DATA PROTECTION ACT 2018

“Requests for and provision of information

1. (1) The National Cancer Registry Board (established under the Health (Corporate Bodies) Act 1961) may request from any person personal data (including data concerning health and genetic data within the meaning of the Data Protection Regulation) held by, or in the possession of, that person for the purposes of the performance of that Board of its functions.

• (2) Without prejudice to his or her obligations under the Data Protection Regulation and the Act of 2018, the person to whom a request is made under subsection (1) shall provide the personal data requested to the extent it is held by, or in the possession of, that person.

• (3) The Health Service Executive may, for the purposes of compiling and maintaining a record of the names, addresses, telephone numbers, e-mail addresses and dates of birth of persons who, for public health reasons, may be invited to participate in any cancer screening (including any breast, cervical or bowel cancer screening) programme operated by the Executive, request from any person the names, addresses, telephone numbers, e-mail addresses and dates of birth of persons held by, or in the possession of, that person.

• (4) Without prejudice to his or her obligations under the Data Protection Regulation and the Act of 2018, the person to whom a request is made under subsection

• (3) may provide that information to the extent it is held by, or in the possession of, that person.

• (5) In this section—

‘Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of the Data Protection Regulation.”.

185. Amendment of section 9M of Electricity Regulation Act 1999

185. Section 9M of the Electricity Regulation Act 1999 is amended—

• (a) in subsection (4), by the substitution of “the Data Protection Regulation or the Data Protection Act 2018” for “the Data Protection Acts 1988 and 2003”, and

• (b) by the insertion of the following subsection after subsection (10):

• “(11) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²² on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

186. Amendment of British-Irish Agreement Act 1999

186. Section 51 of the British-Irish Agreement Act 1999 is amended—

• (a) in subsection (1) by—

• (i) the substitution of the following definition for the definition of “Act of 1988”:

“ ‘Act of 1988’ means the Data Protection Act 1988, as amended by the Data Protection Act 2018;”,

and

• (ii) the substitution of the following definition for the definition of “established”:

“ ‘established’, in relation to a data controller or a data processor, shall be construed in accordance with section 1(3B)(b) of the Act of 1988;”,

and

• (b) by the deletion of subsection (6).

187. Amendment of section 7D of Comhairle Act 2000

187. Section 7D of the Comhairle Act 2000 is amended—

• (a) in subsection (3), by the substitution of “Subject to the Data Protection Regulation and the Data Protection Act 2018” for “Subject to the Data Protection Acts 1988 and 2003”, and

• (b) by the substitution of the following subsection for subsection (8):

• “(8) In this section—

‘application’, ‘assessment’ and ‘service statement’ have the meanings assigned to them respectively by Part 2 of the Disability Act 2005;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²³ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion).”.

188. Amendment of section 33 of Commission To Inquire Into Child Abuse Act 2000

188. The Commission To Inquire Into Child Abuse Act 2000 is amended by the substitution of the following section for section 33:

“33. (1) Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to safeguard the effective performance by the Commission of its functions or a Committee of its functions, in so far as it relates to personal data (within the meaning of that Regulation) provided to the Commission or a Committee while the data is in the custody of the Commission or a Committee, or in the case of such data provided to the Confidential Committee, of a body to which it is transferred by the Commission upon the dissolution of the Commission.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

189. Amendment of section 2 of Merchant Shipping (Investigation of Marine Casualties) Act 2000

189. Section 2(1) of the Merchant Shipping (Investigation of Marine Casualties) Act 2000 is amended in the definition of “record” by the deletion of the words “any form in which data (within the meaning of the Data Protection Act 1988) are held,”.

190. Amendment of section 28 of Education (Welfare) Act 2000

190. Section 28 of the Education (Welfare) Act 2000 is amended—

• (a) by the substitution of “controller” for “data controller” in each place it occurs, and

• (b) in subsection (3), by the deletion of “ ‘data controller’ and ‘personal data’ have the meanings assigned to them by the Data Protection Act 1988” and the insertion of the following:

“ ‘controller’ means a controller within the meaning of the Data Protection Regulation;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of the Data Protection Regulation;”.

191. Amendment of section 38 of Planning and Development Act 2000

191. Section 38 of the Planning and Development Act 2000 is amended in subsection (2) by the deletion of “and the Data Protection Acts 1988 and 2003”.

192. Amendment of section 14 of Dormant Accounts Act 2001

192. Section 14(5) of the Dormant Accounts Act 2001 is amended by the substitution of the following paragraph for paragraph (b):

• “(b) Nothing in paragraph (a) shall be construed as restricting the right of a person to inspect the register, in relation to an account, where the person—

  • (i) proves to the satisfaction of an institution that he or she is, or may be, the account holder,

  • (ii) proves to the satisfaction of an institution that he or she is authorised by the account holder to so inspect, or

  • (iii) may act on behalf of the account holder in relation to that account pursuant to regulations made under section 9.”.

193. Amendment of section 30 of Residential Institutions Redress Act 2002

193. The Residential Institutions Redress Act 2002 is amended by the substitution of the following section for section 30:

“30. (1) Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to safeguard the effective performance by the Board of its functions and the Review Committee of its functions, in so far as it relates to personal data (within the meaning of that Regulation) provided to the Board while the data is in the custody of the Board or the Review Committee.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁶ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

194. Amendment of section 2 of Official Languages Act 2003

194. Section 2(1) of the Official Languages Act 2003 is amended—

• (a) in the Irish text, in the definition of “taifead”, by the substitution of “aon fhoirm ina gcoimeádtar sonraí (lena n-áirítear foirm mheaisín-inléite) nó rud” for “aon fhoirm ina gcoimeádtar sonraí (de réir bhrí an Achta um Chosaint Sonraí 1988), aon fhoirm eile (lena n-áirítear foirm mheaisín-inléite) nó rud eile” and

• (b) in the English text, in the definition of “record”, by the substitution of “any form in which data are held (including machine-readable form)” for “any form in which data (within the meaning of the Data Protection Act 1988) are held, any other form (including machine-readable form)”.

195. Amendment of section 86 of Personal Injuries Assessment Board Act 2003

195. Section 86 of the Personal Injuries Assessment Board Act 2003 is amended—

• (a) in subsection (1), by the substitution of “but only if the processing (within the meaning of the Data Protection Regulation) of any particulars constituting personal data (within the meaning of that Regulation) in the database is in accordance with the Data Protection Regulation and the Data Protection Act 2018.” for “but only if the database is, for the time being, maintained in accordance with the Data Protection Act 1988”, and

• (b) by the insertion of the following subsection after subsection (4):

• “(5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁷ on the

protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

196. Amendment of section 12 of Unclaimed Life Assurance Policies Act 2003

196. Section 12(5) of the Unclaimed Life Assurance Policies Act 2003 is amended by the substitution of the following paragraph for paragraph (b):

• “(b) Nothing in paragraph (a) shall be construed as restricting the right of a person to inspect the register in relation to a policy where the person—

  • (i) proves to the satisfaction of an insurance undertaking that he or she is, or may be, the policy holder,

  • (ii) proves to the satisfaction of an insurance undertaking that he or she is authorised by the policy holder to so inspect, or

  • (iii) may act on behalf of the policy holder in relation to that policy pursuant to regulations made under section 7.”.

197. Amendment of section 66 of Civil Registration Act 2004

197. Section 66 of the Civil Registration Act 2004 is amended—

• (a) in subsection (1), by the substitution of “Notwithstanding anything contained in any other enactment, but subject to the Data Protection Regulation and the Data Protection Act 2018, an tArd-Chláraitheoir may” for “Notwithstanding anything contained in the Data Protection Acts 1988 to 2003 or any other enactment, an tArd-Chláraitheoir may”, and

• (b) by the substitution of the following subsection for subsection (2):

• “(2) In this section—

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁸ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘information’ includes personal data;

‘personal data’ means personal data within the meaning of—

- (a) the [Data Protection Act 1988](https://www.irishstatutebook.ie/eli/1988/act/25),

- (b) the Data Protection Regulation, or

- (c) *Part 5* of the *Data Protection Act 2018*.”.

198. Amendment of section 39 of Commissions of Investigation Act 2004

198. Section 39 of the Commissions of Investigation Act 2004 is amended—

• (a) by designating the section as subsection (1),

• (b) in that designated subsection (1), by the substitution of “Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and propor-tionate to safeguard the effective operation of commissions and the future cooperation of witnesses, in so far as it relates to personal data (within the meaning of that Regulation) provided to a commission” for “Section 4 of the Data Protection Act 1988 does not apply to personal data provided to a commission”, and

• (c) by the insertion of the following subsection after subsection (1):

• “(2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

199. Amendment of section 55H of Health Act 2004

199. Section 55H of the Health Act 2004 is amended—

• (a) in subsection (8), by the substitution of the following paragraph for paragraph (a):

• “(a) submit a draft of the proposed procedures to the Data Protection Commission for its opinion as to whether any provision of the procedures would, if given effect, be likely to result in a contravention of the Data Protection Regulation or the Data Protection Act 2018, and”,

• (b) in subsection (9), by the substitution of “the Data Protection Commission” for “the Data Protection Commissioner”, and

• (c) by the insertion of the following subsection after subsection (9):

• “(10) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁰ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

200. Amendment of section 2 of Safety, Health and Welfare at Work Act 2005

200. Section 2(1) of the Safety, Health and Welfare at Work Act 2005 is amended—

• (a) by the substitution of the following definition for the definition of “record”:

“ ‘record’ includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data within the meaning of the Data Protection Regulation or Part 5 of the Data Protection Act 2018) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing;”,

and

• (b) by the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”.

201. Amendment of section 265 of Social Welfare Consolidation Act 2005

201. Section 265 of the Social Welfare Consolidation Act 2005 is amended—

• (a) in subsection (1)—

• (i) by the substitution of the following definitions for the definitions of “data controller” and “personal data”:

“ ‘controller’ means a controller within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;

‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

and

• (ii) by the insertion of the following definitions:

“ ‘Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³² on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

and

• (b) in subsection (2), by the substitution of “controller” for “data controller”.

202. Amendment of Disability Act 2005

202. The Disability Act 2005 is amended—

• (a) in section 12, by the deletion of subsection (3),

• (b) in section 13, by the deletion of subsection (4),

• (c) in section 41—

• (i) by the deletion of the definition of “the Acts”,

• (ii) by the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of the Data Protection Regulation;”,

and

• (iii) by the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³³ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (d) in section 42—

• (i) by the substitution, in subsection (1)(b), of “the Data Protection Regulation”, for “the Acts”,

• (ii) by the deletion, in subsection (2)(a), of “save in accordance with the provisions of section 12A of the Data Protection Act 1988 (as inserted by the Data Protection (Amendment) Act 2003”,

• (iii) by the substitution of the following subsection for subsection (4):

• “(4) A person who contravenes subsection (2) or (3) shall be guilty of an offence and shall be liable—

  • (a) on summary conviction, to a class A fine, or

  • (b) on conviction on indictment, to a fine not exceeding €100,000.”,

and

• (iv) by the insertion of the following subsections:

• “(5) Where a person is convicted of an offence under subsection (4), the court may order any personal data that appears to the court to be connected with the commission of the offence to be destroyed or erased.

• (6) The court shall not make an order under subsection (5) where it considers that a person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data concerned, unless such steps as are reasonably practicable have been taken for notifying that person and giving him or her an opportunity to show cause why the order should not be made.”,

• (e) by the deletion of section 43, and

• (f) in section 45, by the deletion of subsection (1).

203. Amendment of section 2 of Railway Safety Act 2005

203. Section 2(1) of the Railway Safety Act 2005 is amended in the definition of “record” by the deletion of the words “in which data (within the meaning of the Data Protection Act 1988) are held, any other form”.

204. Amendment of section 12 of Health (Repayment Scheme) Act 2006

204. Section 12(3) of the Health (Repayment Scheme) Act 2006 is amended by the substitu-tion of “except after consultation with the Data Protection Commission” for “except after consultation with the Data Protection Commissioner within the meaning of the Data Protection Acts 1988 and 2003”.

205. Amendment of section 19 of Electoral (Amendment) Act 2006

205. Section 19 of the Electoral (Amendment) Act 2006 is amended by the substitution of “A registration authority may,” for “Notwithstanding anything in the Data Protection Acts 1988 and 2003, a registration authority may,”.

206. Amendment of section 67 of Pharmacy Act 2007

206. Section 67 of the Pharmacy Act 2007 is amended—

• (a) in subsection (3), by the substitution of the following paragraph for paragraph (l):

• “(l) inspect and copy or extract information from any data, including data that constitutes personal data within the meaning of—

• (i) the Data Protection Regulation, or

• (ii) Part 5 of the Data Protection Act 2018.”,

and

• (b) by the insertion of the following subsection after subsection (12):

• “(13) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

207. Amendment of Passports Act 2008

207. The Passports Act 2008 is amended—

• (a) in section 2, by—

• (i) the deletion of the definitions of “Act of 1988”, “automated data” and “data”,

• (ii) the insertion of the following definition:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

• (iii) the substitution of the following definition for the definition of “biometric data”:

“ ‘biometric data’ means biometric data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

• (iv) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (v) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

and

• (vi) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018.”,

• (b) in section 8, by the substitution in subsection (1) of “Subject to the Data Protection Regulation and the Act of 2018” for “Subject to the Data Protection Acts 1988 and 2003”, and

• (c) in section 21(1)(b), by the substitution of “personal data” for “data” in each place it occurs.

208. Amendment of Criminal Justice (Mutual Assistance) Act 2008

208. The Criminal Justice (Mutual Assistance) Act 2008 is amended—

• (a) in section 76(1), by the insertion of the following definition:

“ ‘controller’ means a controller within the meaning of Part 5 of the Data Protection Act 2018;”,

• (b) in section 79C(7), by the insertion of “or, as the case may be, controller” after “data controller” in each place it occurs,

• (c) in section 94, by—

• (i) the substitution of the following subsections for subsections (5) and (6):

• “(5) Article 7, in its application in relation to the use of personal data contained in evidence or information obtained under the Treaty by a person in the State, is without prejudice to the application of—

  • (a) subject to section 8 of the Act of 2018, section 7 (duty of care owed by data controllers and data processors) of the Act of 1988 in respect of the use of such data (within the meaning of the Act of 1988), and

  • (b) Part 5 of the Act of 2018, in respect of the use of such data (within the meaning of that Part).

• (6)

  • (a) Subject to section 8 of the Act of 2018, the Data Protection Acts 1988 and 2003 apply in relation to personal data referred to in subsection (5)(a), in respects other than those related to their use.

  • (b) Part 5 of the Act of 2018 applies in relation to personal data referred to in subsection (5)(b), in respects other than those related to their use.”,

and

• (ii) the insertion of the following subsection:

• “(8) In this section—

‘Act of 1988’ means the Data Protection Act 1988;

‘Act of 2018’ means the Data Protection Act 2018.”,

and

• (d) in section 107, by—

• (i) the substitution of the following subsections for subsections (2) and (3):

• “(2) Subsection (1) is without prejudice to the application of—

  • (a) subject to section 8 of the Act of 2018, section 7 (duty of care owed by data controllers and data processors) of the Act of 1988 in respect of the use of such data (within the meaning of the Act of 1988), and

  • (b) Part 5 of the Act of 2018, in respect of the use of such data (within the meaning of that Part).

• (3)

  • (a) Subject to section 8 of the Act of 2018, the Data Protection Acts 1988 and 2003 apply in relation to personal data referred to in subsection (2)(a), in respects other than those related to their use.

