Protection Commission that is required for the performance of that Commission's functions under the Data Protection Regulation or the Data Protection Acts 1988 to 2018.”,

and

• (c) by the insertion in subsection (10) of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹² on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”.

169. Amendment of section 2 of Civil Service Regulation Act 1956

169. Section 2(2) of the Civil Service Regulation Act 1956 is amended—

• (a) in paragraph (h), by the deletion of “and”,

• (b) in paragraph (i), by the substitution of “Síochána, and” for “Síochána.”, and

• (c) by the insertion of the following paragraph after paragraph (i):

“( j) in relation to a member of staff of the Data Protection Commission, the Commissioner for Data Protection or, where more than one Commissioner for Data Protection stands appointed, the chairperson (within the meaning of the Data Protection Act 2018).”.

170. Amendment of section 24 of Misuse of Drugs Act 1977

170. Section 24 of the Misuse of Drugs Act 1977 is amended—

• (a) in subsection (1)(c), by the substitution of “(including those containing any data that constitutes personal data)” for “(including any data within the meaning of the Data Protection Acts 1988 and 2003)”,

• (b) in subsection (2)(c), by the substitution of “(including those containing any data that constitutes personal data)” for “(including any data within the meaning of the Data Protection Acts 1988 and 2003)”, and

• (c) by the insertion of the following subsection after subsection (7):

• “(8) In this section—

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹³ on the protection of natural

persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of—

- (a) the Data Protection Regulation, or

- (b) *Part 5* of the *Data Protection Act 2018*.”.

171. Amendment of section 15A of Control of Clinical Trials Act 1987

171. Section 15A of the Control of Clinical Trials Act 1987 is amended—

• (a) by the substitution of the following paragraph for paragraph (d):

• “(d) inspect and copy or extract information from any data including data that constitutes personal data within the meaning of—

• (i) the Data Protection Regulation, or

• (ii) Part 5 of the Data Protection Act 2018.”,

and

• (b) the insertion of the following subsection after subsection (10):

• “(11) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

172. Amendment of Data Protection Act 1988

172. (1) The Act of 1988 is amended—

• (a) in section 24, by the substitution of the following subsection for subsection (1):

• “(1) In this section ‘authorised officer’ has the same meaning that it has in section 2(1) of the Data Protection Act 2018.”,

and

• (b) in section 26—

• (i) in subsection (1)—

• (I) in paragraph (b), by the substitution of “notice, and” for “notice”, and

• (II) by the deletion of paragraph (c),

and

• (ii) in subsection (4)—

• (I) in paragraph (a), by the substitution of “paragraph (a) or (b) of subsection (1) of this section” for “paragraph (a), (b) or (c) of subsection (1) of this section”, and

• (II) by the substitution of “with a requirement or prohibition specified in the notice” for “with a requirement or prohibition specified in the notice, or, as the case may be, a contravention by him of section 19 of this Act,”.

• (2) THE AMENDMENTS EFFECTED BY SUBSECTION (1) SHALL NOT APPLY FOR THE PURPOSES OF subsections (1)(b), (2) and (3) OF SECTION 8.

173. Amendment of Bankruptcy Act 1988

173. The Bankruptcy Act 1988 is amended by the insertion of the following section:

“Restriction of right of access to personal data in certain circumstances

140D. (1) Article 15 (Right of access) of the Data Protection Regulation is restricted to the extent necessary and proportionate to safeguard the effective performance by the Official Assignee of his or her functions under section 61, where the performance of those functions gives rise to the processing of personal data to which the Data Protection Regulation applies.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

174. Amendment of Firearms and Offensive Weapons Act 1990

174. The Firearms and Offensive Weapons Act 1990 is amended by the insertion of the following section after section 16:

“Provision of information by Commissioner to Minister

16A. (1) The Minister may request the Commissioner of the Garda Síochána to provide any information necessary for the performance of the Minister’s functions under sections 9C and 9E and the Commissioner shall, notwithstanding anything contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with that request.

• (2) In this section ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁶ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

175. Amendment of section 13A of Electoral Act 1992

175. Section 13A of the Electoral Act 1992 is amended by the insertion of the following subsection after subsection (3B):

• “(3C) In addition to any other electoral purpose for which the information contained in the register prepared under section 13, including a draft register or the supplement to the register prepared under section 15 or an electors list published under section 16, being information which is excluded from the edited register, may be used, that information may be used—

  • (a) by a specified person (within the meaning of section 39 of the Data Protection Act 2018), for the purpose of communicating with a data subject in accordance with section 39 of that Act, or

  • (b) by an elected representative (within the meaning of section 40 of the Data Protection Act 2018) for the purposes of section 40 of that Act.”.

