S.I. No. 658/2018 - Data Protection Act 2018 (Section 158(3)) Rules 2018

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 26th April, 2019.

We, being the panel nominated by the Chief Justice pursuant to section 158 (6) of the Data Protection Act 2018 , by virtue of the powers conferred on us by section 158 (3) of the Data Protection Act 2018 , and being satisfied:

• (i) that it is necessary to make Rules for the purpose of ensuring the effective application of restrictions of the rights and obligations provided for in—

• (a) Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22, and

• (b) sections 87, 90, 91, 92 and 93, and section 71 in so far as it relates to those sections;

and

• (ii) that such restrictions, as applied by the Rules hereinafter mentioned, are necessary and proportionate to safeguard judicial independence and court proceedings,

do hereby make the following Rules.

Dated this 18^th day of July 2018.

John A. Edwards

David Barniville

Marie Quirke

Citation and entry into force

1.

• (i) come into operation on, and

• (ii) apply to the processing of personal data referred to in rule 3 which takes place on or after,

the 1^st day of August 2018.

Interpretation

2.

“2018 Act” means the Data Protection Act 2018 ;

“Assigned Judge” means the judge, appointed by the Chief Justice, competent for supervision of data processing operations of the Courts when acting in their judicial capacity, in accordance with section 157(1) of the 2018 Act;

“court record” includes any document or other material issued or received by a court and forming part of the file or record of the proceedings before the court but does not include notes taken by or for a judge, or communications with, by or on behalf of a judge performing a judicial function in respect of such proceedings and not intended by the judge to form part of such file or record;

“Courts Service” means the body established by section 4(1) of the Courts Service Act 1998 ;

“Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“proceedings” means proceedings before a court, and “civil proceedings” and “criminal proceedings” shall be construed accordingly.

• (2) In these Rules, save as expressly provided otherwise, terms defined in the Data Protection Regulation shall have the meanings given to them in the Data Protection Regulation.

Scope

3.

• (i) personal data

• (a) delivered to or by a court, judge, court office or court officer, or

• (b) held by a court, judge, court office or court officer, or

• (c) issued by a court, judge, court office or court officer,

for the purposes of or in connection with proceedings, or the performance of a judicial function, or (as the case may be) the performance by a court officer in civil proceedings of limited functions of a judicial nature conferred on that officer by law, and which forms or will form part of a court record; and

• (ii) personal data created or held by

• (a) a judge or a court officer or other person performing functions under the direction of a judge, or

• (b) a court officer performing limited functions of a judicial nature conferred on that officer by law or a court officer or other person performing functions under the direction of such officer,

for the purposes of or in connection with proceedings, or the performance of a judicial function, or (as the case may be) the performance in civil proceedings of limited functions of a judicial nature conferred by law, and which does not form part of a court record.

Restrictions

4.

Provision of Information

5.

Where personal data are collected from the data subject

Article 13.1 (a) of the Data Protection Regulation and section 90(2)(a) of the 2018 Act

• (i) the identity of the controller, being the Supreme Court, the Court of Appeal, the High Court, the Circuit Court, the District Court or a Special Criminal Court, as the case may be;

Article 13.1 (c) of the Data Protection Regulation and section 90(2)(c) and (f) of the 2018 Act

• (ii) that personal data are processed by and on behalf of the courts for the purposes of the performance by the courts of their functions under the Constitution and law, as interpreted in the decisions of the courts, and the fact that the legal basis for such processing is provided for in the Constitution, in statute, (principally but without limitation the Courts of Justice Acts 1924 to 2014, the Courts (Supplemental Provisions) Acts 1961 to 2017 and, in the case of a Special Criminal Court, Part V of the Offences against the State Act 1939 ) and otherwise in law;

Article 13.1 (e) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (iii) that material comprised in a court record may be made available to a party to the proceedings concerned (or to that party’s legal representative) or to another person

• (a) where statute (other than the 2018 Act) or rules of court so require or permit, or

• (b) if applicable, where the practice of the court so permits, or

• (c) for the purpose of facilitating the fair and accurate reporting of a hearing in the proceedings, to a bona fide member of the Press or broadcast media at the member’s request in accordance with section 159(7) of the 2018 Act and rules made thereunder,

and that in accordance with the requirements of Article 34 of the Constitution, proceedings are generally held in public save in such special and limited cases as may be prescribed by law;

Article 13.1 (f) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (iv) that material comprised in a court record may in certain circumstances (including, without limitation, in matters of judicial co-operation and criminal justice mutual assistance and where the transcription of digital audio records of proceedings is carried out for the Courts Service in a third country) be transferred to a third country and that where same occurs in the absence of an adequacy decision pursuant to Article 45.3 of the Data Protection Regulation, the appropriate or suitable safeguards pursuant to Article 46 of the Data Protection Regulation which have been provided and the means by which to obtain a copy of them or where they have been made available;

Article 13.2 (a) of the Data Protection Regulation and section 90(2)(f)(ii) of the 2018 Act

• (v) that a court record is, by virtue of section 1(2) of the National Archives Act 1986 , a “departmental record” for the purposes of that Act and records of proceedings are therefore liable to be retained and preserved in accordance with and subject to section 7 of that Act and transferred to the National Archives in accordance with and subject to section 8 of that Act;

Article 13.2 (b) of the Data Protection Regulation and section 90(2)(d) of the 2018 Act

• (vi) that the right to request access to personal data contained in a court record is confined to the circumstances where statute or rules of court or the practice of the court so permits and, for the avoidance of doubt, that no such rights are exercisable in respect of personal data referred to in rule 3(ii), which data remain confidential and immune from production;

Article 13.2 (b) of the Data Protection Regulation and section 90(2)(d) of the 2018 Act

• (vii) that the right to request rectification of personal data contained in a court record is confined to the circumstances in which such right is available to a party to the proceedings concerned in accordance with rules of court and may be exercised only by the means available to such party to request rectification of a court record (including generally by application under the “slip rule” applicable in the relevant court) and, for the avoidance of doubt, that no such rights are exercisable in respect of personal data referred to in rule 3(ii), which remain confidential and immune from production;

Article 13.2 (e) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (viii) that the nature of the obligation to provide personal data will depend on the circumstances but arises ultimately from the function conferred on courts by the Constitution and law; where the personal data is provided by a plaintiff, applicant or moving party in civil proceedings or by a complainant in criminal proceedings, it is essentially provided voluntarily and with the intention of, or directed towards, seeking a remedy in the proceedings and failure to provide it may diminish the prospects of securing that remedy; where the personal data is provided by a defendant or respondent in civil proceedings or by an accused in criminal proceedings, it is essentially provided voluntarily and with the intention of, or directed towards, defending the proceedings and failure to provide it may diminish the prospects of successfully defending the proceedings and may also involve a risk of being found in default of defence; where the personal data is provided under a summons to give evidence in any proceedings, it is essentially provided under compulsion and failure to provide it may render the person liable to be summoned in contempt of court;

Article 13.3 of the Data Protection Regulation and section 160 of the 2018 Act

• (ix) that personal data held by courts may be further processed for purposes connected with the administration of justice, including the publication of a judgment or decision of a court, or of a list or schedule of proceedings or hearings in proceedings;

Article 13.3 of the Data Protection Regulation

• (x) that personal data held by courts may be further processed for purposes connected with the efficient management and operation of the courts, including statistical analysis, but further processing for statistical analysis purposes will be subject to technical and organisational measures in order to ensure respect for the principle of data minimisation, (and for the avoidance of doubt, that the courts do not permit data held by them to be used by third parties for marketing or other commercial purposes);

Where personal data have not been obtained from the data subject

Article 14.1 (a) of the Data Protection Regulation and section 90(2)(a) of the 2018 Act

• (xi) the identity of the controller, being the Supreme Court, the Court of Appeal, the High Court, the Circuit Court, the District Court or a Special Criminal Court, as the case may be;

Article 14.1 (c) of the Data Protection Regulation and section 90(2)(c) and (f) of the 2018 Act

• (xii) that personal data are processed by and on behalf of the courts for the purposes of the performance by the courts of their functions under the Constitution and law, as interpreted in the decisions of the courts, and the fact that the legal basis for such processing is provided for in the Constitution, in statute (principally but without limitation the Courts of Justice Acts 1924 to 2014, the Courts (Supplemental Provisions) Acts 1961 to 2017 and, in the case of a Special Criminal Court, Part V of the Offences against the State Act 1939 ) and otherwise in law;

Article 14.1 (d) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (xiii) that the categories of personal data concerned depend on the nature of the proceedings concerned and the content of pleadings and other court documents lodged, exchanged or issued, and of evidence given and submissions made in, those proceedings;

Article 14.1 (e) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (xiv) that material comprised in a court record may be made available to a party to the proceedings concerned (or to that party’s legal representative) or to another person

• (a) where statute (other than the 2018 Act) or rules of court so require or permit, or

• (b) if applicable, where the practice of the court so permits, or

• (c) for the purpose of facilitating the fair and accurate reporting of a hearing in the proceedings, to a bona fide member of the Press or broadcast media at the member’s request in accordance with section 159(7) of the 2018 Act and rules made thereunder,

and that in accordance with the requirements of Article 34 of the Constitution, proceedings are generally held in public save in such special and limited cases as may be prescribed by law;

Article 14.1 (f) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (xv) that material comprised in a court record may in certain circumstances (including, without limitation, in matters of judicial co-operation and criminal justice mutual assistance and where the transcription of digital audio records of proceedings is carried out for the Courts Service in a third country) be transferred to a third country and that where same occurs in the absence of an adequacy decision pursuant to Article 45.3 of the Data Protection Regulation, the appropriate or suitable safeguards pursuant to Article 46 of the Data Protection Regulation which have been provided and the means by which to obtain a copy of them or where they have been made available;

Article 14.2 (a) of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (xvi) that a court record is, by virtue of section 1(2) of the National Archives Act 1986 a “departmental record” for the purposes of that Act and records of proceedings are therefore liable to be retained and preserved in accordance with and subject to section 7 of that Act and transferred to the National Archives in accordance with and subject to section 8 of that Act;

Article 14.2 (c) of the Data Protection Regulation and section 90(2)(d) of the 2018 Act

• (xvii) that the right to request access to personal data contained in a court record is confined to the circumstances where statute or rules of court or the practice of the court so permits and, for the avoidance of doubt, that no such rights are exercisable in respect of personal data referred to in rule 3(ii), which data remain confidential and immune from production;

Article 14.2 (f) of the Data Protection Regulation

• (xviii) that the source from which personal data originate in proceedings is usually a party to those proceedings (who may rely in his, her or its pleadings and documents submitted to the court on other, including publicly accessible sources), a person summoned to give evidence before the court by a party to the proceedings, or a person, not being a party to the proceedings, who is required to provide discovery in the proceedings;

Article 14.4 of the Data Protection Regulation and section 160 of the 2018 Act

• (xix) that personal data held by courts may be further processed for purposes connected with the administration of justice, including the publication of a judgment or decision of a court, or of a list or schedule of proceedings or hearings in proceedings;

Article 14.4 of the Data Protection Regulation and section 90(2)(f) of the 2018 Act

• (xx) that personal data held by courts may be further processed for purposes connected with the efficient management and operation of the courts, including statistical analysis, but further processing for statistical analysis purposes will be subject to technical and organisational measures in order to ensure respect for the principle of data minimisation, (and for the avoidance of doubt, that the courts do not permit data held by them to be used by third parties for marketing or other commercial purposes).

Right of Access (Article 15 of the Data Protection Regulation and section 91 of the 2018 Act)

6.

• (i) a provision of statute (other than the 2018 Act) or rules of court so permits,

or

• (ii) the practice of the court so permits.

• (2) A data subject may seek access to any part of a note or recording made of proceedings only by making an application to the court concerned subject to and in accordance with the provisions of Order 123, rule 9 of the Rules of the Superior Courts (in the case of the Supreme Court, Court of Appeal or High Court), Order 67A, rule 8 of the Circuit Court Rules (in the case of the Circuit Court) or, as the case may be, Order 12B, rule 5 of the District Court Rules (in the case of the District Court).

Right to Rectification (Article 16 of the Data Protection Regulation and section 92 of the 2018 Act)

7.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These rules are made under section 158 (3) of the Data Protection Act 2018 for the purpose of ensuring the effective application of restrictions of the rights and obligations provided for in—

• (a) Articles 12 to 22 and Article 34 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and Article 5 of that Regulation in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22, and

• (b) sections 87 , 90 , 91 , 92 and 93 of the Data Protection Act 2018 , and section 71 of that Act in so far as it relates to those sections.