  • (b) Part 5 of the Act of 2018 applies in relation to personal data referred to in subsection (5)(b), in respects other than those related to their use.”,

and

• (ii) by the insertion of the following subsection after subsection (4):

• “(5) In this section—

‘Act of 1988’ means the Data Protection Act 1988;

‘Act of 2018’ means the Data Protection Act 2018.”.

209. Amendment of section 2 of Chemicals Act 2008

209. Section 2(1) of the Chemicals Act 2008 is amended by—

• (a) the substitution of the following definition for the definition of “record”—

“ ‘record’ includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data within the meaning of the Data Protection Regulation or Part 5 of the Data Protection Act 2018) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing;”,

and

• (b) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁶ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”.

210. Amendment of Nursing Homes Support Scheme Act 2009

210. The Nursing Homes Support Scheme Act 2009 is amended—

• (a) in section 26, by the deletion of subsection (12), and

• (b) in section 45(1), by the substitution of “Subject to the Data Protection Regulation and the Data Protection Act 2018” for “Notwithstanding any provision of the Data Protection Acts 1988 to 2003”.

211. Amendment of section 23 of Criminal Justice (Miscellaneous Provisions) Act 2009

211. Section 23 of the Criminal Justice (Miscellaneous Provisions) Act 2009 is amended by the substitution of the following subsections for subsection (2):

• “(2) The Data Protection Act 1988 shall, subject to any necessary modifications, apply and have effect in relation to the processing (within the meaning of that Act) of personal data (within the meaning of that Act) for the purposes of the operation of the Council Decision and the Schengen Convention.

• (3) The Data Protection Act 2018 shall, subject to any necessary modifications, apply and have effect to the processing (within the meaning of Part 5 of that Act) of personal data (within the meaning of that Part) for the purposes of the operation of the Council Decision and the Schengen Convention.”.

212. Amendment of section 201 of National Asset Management Agency Act 2009

212. The National Asset Management Agency Act 2009 is amended by the substitution of the following section for section 201:

“201. (1) For the avoidance of doubt, an obligation on a credit institution or any other person under this Act to disclose information to NAMA, a NAMA group entity or the NTMA extends to personal data within the meaning of the Data Protection Regulation.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁷ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

213. Amendment of Criminal Justice (Money Laundering and Terrorist Financing) Act 2010

213. The Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 is amended—

• (a) in section 2(1), by the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁸ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of—

• (i) the Data Protection Act 1988,

• (ii) the Data Protection Regulation, or

• (iii) Part 5 of the Data Protection Act 2018;”,

• (b) in section 52(2), by the deletion of “(within the meaning of the Data Protection Acts 1988 and 2003)”, and

• (c) in section 88(2), by the deletion of “(within the meaning of the Data Protection Acts 1988 and 2003)”.

214. Amendment of section 12 of Communications (Retention of Data) Act 2011

214. Section 12 of the Communications (Retention of Data) Act 2011 is amended by the substitution of the following subsections for subsection (4):

• “(4) The designated judge may, if he or she considers it desirable to do so, communicate with the Taoiseach or the Minister concerning disclosure requests and with the Data Protection Commission in connection with its functions under the Data Protection Regulation and the Data Protection Acts 1988 to 2018.

• (5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

215. Amendment of section 17A of Ministers and Secretaries (Amendment) Act 2011

215. Section 17A of the Ministers and Secretaries (Amendment) Act 2011 is amended—

• (a) in subsection (2), by the substitution of “Data Protection Regulation” for “Data Protection Acts 1988 and 2003”, and

• (b) by the insertion of the following subsection after subsection (3):

• “(4) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁰ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

216. Amendment of section 28 of Student Support Act 2011

216. Section 28 of the Student Support Act 2011 is amended—

• (a) by the substitution of “controller” for “data controller” in each place it occurs,

• (b) in subsection (1), by the substitution of “Notwithstanding anything contained in any enactment (other than the Act of 2018)” for “Notwithstanding anything contained in the Data Protection Acts 1988 and 2003 or any other enactment”, and

• (c) in subsection (5), by—

• (i) the substitution of the following definitions for the definition of “data controller”:

“ ‘Act of 2018’ means the Data Protection Act 2018;

‘controller’ means a controller within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (ii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

and

• (iii) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing with the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”.

217. Amendment of Communications Regulation (Postal Services) Act 2011

217. The Communications Regulation (Postal Services) Act 2011 is amended—

• (a) in section 65A(1), by—

• (i) the deletion of the definition of “Act of 1988”,

• (ii) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴² on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (iii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of the Data Protection Regulation;”,

and

• (iv) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of the Data Protection Regulation;”,

• (b) in section 66A(2), by the deletion of paragraph (a), and

• (c) in section 66C—

• (i) in subsection (1), by the substitution of “the Data Protection Regulation and the Data Protection Act 2018” for “the Data Protection Acts 1988 to 2003”, and

• (ii) by the substitution of the following subsection for subsection (2):

• “(2) Article 21 (Right to object) of the Data Protection Regulation shall not apply to processing of personal data that is required for the purposes of carrying out legitimate postcode activity.”.

218. Amendment of Property Services (Regulation) Act 2011

218. The Property Services (Regulation) Act 2011 is amended—

• (a) in section 2(1), by the insertion of the following definition after the definition of “connected relative”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴³ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (b) in section 42, by the substitution of the following subsection for subsection (2):

• “(2) The Commissioner of the Garda Síochána shall, notwithstanding anything contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with a request under subsection (1).”,

and

• (c) by the substitution of the following section for section 93:

“Restriction of right of access to personal data in certain circumstances

93. Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to enable the Authority to effectively perform its functions under this Act in so far as the functions relate to carrying out an investigation, in so far as it relates to personal data (within the meaning of that Regulation) processed by the Authority.”.

219. Amendment of section 56 of Credit Union and Co-operation with Overseas Regulators Act 2012

219. Section 56 of the Credit Union and Co-operation with Overseas Regulators Act 2012 is amended—

• (a) by the substitution of the following subsection for subsection (2):

• “(2) A credit union may disclose to ReBo personal data within the meaning of the Data Protection Regulation.”,

and

• (b) by the insertion of the following subsection after subsection (3):

• “(4) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

220. Amendment of Europol Act 2012

220. Section 1 of the Europol Act 2012 is amended by—

• (a) the substitution of the following definition for the definition of “data”:

“ ‘data’ means automated data and manual data;”,

• (b) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ has the meaning it has in Part 5 of the Data Protection Act 2018;”,

• (c) by the substitution of the following definition for the definition of “processing”:

“ ‘processing’, in relation to personal data, has the meaning it has in Part 5 of the Data Protection Act 2018;”,

and

• (d) the insertion of the following definitions:

“ ‘automated data’ means information that—

• (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or

• (b) is recorded with the intention that it should be processed by means of such equipment;

‘manual data’ means information that is recorded as part of a relevant filing system, or with the intention that it should form part of a relevant filing system;

‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;”.

221. Amendment of Personal Insolvency Act 2012

221. The Personal Insolvency Act 2012 is amended—

• (a) in section 2(1), by—

• (i) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

and

• (ii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Data Protection Act 2018;”,

• (b) by the deletion of section 21A, and

• (c) by the substitution of the following section for section 186:

“Restriction of right of access to personal data in certain circumstances

186. Article 15 (Right of access) of the Data Protection Regulation, in so far as it relates to personal data (within the meaning of that Regulation) processed by the following persons or bodies, is restricted to the extent necessary and proportionate to enable the person or body to effectively perform his, her or its functions under this Act, in so far as those functions relate to the supervision of personal insolvency practitioners in accordance with section 176A or to carrying out an investigation under this Part:

• (a) the Insolvency Service;

• (b) an inspector appointed under section 176;

• (c) an authorised officer appointed under section 176B;

• (d) the Complaints Committee.”.

222. Amendment of section 2 of Animal Health and Welfare Act 2013

222. Section 2(1) of the Animal Health and Welfare Act 2013 is amended, in the definition of “record”, by the deletion of “(within the meaning of the Data Protection Acts 1988 and 2003)”.

223. Amendment of section 8 of Health (Alteration of Criteria for Eligibility) Act 2013

223. Section 8 of the Health (Alteration of Criteria for Eligibility) Act 2013 is amended—

• (a) in subsection (4), by the substitution of “Subject to compliance with the Data Protection Regulation and the Act of 2018 and subject to this section” for “Notwith-standing anything contained in the Data Protection Acts 1988 and 2003, but subject to this section”,

• (b) in subsection (7), by the substitution of “the Data Protection Commission” for “the Data Protection Commissioner”,

• (c) by the deletion of subsection (8),

• (d) in subsection (9), by the substitution of “references in this section to personal data shall include references to special categories of personal data (within the meaning of section 2 of the Act of 2018)” for “references in this section to personal data shall include references to sensitive personal data”, and

• (e) by the substitution of the following subsection for subsection (10):

• “(10) In this section—

‘Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁶ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of the Data Protection Regulation.”.

224. Insertion of section 957A to Companies Act 2014

224. The Companies Act 2014 is amended by the insertion of the following section after section 957:

“Restriction of application of certain articles of Data Protection Regulation

957A. (1) Articles 14 (Information to be provided where personal data have not been obtained from the data subject) and 15 (Right of access by the data subject) of the Data Protection Regulation are restricted, to the extent necessary and proportionate to safeguard the effective performance by the Director of his or her functions referred to in paragraph (b) and (e) of section 949(1), where the performance of those functions give rise to the processing of personal data to which the Data Protection Regulation applies.

• (2) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁷ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

225. Amendment of Health Identifiers Act 2014

225. The Health Identifiers Act 2014 is amended—

• (a) in section 2(1)—

• (i) by the insertion of the following definition after the definition of “Act of 2013”:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

• (ii) by the insertion of the following definition after the definition of “conditions”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁸ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (iii) by the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

• (iv) by the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Act of 2018;”,

• (v) in paragraph (g)(iii) of the definition of “secondary purpose”, by the substitution of “in accordance with the Data Protection Regulation and the Act of 2018” for “in accordance with the Data Protection Acts 1988 and 2003”,

and

• (b) by the substitution of the following Part for Part 6:

“PART 6

Application of Data Protection Regulation

Application of Data Protection Regulation

27. Article 32 of the Data Protection Regulation shall apply to a deceased individual’s relevant information (individual) as it applies to a living individual’s relevant information (individual).”.

226. Amendment of section 15 of Freedom of Information Act 2014

226. Section 15 of the Freedom of Information Act 2014 is amended—

• (a) by the substitution of the following subsection for subsection (3):

• (3) A record shall not be within subsection (2) by reason only of the fact that it contains information constituting—

• (a) personal data within the meaning of the Data Protection Act 1988 to which that Act applies,

• (b) personal data within the meaning of the Data Protection Regulation to which that Regulation and the Act of 2018 apply, or

• (c) personal data within the meaning of Part 5 of the Act of 2018 to which that Act applies.

and

• (b) by the insertion of the following subsection after subsection (4):

• “(5) In this section—

‘Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴⁹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion).”.

227. Amendment of section 41 of Customs Act 2015

227. Section 41 of the Customs Act 2015 is amended by the deletion of subsections (4), (5) and (10).

228. Amendment of section 7 of Regulation of Lobbying Act 2015

228. Section 7 of the Regulation of Lobbying Act 2015 is amended—

• (a) by the insertion of the following definition after the definition of “Commission”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵⁰ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

and

• (b) by the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

• (a) the Data Protection Regulation, or

• (b) Part 5 of the Data Protection Act 2018.”.

229. Amendment of Sport Ireland Act 2015

229. The Sport Ireland Act 2015 is amended—

• (a) in section 40, by—

• (i) the insertion of the following definition before the definition of “anti-doping organisation”:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

• (ii) the insertion of the following definition after the definition of “anti-doping rule violation”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);”,

• (iii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of the Data Protection Regulation;”,

and

• (iv) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of the Data Protection Regulation;”,

• (b) in section 42(4), by the substitution of “Subject to compliance with the Data Protection Regulation and the Act of 2018, Sport Ireland shall” for “Sport Ireland shall”, and

• (c) in section 43—

• (i) in subsection (1), by the substitution of “Data Protection Regulation and the Act of 2018” for “Data Protection Acts 1988 and 2003”, and

• (ii) by the deletion of subsection (3).

230. Amendment of section 12 of Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016

230. Section 12 of the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 is amended—

• (a) by designating the section as subsection (1),

• (b) in that designated subsection (1), by the deletion of “(within the meaning of the Data Protection Act 1988)”, and

• (c) by the insertion of the following subsection after subsection (1):

• “(2) In this section—

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵² on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion);

‘personal data’ means personal data within the meaning of—

- (a) the [Data Protection Act 1988](https://www.irishstatutebook.ie/eli/1988/act/25),

- (b) the Data Protection Regulation, or

- (c) *Part 5* of the *Data Protection Act 2018*.”.

231. Amendment of section 62 of Financial Services and Pensions Ombudsman Act 2017

231. Section 62 of the Financial Services and Pensions Ombudsman Act 2017 is amended—

• (a) in subsection (2), by the substitution of the following paragraph for paragraph (b):

• “(b) ensures compliance with the Data Protection Regulation and the Data Protection Act 2018.”,

and

• (b) by the insertion of the following subsection after subsection (4):

• “(5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵³ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.

232. Amendment of National Shared Services Office Act 2017

232. The National Shared Services Office Act 2017 is amended—

• (a) in section 2, by the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁵⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regula-tion).”,

• (b) in section 9(2)(a)(iv), by the substitution of “processing (within the meaning of the Data Protection Regulation) personal data (also within the meaning of that Regulation)” for “processing (within the meaning of the Data Protection Act 1988) personal data (also within the meaning of that Act)”, and

• (c) in section 35—

• (i) in subsection (1)—

• (I) by the substitution of “Notwithstanding anything contained in any enactment, but subject to the Data Protection Regulation and the Data Protection Act 2018” for “Notwithstanding anything contained in the Data Protection Acts 1988 and 2003”, and

• (II) by the substitution of “controller” for “data controller” in each place it occurs,

• (ii) in subsection (3), by the substitution of “controller” for “data controller”, and

• (iii) in subsection (4)—

• (I) by the substitution of the following definition for the definition of “data controller”:

“ ‘controller’ has the same meaning as it has in the Data Protection Regulation;”,

and

• (II) by the deletion of the definition of “data subject”.

SCHEDULE 1 Statutory Instruments Revoked

Section 7(3)

Item S.I. No. Short Title Extent of and Revoca- (1) Year (3) tion

• (2) (4)

Item S.I. No. Short Title Extent of and Revoca- (1) Year (3) tion

• (2) (4)

SCHEDULE 2 Data Protection Commission

Section 10

• (a) a Commissioner, and

• (b) a member of staff of the Commission authorised by the Commission for that purpose.

• (a) nominated as a member of Seanad Éireann,

• (b) elected as a member of either House of the Oireachtas or to be a member of the European Parliament,

• (c) regarded pursuant to Part XIII of the Second Schedule to the European Parliament Elections Act 1997 as having been elected to that Parliament, or

• (d) is elected or co-opted as a member of a local authority,

he or she shall thereupon cease to be a Commissioner.

• (2) A person who is for the time being—

• (a) entitled under the Standing Orders of either House of the Oireachtas to sit therein,

• (b) a member of the European Parliament, or

• (c) entitled under the standing orders of a local authority to sit as a member thereof,

shall, while he or she is so entitled as mentioned in clause (a) or (c) or is such a member as mentioned in clause (b), be disqualified for membership of the Commission or for employment in any capacity by the Commission.

SCHEDULE 3 Provisions Applicable to Oral Hearing Conducted by an Authorised Officer Under Section 138

Section 138(11)

Provisions Applicable to Oral Hearing Conducted by an Authorised Officer Under Section 138

Footnotes