176. Amendment of Comptroller and Auditor General (Amendment) Act 1993

176. The Comptroller and Auditor General (Amendment) Act 1993 is amended—

• (a) in section 10, by the substitution of the following subsection for subsection (3):

• “(3) In this section—

‘automated data’ means information that—

- (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or

- (b) is recorded with the intention that it should be processed by means of such equipment;

  ‘data’ means automated data and manual data;

  ‘data equipment’ means equipment for processing data;

  ‘data material’ means any document or other material used in connection with, or produced by, data equipment;

  ‘manual data’ means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;

  ‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;”,

and

• (b) by the insertion of the following section after section 18B:

“Application of this Act to the Data Protection Commission

18C. This Act applies to the Data Protection Commission as if it were a Department.”.

177. Amendment of section 8 of Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993

177. Section 8 of the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 is amended in subsection (1A) by the substitution of “the functions of the Data Protection Commission under section 10 of the Data Protection Act 1988 and Part 6 of the Data Protection Act 2018” for “the functions of the Data Protection Commissioner under section 10 of the Data Protection Act 1988”.

178. Amendment of section 24 of Statistics Act 1993

178. Section 24 of the Statistics Act 1993 is amended—

• (a) by the substitution of the following subsection for subsection (2):

• “(2) Without prejudice to the Data Protection Regulation and the Data Protection Act 2018, persons and undertakings may provide information and records, or copies thereof, which they may possess to the Director General or officers of statistics on invitation under the provisions of this Act.”,

and

• (b) by the insertion of the following subsection:

• “(3) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁷ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

179. Amendment of section 57B of Irish Aviation Authority Act 1993

179. Section 57B(1) of the Irish Aviation Authority Act 1993 is amended by the substitution of the following paragraph for paragraph (d):

• “(d) inspect, copy or extract information from any material (including information in any form) or thing found or produced to the authorised person.”.

180. Amendment of section 18F of Health Insurance Act 1994

180. Section 18F of the Health Insurance Act 1994 is amended—

• (a) in subsection (2)(d), by the substitution of “data (including data that constitutes personal data)” for “data (within the meaning of the Data Protection Acts 1988 and 2003)”, and

• (b) in subsection (12), by the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁸ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Data Protection Act 2018.”.

181. Amendment of section 142 of Consumer Credit Act 1995

181. Section 142 of the Consumer Credit Act 1995 is amended—

• (a) in subsection (2), by the substitution of the following paragraph for paragraph (b):

• “(b) which relates to information that constitutes personal data to which the Data Protection Regulation applies.”,

• (b) in subsection (4), by the substitution of the following paragraph for paragraph (b):

• “(b) which relates to information that constitutes personal data to which the Data Protection Regulation applies.”,

and

• (c) by the insertion of the following subsection after subsection (4):

• “(5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016¹⁹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

182. Amendment of section 32B of Irish Medicines Board Act 1995

182. Section 32B of the Irish Medicines Board Act 1995 is amended—

• (a) in subsection (3), by the substitution of the following paragraph for paragraph (l):

• “(l) inspect and copy or extract information from any data, including data that constitutes personal data within the meaning of—

• (i) the Data Protection Regulation, or

• (ii) Part 5 of the Data Protection Act 2018.”,

and

• (b) by the insertion of the following subsection after subsection (11):

• “(12) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁰ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

183. Amendment of section 77 of Central Bank Act 1997

183. Section 77 of the Central Bank Act 1997 is amended by the substitution of the following subsection for subsection (12):

• “(12) In this section—

‘automated data’ means information that—

- (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or

- (b) is recorded with the intention that it should be processed by means of such equipment;

  ‘data’ means automated data and manual data;

  ‘data equipment’ means equipment for processing data;

  ‘data material’ means any document or other material used in connection with, or produced by data equipment;

  ‘manual data’ means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;

  ‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.”.

184. Amendment of section 1 of Health (Provision of Information) Act 1997

184. The Health (Provision of Information) Act 1997 is amended by the substitution of the following section for section 1: