Data Protection Act 2018

In short

This law, the Data Protection Act 2018, establishes the Data Protection Commission and outlines rules for processing personal data, including special categories of data, to protect individuals' privacy rights.

What it regulates

The establishment and functions of the Data Protection Commission as a supervisory authority.
Rules for processing personal data, including specific provisions for children and special categories of data.
The rights of individuals regarding their personal data and restrictions on those rights in certain circumstances.
Enforcement mechanisms, including investigations, administrative fines, and judicial remedies for infringements.

Who it concerns

The Data Protection Commission and its staff.
Organisations and individuals who process personal data (controllers and processors).
Individuals whose personal data is being processed (data subjects).

Key points

Establishes the Data Protection Commission (Part 2).
Includes specific rules for children's data, such as consent for information society services (Section 31) and the right to be forgotten (Section 33).
Outlines conditions for processing special categories of personal data, including for employment, legal advice, and public health (Chapter 2 of Part 3).
Details enforcement powers of the Commission, including the ability to impose administrative fines (Chapter 6 of Part 6).

Legal text

Data Protection Act 2018 Skip to content Disclaimer Feedback Helpdesk Gaeilge Léim go dtí an t-ábhar Séanadh Aiseolas Deasc chabhrach English Gaeilge English Produced by the Office of the Attorney General Táirgthe ag Oifig an Ard-Aighne Home Legislation Acts of the Oireachtas Statutory Instruments Pre-1922 Legislation Constitution External Resources Bills (Houses of the Oireachtas) Iris Oifigiúil / Official Gazette Revised Acts (LRC) Classified List of Legislation (LRC) Translations (acts.

ie)Translations (Houses of the Oireachtas) Government Publications for Sale EU Law (EUR-Lex) FAQ Disclaimer Feedback Helpdesk Search Baile Reachtaíocht Achtanna an Oireachtais Ionstraimí Reachtúla Reachtaíocht Réamh-1922 Bunreacht Acmhainní Seachtracha Billí (Tithe an Oireachtais) Iris Oifigiúil Achtanna Athbhreithnithe (CAD) (An Coimisiún um Athchóiriú an Dlí) Liosta Rangaithe Reachtaíochta Aistriúcháin (achtanna.
ie)Aistriúcháin (Tithe an Oireachtais) Foilseacháin Rialtais ar Díol Dlí AE (EUR-Lex) CCanna (Ceisteanna Coitianta) Séanadh Aiseolas Deasc chabhrach Cuardach TitleTeideal Year(
s)or rangeBliain nó blianta nó raon TypeCineál All Legislation Acts Statutory Instruments Advanced SearchCuardach Casta HomeBaile ActsAchtanna 2018 Data Protection Act 2018 Data Protection Act 2018 Permanent Page URL View by SectionAmharc de réir Ailt View Full ActAmharc ar an Acht Iomlán Bill History Stair Bille Commencement, Amendments, SIs made under the Act Tosach Feidhme, Leasuithe, IRí arna ndéanamh faoin Acht Revised Act Acht Athbh… Open PDFOscail PDF Print Full ActPriontáil an tAcht Iomlán Number 7 of 2018 DATA PROTECTION ACT 2018 CONTENTS PART 1 Preliminary and General 1. Short title, citation and commencement 2. Interpretation 3. Designation by appropriate authority 4. Obligation not to require data subject to exercise right of access under Data Protection Regulation and Directive in certain circumstances 5. Expenses 6. Regulations 7. Repeals and revocations 8. Application of Data Protection Act 1988 PART 2 Data Protection Commission 9. Establishment day 10. Establishment of Data Protection Commission 11. Supervisory authority for Data Protection Regulation and Directive 12. Functions of Commission 13. Performance of functions of Commission by Commissioner or member of staff 14. Transfer of functions of Data Protection Commissioner to Commission 15. Membership of Commission 16. Appointment of chairperson of Commission 17. Resignation, removal, disqualification of Commissioner, ineligibility to become Commissioner 18. Acting Commissioner 19. Accountability of Commissioner to Oireachtas Committees 20. Assignment and transfer of staff to Commission 21. Staff of Commission 22. Superannuation of Commissioners 23. Accounts of Commission 24. Annual report 25. Accountability for accounts of Commission 26. Prohibition on disclosure of confidential information 27. Civil proceedings for contravention of section 26 PART 3 Data Protection Regulation Chapter 1 General 28. Fees 29. Child for purposes of application of Data Protection Regulation 30. Micro-targeting and profiling of children 31. Consent of child in relation to information society services 32. Codes of conduct: children 33. Right to be forgotten: children 34. Designation of data protection officer 35. Accreditation of certification bodies by Irish National Accreditation Board 36. Suitable and specific measures for processing 37. Limitation on transfers of personal data outside the European Union 38. Processing for a task carried out in the public interest or in the exercise of official authority 39. Communication with data subjects by political parties, candidates for and holders of certain elective political offices 40. Processing of personal data and special categories of personal data by elected representatives 41. Processing for purpose other than purpose for which data collected 42. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 43. Data processing and freedom of expression and information 44. Data processing and public access to official documents Chapter 2 Processing of special categories of personal data and processing of personal data relating to criminal convictions and offences 45. Processing of special categories of personal data 46. Processing of special categories of personal data for purposes of employment and social welfare law 47. Processing of special categories of personal data for purpose of legal advice and legal proceedings 48. Processing of personal data revealing political opinions for electoral activities and functions of Referendum Commission 49. Processing of special categories of personal data for purposes of administration of justice and performance of functions 50. Processing of special categories of personal data for insurance and pension purposes 51. Processing of special categories of personal data and Article 10 data for reasons of substantial public interest 52. Processing of special categories of personal data for purposes of Article 9

(2)(h)

Processing of special categories of personal data for purposes of public interest in the area of public health
Processing of special categories of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Processing of personal data relating to criminal convictions and offences Chapter 3 Rights, and restrictions of rights, of data subject and restrictions on obligations of controllers
Right of access to results and scripts of examination and results of appeal
Rights in relation to automated decision making
Direct marketing for purposes of Article 21
Restriction on right of data subject to object to processing for election purposes and processing by Referendum Commission
Restrictions on obligations of controllers and rights of data subjects for important objectives of general public interest
Restriction on exercise of data subjects’ rights: archiving purposes in the public interest, scientific or historical research purposes or statistical purposes PART 4 Provisions Consequent on Repeal of Certain Provisions of Data Protection Act 1988
Transfer of property of Data Protection Commissioner to Commission
Transfer of rights and liabilities of Data Protection Commissioner to Commission
Liability for loss occurring before establishment day
Provisions consequent upon transfer of functions, assets, rights and liabilities to Commission
Final accounts and final annual report of Data Protection Commissioner
Saver for scheme relating to superannuation
Saver for regulations under Act of 1988 PART 5 Processing of Personal Data for Law Enforcement Purposes Chapter 1 Preliminary and general (Part 5)
Interpretation (Part 5)
Application of Part 5 Chapter 2 General principles of data protection
Processing of personal data
Security measures for personal data
Processing of special categories of personal data (Part 5)
Data quality Chapter 3 Obligations of controllers and processors
General obligations of controller with regard to technical and organisational measures
Data protection by design and by default
Security of automated processing
Technical and organisational measures
Joint controllers
Processors
Record of data processing activities
Data logging for automated processing system
Cooperation with Commission
Data protection impact assessment and prior consultation with Commission
Notification of personal data breach by processor
Notification of personal data breach to Commission, etc.
Communication of personal data breach to data subject
Data protection officer Chapter 4 Rights, and restriction of rights, of data subject (Part 5)
Rights in relation to automated decision making (Part 5)
Right to information
Right of access
Right to rectification or erasure and restriction of processing
Communication with data subject
Restrictions on exercise of data subject rights (Part 5)
Indirect exercise of rights and verification by Commission Chapter 5 Transfers of personal data to third countries or international organisations
Transfer to third country or international organisation
Adequacy decision
Transfer subject to appropriate safeguards
Derogations for specific situations
Transfer to recipient in third country Chapter 6 Independent supervisory authority
Functions of Commission under Part 5
Power of the Commission to advise and issue opinions
Mutual assistance
Requests by Commission for mutual assistance PART 6 Enforcement of Data Protection Regulation and Directive Chapter 1 Preliminary
Interpretation (Part 6)
Service of documents (Part 6) Chapter 2 Enforcement of Data Protection Regulation
Interpretation (Chapter 2)
Complaints under Chapter 2: General
Commission to handle complaint under Chapter 2
Commission may conduct inquiry into suspected infringement of relevant enactment
Decision of Commission where inquiry under Chapter 2 conducted of own volition
Decision of Commission where inquiry conducted in respect of complaint to which Article 55 or 56

(5)applies

Complaint to which Article 60 applies
Commission to adopt decision in certain circumstances
Exercise by Commission of corrective power
Notification of decision of Commission under Chapter 2
Judicial remedy for infringement of relevant enactment Chapter 3 Enforcement of Directive
Interpretation (Chapter 3)
Data subject may lodge complaint with Commission
Representation of data subjects
Complaints under Chapter 3: General
Commission to handle complaint under Chapter 3
Commission may conduct inquiry into suspected infringements of relevant provision
Decision of Commission in respect of inquiry under Chapter 3 conducted of own volition
Decision of Commission where inquiry conducted in respect of complaint under Chapter 3
Notification of decision of Commission under Chapter 3
Corrective powers of Commission (Chapter 3)
Judicial remedy for infringement of relevant provision Chapter 4 Inspection, Audit and Enforcement
Authorised officers
Powers of authorised officers
Search warrants
Information notice
Enforcement notice
Circumstances in which application may be made to the High Court for suspension or restriction of processing of data
Power to require report
Data Protection Audit Chapter 5 Investigations
Investigations
Conduct of investigation under section 137
Investigation report
Commission to consider investigation report Chapter 6 Administrative Fines
Power of Commission to decide to impose administrative fine: General
Appeal against administrative fine
Circuit Court to confirm decision to impose administrative fine Chapter 7 Offences
Unauthorised disclosure by processor
Disclosure of personal data obtained without authority
Offences by directors, etc., of bodies corporate
Prosecution of summary offences by Commission Chapter 8 Miscellaneous
General provisions relating to complaints
Publication of convictions, sanctions, etc.
Right to effective judicial remedy (Part 6)
Privileged legal material
Presumptions
Expert evidence
Immunity from suit
Jurisdiction of Circuit Court
Hearing of proceedings PART 7 Miscellaneous Provisions
Supervisory authority for courts acting in judicial capacity
Restrictions on obligations of controllers and rights of data subjects for objective of safeguarding judicial independence and court proceedings
Processing of personal data where court is controller
Publication of judgment or decision of court or court list
Rules of court for data protection actions
Legal privilege
Application to High Court concerning adequate level of protection or appropriate safeguards
Court may order destruction, erasure of data PART 8 Amendments of other Acts of Oireachtas
Reference to personal data in enactment
Reference to processing in enactment
Amendment of Firearms Act 1925
Amendment of section 33AK of Central Bank Act 1942
Amendment of section 2 of Civil Service Regulation Act 1956
Amendment of section 24 of Misuse of Drugs Act 1977
Amendment of section 15A of Control of Clinical Trials Act 1987
Amendment of Data Protection Act 1988
Amendment of Bankruptcy Act 1988
Amendment of Firearms and Offensive Weapons Act 1990
Amendment of section 13A of Electoral Act 1992
Amendment of Comptroller and Auditor General (Amendment) Act 1993
Amendment of section 8 of Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993
Amendment of section 24 of Statistics Act 1993
Amendment of section 57B of Irish Aviation Authority Act 1993
Amendment of section 18F of Health Insurance Act 1994
Amendment of section 142 of Consumer Credit Act 1995
Amendment of section 32B of Irish Medicines Board Act 1995
Amendment of section 77 of Central Bank Act 1997
Amendment of section 1 of Health (Provision of Information) Act 1997
Amendment of section 9M of Electricity Regulation Act 1999
Amendment of British-Irish Agreement Act 1999
Amendment of section 7D of Comhairle Act 2000
Amendment of section 33 of Commission To Inquire Into Child Abuse Act 2000
Amendment of section 2 of Merchant Shipping (Investigation of Marine Casualties) Act 2000
Amendment of section 28 of Education (Welfare) Act 2000
Amendment of section 38 of Planning and Development Act 2000
Amendment of section 14 of Dormant Accounts Act 2001
Amendment of section 30 of Residential Institutions Redress Act 2002
Amendment of section 2 of Official Languages Act 2003
Amendment of section 86 of Personal Injuries Assessment Board Act 2003
Amendment of section 12 of Unclaimed Life Assurance Policies Act 2003
Amendment of section 66 of Civil Registration Act 2004
Amendment of section 39 of Commissions of Investigation Act 2004
Amendment of section 55H of Health Act 2004
Amendment of section 2 of Safety, Health and Welfare at Work Act 2005
Amendment of section 265 of Social Welfare Consolidation Act 2005
Amendment of Disability Act 2005
Amendment of section 2 of Railway Safety Act 2005
Amendment of section 12 of Health (Repayment Scheme) Act 2006
Amendment of section 19 of Electoral (Amendment) Act 2006
Amendment of section 67 of Pharmacy Act 2007
Amendment of Passports Act 2008
Amendment of Criminal Justice (Mutual Assistance) Act 2008
Amendment of section 2 of Chemicals Act 2008
Amendment of Nursing Homes Support Scheme Act 2009
Amendment of section 23 of Criminal Justice (Miscellaneous Provisions) Act 2009
Amendment of section 201 of National Asset Management Agency Act 2009
Amendment of Criminal Justice (Money Laundering and Terrorist Financing) Act 2010
Amendment of section 12 of Communications (Retention of Data) Act 2011
Amendment of section 17A of Ministers and Secretaries (Amendment) Act 2011
Amendment of section 28 of Student Support Act 2011
Amendment of Communications Regulation (Postal Services) Act 2011
Amendment of Property Services (Regulation) Act 2011
Amendment of section 56 of Credit Union and Co-operation with Overseas Regulators Act 2012
Amendment of Europol Act 2012
Amendment of Personal Insolvency Act 2012
Amendment of section 2 of Animal Health and Welfare Act 2013
Amendment of section 8 of Health (Alteration of Criteria for Eligibility) Act 2013
Insertion of section 957A to Companies Act 2014
Amendment of Health Identifiers Act 2014
Amendment of section 15 of Freedom of Information Act 2014
Amendment of section 41 of Customs Act 2015
Amendment of section 7 of Regulation of Lobbying Act 2015
Amendment of Sport Ireland Act 2015
Amendment of section 12 of Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016
Amendment of section 62 of Financial Services and Pensions Ombudsman Act 2017
Amendment of National Shared Services Office Act 2017 SCHEDULE 1 Statutory Instruments Revoked SCHEDULE 2 Data Protection Commission SCHEDULE 3 Provisions Applicable to Oral Hearing Conducted by an Authorised Officer Under Section 138 Acts Referred to Animal Health and Welfare Act 2013 (No. 15) Bankruptcy Act 1988 (No. 27) British-Irish Agreement Act 1999 (No. 1) Central Bank Act 1942 (No. 22) Central Bank Act 1997 (No. 8) Chemicals Act 2008 (No. 13) Children Act 2001 (No. 24) Civil Registration Act 2004 (No. 3) Civil Service Regulation Act 1956 (No. 46) Comhairle Act 2000 (No. 1) Commission To Inquire Into Child Abuse Act 2000 (No. 7) Commissions of Investigation Act 2004 (No. 23) Communications (Retention of Data) Act 2011 (No. 3) Communications Regulation (Postal Services) Act 2011 (No. 21) Companies Act 2014 (No. 38) Competition Act 2002 (No. 14) Comptroller and Auditor General (Amendment) Act 1993 (No. 8) Consumer Credit Act 1995 (No. 24) Control of Clinical Trials Act 1987 (No. 28) Credit Union and Co-operation with Overseas Regulators Act 2012 (No. 40) Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 (No. 11) Criminal Justice (Miscellaneous Provisions) Act 2009 (No. 28) Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (No. 6) Criminal Justice (Mutual Assistance) Act 2008 (No. 7) Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 (No. 4) Customs Act 2015 (No. 18) Data Protection (Amendment) Act 2003 (No. 6) Data Protection Act 1988 (No. 25) Data Protection Acts 1988 and 2003 Data Protection Acts 1988 to 2003 Defence Act 1954 (No. 18) Dentists Act 1985 (No. 9) Disability Act 2005 (No. 14) Dormant Accounts Act 2001 (No. 32) Education (Welfare) Act 2000 (No. 22) Education Act 1998 (No. 51) Electoral (Amendment) Act 2006 (No. 33) Electoral Act 1992 (No. 23) Electricity Regulation Act 1999 (No. 23) European Parliament Elections Act 1997 (No. 2) Europol Act 2012 (No. 53) Financial Services and Pensions Ombudsman Act 2017 (No. 22) Firearms (Firearm Certificates For Non-Residents) Act 2000 (No. 20) Firearms Act 1925 (No. 17) Firearms and Offensive Weapons Act 1990 (No. 12) Freedom of Information Act 2014 (No. 30) Health (Alteration of Criteria for Eligibility) Act 2013 (No. 10) Health (Corporate Bodies) Act 1961 (No. 27) Health (Provision of Information) Act 1997 (No. 9) Health (Repayment Scheme) Act 2006 (No. 17) Health Act 2004 (No. 42) Health Identifiers Act 2014 (No. 15) Health Insurance Act 1994 (No. 16) Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 (No. 10) Interpretation Act 2005 (No. 23) Irish Aviation Authority Act 1993 (No. 29) Irish Medicines Board Act 1995 (No. 29) Local Government Act 2001 (No. 37) Medical Practitioners Act 1978 (No. 4) Medical Practitioners Act 2007 (No. 25) Merchant Shipping (Investigation of Marine Casualties) Act 2000 (No. 14) Ministers and Secretaries (Amendment) Act 2011 (No. 10) Misuse of Drugs Act 1977 (No. 12) National Asset Management Agency Act 2009 (No. 34) National Shared Services Office Act 2017 (No. 26) Nursing Homes Support Scheme Act 2009 (No. 15) Official Languages Act 2003 (No. 32) Passports Act 2008 (No. 4) Personal Injuries Assessment Board Act 2003 (No. 46) Personal Insolvency Act 2012 (No. 44) Petty Sessions (Ireland) Act 1851 (14 & 15 Vict., c.93) Pharmacy Act 2007 (No. 20) Planning and Development Act 2000 (No. 30) Prisons Acts 1826 to 2015 Property Services (Regulation) Act 2011 (No. 40) Public Service Superannuation (Miscellaneous Provisions) Act 2004 (No. 7) Railway Safety Act 2005 (No. 31) Regulation of Lobbying Act 2015 (No. 5) Residential Institutions Redress Act 2002 (No. 13) Safety, Health and Welfare at Work Act 2005 (No. 10) Social Welfare Consolidation Act 2005 (No. 26) Sport Ireland Act 2015 (No. 15) Statistics Act 1993 (No. 21) Student Support Act 2011 (No. 4) Unclaimed Life Assurance Policies Act 2003 (No. 2) Vehicle Registration Data (Automated Searching and Exchange) Act 2018 (No. 5) Number 7 of 2018 DATA PROTECTION ACT 2018 An Act to establish a body to be known as An Coimisiún um Chosaint Sonraí or, in the English language, the Data Protection Commission; to give further effect to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); to give effect to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 20162 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA; to give further effect to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January 1981 and for those and other purposes to amend the Data Protection Act 1988 ; to provide for the consequential amendment of certain other enactments; and to provide for related matters. [24th May, 2018] Be it enacted by the Oireachtas as follows: PART 1 Preliminary and General Short title, citation and commencement 1.

(1)This Act may be cited as the Data Protection Act 2018.

(2)This Act and the Data Protection Acts 1988 and 2003 may be cited together as the Data Protection Acts 1988 to 2018.

(3)This Act shall come into operation on such day or days as the Minister may by order or orders appoint either generally or with reference to any particular purpose or provision and different days may be so appointed for different purposes or different provisions, and for the repeal of different enactments or provisions of enactments effected by section 7 . Interpretation 2.

(1)In this Act— “Act of 1988” means the Data Protection Act 1988 ; “Act of 2014” means the Companies Act 2014 ; “authorised officer” means a person appointed, or deemed to be appointed, to be an authorised officer under section 129 ; “chairperson” means the chairperson of the Commission; “civil servant” has the meaning assigned to it by the Civil Service Regulation Act 1956 ; “Commission” has the meaning assigned to it by section 10 ; “Commissioner” has the meaning assigned to it by section 15 and includes a member of staff authorised to act in place of a Commissioner under section 18 ; “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20163 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); “Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 20164 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA; “enactment” has the same meaning as it has in the Interpretation Act 2005 ; “local authority” means a local authority within the meaning of section 2 of the Local Government Act 2001 ; “Minister” means the Minister for Justice and Equality; “political party” means a political party registered in the Register of Political Parties in accordance with section 25 of the Electoral Act 1992 ; “prescribe” means prescribe by regulations; “public authority” means— (a) a Department of State, (b) a regional assembly, (c) a local authority, (d) the office of the Director of Corporate Enforcement, (e) the Irish Auditing and Accounting Supervisory Authority, (f) any other person established by or under an enactment (other than the Act of 2014 or a former enactment relating to companies within the meaning of section 5 of that Act) other than— (i) a recognised school or board within the meaning of section 2 of the Education Act 1998 but including a recognised school established and maintained by an education and training board and a board of a school so established and maintained, and (ii) a management committee established under section 37

(3)of the Education Act 1998 , (g) a person with whom the Health Service Executive has, under section 38

(1)of the Health Act 2004 , entered into an arrangement for the provision of a health or personal social service by that person on behalf of the Executive, (

h)the Garda Síochána; “public body” means— (
a)a company (within the meaning of the Act of 2014 or a former enactment relating to companies within the meaning of section 5 of that Act) a majority of the shares in which are held by or on behalf of a Minister of the Government, (
b)a subsidiary (within the meaning of section 7 of the Act of 2014) of a company referred to in paragraph (a); “special categories of personal data”, other than in Part 5 , means— (
a)personal data revealing— (
i)the racial or ethnic origin of the data subject, (
ii)the political opinions or the religious or philosophical beliefs of the data subject, or (iii) whether the data subject is a member of a trade union, (
b)genetic data, (
c)biometric data for the purposes of uniquely identifying an individual, (
d)data concerning health, or (
e)personal data concerning an individual’s sex life or sexual orientation.

(2)Subject to subsection

(1), a word or expression used in this Act, other than in Part 5 , that is also used in the Data Protection Regulation has, unless the context otherwise requires, the same meaning in this Act as it has in that Regulation.

(3)Unless the context otherwise requires, a reference in this Act (other than in Part 5 ) to a numbered Article is a reference to the Article so numbered of the Data Protection Regulation. Designation by appropriate authority 3.

(1)An appropriate authority (within the meaning of the Civil Service Regulation Act 1956 ) may, as respects all or part of the personal data kept by the authority, designate a civil servant in relation to whom it is the appropriate authority to be a controller and while the designation is in force the civil servant so designated shall, other than for the purposes of sections 105

(3)and 141

(2)and

(3), be deemed, for the purposes of this Act and the Data Protection Regulation, to be the controller in respect of the data concerned.

(2)Without prejudice to subsection

(1), the Minister for Defence may, as respects all or part of the personal data kept by him in relation to the Defence Forces, designate an officer of the Permanent Defence Force who holds a commissioned rank therein to be a controller and while the designation is in force the officer so designated shall, other than for the purposes of sections 105

(3)and 141

(2)and

(3), be deemed, for the purposes of this Act and the Data Protection Regulation, to be the controller in respect of the data concerned.

(3)For the purposes of this Act and the Data Protection Regulation— (a) where a designation by the relevant appropriate authority under subsection

(1)is not in force, a civil servant in relation to whom that authority is the appropriate authority shall be deemed to be its employee and, where such a designation is in force, such a civil servant (other than the civil servant the subject of the designation) shall be deemed to be an employee of the last mentioned civil servant, (b) where a designation under subsection

(2)is not in force, a member of the Defence Forces shall be deemed to be an employee of the Minister for Defence and, where such a designation is in force, such a member (other than the officer the subject of the designation) shall be deemed to be an employee of that officer, and (c) a member of the Garda Síochána (other than the Commissioner of the Garda Síochána) shall be deemed to be an employee of the Commissioner of the Garda Síochána. Obligation not to require data subject to exercise right of access under Data Protection Regulation and Directive in certain circumstances 4.

(1)A person shall not, in connection with— (

a)the recruitment of an individual as an employee, (
b)the continued employment of the individual, or (
c)a contract for the provision of services to the person by an individual, require that individual to— (
i)make a request under Article 15 or under section 91 , or (
ii)supply the person with data relating to that individual obtained as a result of such a request.

(2)A person who contravenes subsection

(1)shall be guilty of an offence and shall be liable— (

a)on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or (
b)on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both. Expenses 5. The expenses incurred by the Commission and any Minister of the Government in the administration of this Act shall, to such an extent as may be sanctioned by the Minister for Public Expenditure and Reform, be paid out of moneys provided by the Oireachtas. Regulations 6.

(1)Regulations made under this Act may contain such incidental, supplementary and consequential provisions as appear to the person making the regulations to be necessary or expedient for the purposes of the regulations.

(2)Every regulation made under this Act, other than under section 51 , 60 or 73 , shall be laid before each House of the Oireachtas as soon as may be after it is made.

(3)Either House of the Oireachtas may, by a resolution passed within 21 sitting days after the day on which a regulation is laid before it under subsection

(2), annul the regulation.

(4)The annulment of a regulation under subsection

(3)takes effect immediately on the passing of the resolution concerned but does not affect the validity of anything done under the regulation before the passing of the resolution.

(5)Regulations may be made under section 51 , 60 or 73 only if— (

a)a draft of the proposed regulations has been laid before each House of the Oireachtas, and (
b)a resolution approving the draft has been passed by each House. Repeals and revocations 7.

(1)Subject to subsection

(4), the following provisions of the Act of 1988 are repealed: (a) in section 1— (i) subsection

(1), the definition of “direct marketing”, “financial institution” and “the register”, and (ii) subsection

(5); (b) section 2

(7)and

(8); (c) section 4

(2),

(6),

(8)and

(13); (d) section 5

(1)(d); (

e)section 9 and the Second Schedule; (
f)section 11

(3)and

(4)(b); (g) sections 13, 14, 16, 17, 18, 19, 20, 22A and 33.

(2)Subject to subsection

(4), section 14

(2)of the Data Protection (Amendment) Act 2003 is repealed.

(3)Subject to subsection

(4), the enactments specified in column

(3)of Schedule 1 are revoked to the extent specified in column

(4)of that Schedule.

(4)The repeals and revocations effected by this section shall not apply for the purposes of subsections

(1)(b),

(2)and

(3)of section 8 . Application of Data Protection Act 1988 8.

(1)Subject to this section, the Act of 1988 shall, on and from the date on which this section comes into operation, cease to apply to the processing of personal data (within the meaning of that Act) other than— (

a)the processing of such data for the purposes of safeguarding the security of the State, the defence of the State or the international relations of the State, or (
b)the processing of such data under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018 to the extent that the Act of 1988 is applied in those Acts.

(2)The Act of 1988 shall apply to— (

a)a complaint by an individual under section 10 of that Act made before the commencement of this section, and (
b)a contravention of that Act that occurred before such commencement.

(3)An investigation under section 10 of the Act of 1988 that was begun but not completed before the commencement of this section shall be completed in accordance with that Act and that Act shall apply to such an investigation. PART 2 Data Protection Commission Establishment day 9. The Minister shall, by order, appoint a day to be the establishment day for the purposes of this Act. Establishment of Data Protection Commission 10.

(1)On the establishment day there shall stand established a body to be known as An Coimisiún um Chosaint Sonraí or, in the English language, the Data Protection Commission (in this Act referred to as the “Commission”).

(2)Schedule 2 shall have effect in relation to the Commission. Supervisory authority for Data Protection Regulation and Directive 11. The Commission shall be the supervisory authority within the meaning of, and for the purposes specified in— (a) the Data Protection Regulation, and (b) the Directive. Functions of Commission 12.

(1)In addition to the functions assigned to the Commission by virtue of its being the supervisory authority for the purposes of the Data Protection Regulation and the Directive, the general functions of the Commission shall include— (

a)any functions assigned to it by or under this Act, (
b)functions transferred to the Commission under section 14 , and (
c)such other functions as may be assigned to it from time to time by or under any other enactment.

(2)The Commission shall monitor the lawfulness of processing of personal data in accordance with— (

a)Regulation (EU) No 603/2013 of the European Parliament and of the Council of 26 June 20135 on the establishment of ‘Eurodac’ for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (recast), and (
b)Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 20136 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast).

(3)The Commission is designated for the purposes of Chapter IV (Mutual assistance) of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January 1981.

(4)The Minister may, following consultation with the Commission, make any regulations that he or she considers necessary or expedient for the purpose of enabling Chapter IV (as referred to in subsection

(3)) to have full effect.

(5)The Commission shall have all such powers as are necessary or expedient for the performance of its functions.

(6)The Commission shall disseminate, to such extent and in such manner as it considers appropriate, information in relation to the functions performed by it.

(7)The Commission shall be independent in the performance of its functions.

(8)Subject to this Act, the Commission shall regulate its own procedures. Performance of functions of Commission by Commissioner or member of staff 13.

(1)Where more than one Commissioner stands appointed under section 15 , the functions of the Commission, other than the functions specified in subsection

(3), may be performed through or by a Commissioner where he or she is authorised in that behalf by the Commission.

(2)The functions of the Commission, other than the functions specified in subsection

(3), may be performed through or by any member of staff of the Commission where he or she is authorised in that behalf by the Commission.

(3)The functions referred to in subsections

(1)and

(2)are the functions of the Commission under sections 12

(8), 21 , 28 , 43 , 84

(9)and

(10), 129 , 134

(1)and

(4), 135

(1), 149 (other than subsection

(1)), paragraph 1 of Schedule 2 and its function, as supervisory authority, under Article 35

(4)and

(5)of the Data Protection Regulation.

(4)A Commissioner or member of staff of the Commission who performs any of the functions of the Commission is presumed in any proceedings to have been authorised to do so on its behalf unless the contrary is shown. Transfer of functions of Data Protection Commissioner to Commission 14.

(1)All functions that, immediately before the establishment day, were vested in the Data Protection Commissioner are transferred to the Commission.

(2)A reference in any enactment or instrument under an enactment to the Data Protection Commissioner or to the Office of the Data Protection Commissioner shall be construed as a reference to the Commission.

(3)A reference in the Act of 1988 (other than in section 1

(3)(c)(iii) in so far as it refers to to the Commissioner of the Garda Síochána) to the Commissioner shall be construed as a reference to the Commission.

(4)This section shall come into operation on the establishment day. Membership of Commission 15.

(1)The Commission shall consist of such and so many members (not being more than 3) as the Government determines.

(2)Each member of the Commission shall be known as a Commissioner for Data Protection (in this Act referred to as a “Commissioner”).

(3)Subject to subsections

(4),

(8)and

(9)and section 18 , a Commissioner shall be appointed by the Government on the recommendation of the Public Appointments Service and the appointment shall be for a period of not less than 4 and not more than 5 years from the date of his or her appointment.

(4)If, immediately before the establishment day, there is a person holding office as the Data Protection Commissioner, he or she shall, on the establishment day, be a Commissioner for the remainder of the term of office, and upon the same terms and conditions, for which he or she was appointed as the Data Protection Commissioner.

(5)Subject to subsection

(7), the Public Appointments Service shall recommend a person for appointment as Commissioner following an open selection competition held by the Service for that purpose.

(6)The Public Appointments Service shall appoint a selection panel to assist it in holding an open selection competition.

(7)The Public Appointments Service shall ensure that a person is recommended under subsection

(5)for appointment only if it is satisfied that the person has the qualifications, experience and skills necessary to enable the Commission to effectively perform its functions.

(8)A Commissioner to whom subsection

(3)applies and whose term of office expires by the efflux of time may be reappointed to the Commission by the Government for one further period of not less than 4 and not more than 5 years without the need for a further recommendation by the Public Appointments Service.

(9)A Commissioner to whom subsection

(4)applies and whose term of office expires by the efflux of time may be reappointed to the Commission by the Government for one further period of not less than 4 and not more than 5 years.

(10)A Commissioner shall— (

a)act on a full-time basis subject to such terms and conditions (other than the payment of remuneration and allowances for expenses) as the Government may determine, (
b)be paid by the Commission such remuneration and allowances for expenses (if any) as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time determine, (
c)not hold any other office or occupy any other position in respect of which emoluments are payable or carry on any business, and (
d)cease to be a Commissioner on reaching the age of 70 years, but where the person is a new entrant (within the meaning of section 2 of the Public Service Superannuation (Miscellaneous Provisions) Act 2004 ) the requirement to cease to be a Commissioner on grounds of age shall not apply. Appointment of chairperson of Commission 16.

(1)The Minister shall, where the Commission consists of more than one Commissioner, appoint one of the Commissioners to be chairperson and such allowance (if any) may be paid by the Commission to the chairperson as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time determine.

(2)The chairperson shall have a casting vote in the case of decisions to be taken by the Commission in the event of a tied vote.

(3)Where a chairperson stands appointed under subsection

(1), and is unavailable to perform his or her duties due to absence or incapacity, the Minister shall appoint another existing Commissioner to act as chairperson for the duration of the period of absence or incapacity. Resignation, removal, disqualification of Commissioner, ineligibility to become Commissioner 17.

(1)A Commissioner may resign from office by giving notice in writing to the Government of his or her resignation and the resignation shall take effect from such date as is specified in the notice which date shall be at least 90 days after the giving of the notice to the Government.

(2)The Government may remove a Commissioner from office if they are satisfied that one or more of the grounds referred to in subsection

(3)apply to the Commissioner.

(3)The grounds referred to in subsection

(2)are that a Commissioner— (

a)has become incapable through ill health or otherwise of effectively performing the functions of the office, or (
b)has engaged in serious misconduct.

(4)Where the Government propose to remove a Commissioner under subsection

(2), they shall notify the Commissioner concerned in writing of their proposal.

(5)A notification under subsection

(4)shall include a statement— (

a)of the reasons for the proposed removal, (
b)that the Commissioner may, within a period of 30 working days from the sending of the notification or such other period as the Government may, having regard to the requirements of natural justice, specify in the notice, make representations to the Government in such form and manner as may be specified by the Government, as to why the Commissioner should not be removed from office, and (
c)that where no representations are received within the period referred to in paragraph (
b)the Government will, without further notice to the Commissioner, proceed with the removal of the Commissioner from office in accordance with this section.

(6)In considering whether to remove a Commissioner from office under subsection

(2), the Government shall take into account— (a) any representations made by the Commissioner under subsection

(5)(

b)within the period referred to in that subsection, and (
b)any other matter the Government consider relevant for the purpose of their decision.

(7)Where, having taken into account the matters referred to in subsection

(6), the Government decide the Commissioner should be removed from office in accordance with this section, they shall notify the Commissioner in writing of their decision and the reasons for their decision.

(8)Where the Government decide to remove a Commissioner from office in accordance with this section, they shall prepare a statement of the reason or reasons for such removal and cause that statement to be laid before each House of the Oireachtas as soon as practicable after the decision is made.

(9)A Commissioner shall cease to hold office if he or she— (

a)is convicted on indictment of an offence, (
b)is convicted of an offence involving fraud or dishonesty, (
c)has a declaration made against him or her under section 819 of the Act of 2014 or is deemed to be subject to such a declaration by virtue of Chapter 5 of Part 14 of that Act, or (
d)is subject to, or is deemed to be subject to, a disqualification order within the meaning of Chapter 4 of Part 14 of the Act of 2014 whether by virtue of that Chapter or of any other provision of that Act.

(10)A person shall not be eligible for appointment as a Commissioner if any of paragraphs (a) to (d) of subsection

(9)are applicable in respect of the person. Acting Commissioner 18.

(1)Where one Commissioner only stands appointed for the time being under section 15 , the Minister may authorise a member of staff of the Commission to perform the functions of a Commissioner during any period when that Commissioner is absent from duty or absent from the State or is, for any other reason, unable to perform the functions of a Commissioner.

(2)Where a vacancy occurs in the office of Commissioner and no Commissioner stands appointed for the time being under section 15 , the Minister may authorise a member of staff of the Commission to perform the functions of a Commissioner during the period of that vacancy, but an authorisation under this subsection shall cease upon the appointment of a Commissioner under section 15 whether or not such appointment was made for the purpose of filling that vacancy.

(3)An authorisation under subsection

(2)shall not remain in force for a period of more than 6 months unless the Minister is satisfied that it is not reasonably practicable for an appointment under section 15 to be made within that period, in which case he or she may extend that period by such further period as he or she is satisfied is a period within which it is reasonably practicable for an appointment to be made under that section.

(4)The Minister may at any time terminate an authorisation under this section.

(5)A member of staff of the Commission in respect of whom an authorisation under this section is in force may perform the functions of a Commissioner under this Act, and, for that purpose, references to a Commissioner in this Act (other than in sections 15

(3), 17

(2)to

(8)and 22 ) shall be construed as including references to such member of staff. Accountability of Commissioner to Oireachtas Committees 19.

(1)In this section, “Committee” means a Committee appointed by either House of the Oireachtas or jointly by both Houses of the Oireachtas (other than a committee referred to in section 19

(1)of the Comptroller and Auditor General (Amendment) Act 1993 or the Committee on Members’ Interests of Dáil Éireann or the Committee on Members’ Interests of Seanad Éireann) or a sub-committee of such a Committee.

(2)Subject to subsection

(3), a Commissioner shall, at the request in writing of a Committee, attend before it to give account for the general administration of the Commission.

(3)The Commissioner shall not be required to give account before a Committee for any matter which is or has been or may at a future time be the subject of proceedings before a court or tribunal.

(4)Where the Commissioner is of the opinion that a matter in respect of which he or she is requested to give an account before a Committee is a matter to which subsection

(3)applies, he or she shall inform the Committee of that opinion and the reasons for the opinion and, unless the information is conveyed to the Committee at a time when the Commissioner is before it, the information shall be so conveyed in writing.

(5)Where the Commissioner has informed a Committee of his or her opinion in accordance with subsection

(4)and the Committee does not withdraw the request referred to in subsection

(2)in so far as it relates to a matter the subject of that opinion— (a) the Commissioner may, not later than 21 days after being informed by the Committee of its decision not to do so, apply to the High Court in a summary manner for determination of the question whether the matter is one to which subsection

(3)applies, or (b) the Chairperson of the Committee may, on behalf of the Committee, make such an application, and the High Court shall determine the matter.

(6)Pending the determination of an application under subsection

(5), the Commissioner shall not attend before the Committee to give account for the matter the subject of the application.

(7)If the High Court determines that the matter concerned is one to which subsection

(3)applies, the Committee shall withdraw the request referred to in subsection

(2), but if the High Court determines that subsection

(3)does not apply, the Commissioner shall attend before the Committee and give account for the matter.

(8)In this section, a reference to “Commissioner” shall, where more than one Commissioner has been appointed under section 15 , be taken to be a reference to the chairperson. Assignment and transfer of staff to Commission 20.

(1)Every civil servant who, immediately before the establishment day, stands assigned to act as a member of staff of the Data Protection Commissioner shall, on the establishment day, stand assigned to act as a member of staff of the Commission.

(2)The Minister may, as he or she considers appropriate, designate in writing such and so many persons who stand assigned under subsection

(1)to act as members of staff of the Commission to become and be members of staff of the Commission on and from such date as the Minister may specify in the designation (in this section referred to as the “effective date”).

(3)A member of staff designated in accordance with subsection

(2)shall become and be a member of staff of the Commission on and from the effective date. Staff of Commission 21.

(1)The Commission may, subject to the approval of the Minister given with the consent of the Minister for Public Expenditure and Reform, appoint such number of persons to be members of its staff as it may determine.

(2)The Commission shall, subject to the approval of the Minister given with the consent of the Minister for Public Expenditure and Reform, determine the grades of members of its staff and the numbers in each grade.

(3)Members of staff of the Commission shall be civil servants. Superannuation of Commissioners 22.

(1)The Minister may, with the consent of the Minister for Public Expenditure and Reform, make a scheme or schemes for— (

a)the granting of superannuation benefits to or in respect of a Commissioner ceasing to hold office, or (
b)the making of contributions to a pension scheme approved of by the Minister with the consent of the Minister for Public Expenditure and Reform which has been entered into by the Commissioner.

(2)The Minister may, with the consent of the Minister for Public Expenditure and Reform, make a scheme amending or revoking a scheme made under subsection

(1), including a scheme amended under this subsection.

(3)If any dispute arises as to the claim of a Commissioner to, or the amount of, any superannuation benefit payable in pursuance of a scheme made under subsection

(1), such dispute shall be submitted to the Minister who shall refer it to the Minister for Public Expenditure and Reform for determination by him or her.

(4)A scheme made under subsection

(1)shall be carried out by the Minister in accordance with its terms.

(5)No superannuation benefit shall be granted by the Minister to or in respect of any Commissioner ceasing to hold office otherwise than— (a) in accordance with a scheme under subsection

(1), or (b) with the consent of the Minister for Public Expenditure and Reform.

(6)A scheme made under subsection

(1)shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the scheme is passed by either such House within the next 21 days on which that House has sat after the scheme is laid before it, the scheme shall be annulled accordingly but without prejudice to the validity of anything previously done under that scheme prior to the resolution.

(7)In this section, “superannuation benefits” means pensions, gratuities and other allowances payable on resignation, retirement or death. Accounts of Commission 23.

(1)The Commission shall keep, in such form as may be approved by the Minister with the consent of the Minister for Public Expenditure and Reform, all proper and usual accounts of all money received or expended by it and, in particular, shall keep in such form as aforesaid all such special accounts as the Minister may, with the consent of the Minister for Public Expenditure and Reform, from time to time direct.

(2)Accounts kept in accordance with this section shall be submitted, not later than 1 April in the year immediately following the financial year to which they relate or on such earlier date as the Minister may from time to time specify, by the Commission to the Comptroller and Auditor General for audit and, immediately after the audit, a copy of the accounts, and of such other special accounts (if any) kept in accordance with this section as the Minister, after consultation with the Minister for Public Expenditure and Reform, may direct and a copy of the Comptroller and Auditor General’s report on the accounts shall be presented to the Minister and the Commission shall, as soon as may be thereafter, cause copies thereof to be laid before each House of the Oireachtas.

(3)Subject to subsections

(4)and

(5), subsections

(1)and

(2)shall cease to have effect on the date of the coming into operation of section 176 (b).

(4)Accounts kept in accordance with this section that relate to the period specified under subsection

(5)shall be submitted by the Commission to the Comptroller and Auditor General for audit not later than 3 months after the date of the coming into operation of section 176 (b).

(5)The Minister may, for the purposes of subsection

(4), specify a period which— (

a)shall end on the date immediately preceding the date of the coming into operation of section 176 (b), and (
b)may be longer or shorter than a financial year of the Commission. Annual report 24.

(1)The Commission shall, not later than 30 June in each year— (

a)prepare a report on its activities in the immediately preceding year, and (
b)cause copies of the report to be laid before each House of the Oireachtas.

(2)Notwithstanding subsection

(1), if but for this subsection, the first report under this section would relate to a period of less than 6 months, the report shall relate to that period and to the year immediately following that period and shall be made as soon as may be, but not later than 6 months after the end of that year.

(3)The Commission may, at any time after subsection

(1)(b) has been complied with, publish its annual report in such form and manner as it considers appropriate.

(4)For the purposes of the law of defamation, a report under subsection

(1)shall be absolutely privileged. Accountability for accounts of Commission 25.

(1)The Commissioner, or where more than one Commissioner has been appointed under section 15 , the chairperson, is the accounting officer in relation to the appropriation accounts of the Commission for the purpose of the Comptroller and Auditor General Acts 1866 to 1998.

(2)Section 19

(2)of the Comptroller and Auditor General (Amendment) Act 1993 shall, in so far as it relates to data protection matters, not apply to the Commissioner or chairperson who is the accounting officer pursuant to subsection

(1). Prohibition on disclosure of confidential information 26.

(1)A relevant person shall not disclose confidential information obtained by him or her while performing functions under this Act or the Data Protection Regulation unless he or she is required or permitted by law, or duly authorised by the Commission, to do so.

(2)Subsection

(1)shall not operate to prevent the disclosure by a relevant person of information— (

a)in a report to the Commission or a Commissioner, (
b)to a Minister of the Government, and (
c)to a public authority, whether in the State or otherwise, for the purposes of facilitating cooperation between the Commission and such authority in the performance of their respective functions.

(3)Subject to section 154 , a person who contravenes subsection

(1)commits an offence and is liable on summary conviction to a class A fine.

(4)In this section— “confidential information” includes information that is expressed by the Commission to be confidential either as regards particular information or as regards information of a particular class or description; “relevant person” means— (

a)a Commissioner, (
b)a member of staff of the Commission, (
c)an authorised officer, (
d)any other person engaged under a contract for services by the Commission or a member of the staff of such a person, or (
e)a person who has acted in a capacity referred to in any of paragraphs (
a)to (d). Civil proceedings for contravention of section 26 27.

(1)A person who suffers loss or harm as a result of a contravention of section 26

(1)may, subject to section 154 , bring proceedings against the person specified in subsection

(2)seeking relief by way of— (

a)an injunction or declaration, or (
b)damages, or both.

(2)The person specified for the purposes of subsection

(1)is— (

a)where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking an injunction or declaration, the Commissioner, member of staff or authorised officer concerned, (
b)where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking damages, the Commission, and (
c)where it is alleged that the contravention was committed by a person other than a Commissioner, member of staff of the Commission or an authorised officer, that person.

(3)Proceedings under subsection

(1), in so far as they seek the relief referred to in paragraph (

b)of that subsection, shall be founded on tort. PART 3 Data Protection Regulation Chapter 1 General Fees 28. The Commission may, with the consent of the Minister, prescribe the fees to be paid to it— (
a)for the performance of its functions under Article 57

(1)(

r)and (s), and (
b)in relation to requests that are manifestly unfounded or excessive in accordance with Article 57

(4). Child for purposes of application of Data Protection Regulation

For the purposes of the application of the Data Protection Regulation in the State, a reference to “child” in the Regulation shall be taken to be a reference to a person under the age of 18 years. Micro-targeting and profiling of children
It shall be an offence under this Act for any company or corporate body to process the personal data of a child as defined by section 29 for the purposes of direct marketing, profiling or micro-targeting. Such an offence shall be punishable by an administrative fine under section 141 . Consent of child in relation to information society services 31.

(1)The age of a child specified for the purposes of Article 8 is 16 years of age.

(2)For the purposes of the application of Article 8 in the State, the reference in that Article to “information society services” does not include a reference to preventative or counselling services.

(3)The Minister shall— (a) not later than 3 years after the coming into operation of this section, commence a review of the operation of subsection

(1), and (b) complete that review not later than one year after its commencement. Codes of conduct: children 32.

(1)Without prejudice to the generality of Article 40, the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of the Data Protection Regulation with regard to— (

a)the protection of children, (
b)the information to be provided by a controller to children, (
c)the manner in which the consent of the holders of parental responsibility over a child is to be obtained for the purposes of Article 8, (
d)integrating the necessary safeguards into processing in order to protect the rights of children in an age-appropriate manner for the purpose of Article 25, and (
e)the processing of the personal data of children for the purposes of direct marketing and creating personality and user profiles.

(2)For the purpose of considering whether a draft code of conduct or an extension or amendment to an existing code of conduct referred to in Article 40 provides sufficient appropriate safeguards referred to in that Article, the Commission may, where the draft, extension or amendment, as the case may be, concerns the application of the Data Protection Regulation to children, consult with such persons as it considers appropriate including— (a) children and bodies who appear to the Commission to represent the interests of children, (b) the holders of parental responsibility over children, and (c) the Ombudsman for Children. Right to be forgotten: children 33.

(1)Subject to subsection

(3), in accordance with Article 17, a controller shall, at the request of a data subject, without undue delay erase personal data of the data subject where the data have been collected in relation to the offer to that data subject of information society services referred to in Article 8

(1).

(2)Subject to subsection

(3), where a controller has disclosed the personal data which are the subject of a request under subsection

(1)to another controller or controllers, the first-mentioned controller shall, taking account of available technology and the cost of implementation, take all reasonable steps, including technical measures, to inform the other controller or controllers which are processing that personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

(3)Subsections

(1)and

(2)shall not apply to the extent that the processing of the personal data concerned is necessary for the purposes set out in Article 17

(3). Designation of data protection officer 34.

(1)The Minister may, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations requiring controllers, processors, associations or other bodies representing categories of controllers or processors to designate a data protection officer in accordance with Article 37

(4).

(2)Regulations under subsection

(1)may apply to— (

a)one or more than one class of controller, (
b)one or more than one class of processor, or (
c)one or more than one class of association or other body representing categories of controllers or processors.

(3)In making regulations under subsection

(1)the Minister shall have regard to the need for the protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall have regard in particular to— (

a)the nature, scope, context and purposes of the processing, (
b)risks arising for the rights and freedoms of individuals, (
c)the likelihood and the severity of such risk for the individuals concerned, and (
d)the costs of implementation of any requirement if it were imposed under that subsection. Accreditation of certification bodies by Irish National Accreditation Board 35. The Irish National Accreditation Board is the accreditation body for the purposes of Article 43

(1). Suitable and specific measures for processing 36.

(1)Where a requirement that suitable and specific measures be taken to safeguard the fundamental rights and freedoms of data subjects in processing personal data of those subjects is imposed by this Act or regulations made under this Act, those measures may include in particular the following— (

a)explicit consent of the data subject for the processing of his or her personal data for one or more specified purposes, (
b)limitations on access to the personal data undergoing processing within a workplace in order to prevent unauthorised consultation, alteration, disclosure or erasure of personal data, (
c)strict time limits for the erasure of personal data and mechanisms to ensure that such limits are observed, (
d)specific targeted training for those involved in processing operations, and (
e)having regard to the state of the art, the context, nature, scope and purposes of data processing and the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subjects— (
i)logging mechanisms to permit verification of whether and by whom the personal data have been consulted, altered, disclosed or erased, (
ii)in cases in which it is not mandatory under the Data Protection Regulation, designation of a data protection officer, (iii) where the processing involves data relating to the health of a data subject, a requirement that the processing is undertaken by a person referred to in section 52

(2), (

iv)pseudonymisation of the personal data, and (
v)encryption of the personal data.

(2)Regulations may be made for either or both of the following purposes— (

a)to identify additional suitable and specific measures (to those referred to in paragraphs (
a)to (
e)of subsection

(1)) that may be taken to safeguard the fundamental rights and freedoms of data subjects in the processing of personal data of those subjects for the purposes of the requirement referred to in subsection

(1), (

b)to specify that a measure or measures referred to in paragraphs (
a)to (
e)of subsection

(1)or an additional measure or measures identified under paragraph (a), or both, is or are mandatory in respect of the processing to which they are stated to apply.

(3)Without prejudice to the generality of subsection

(2)(a), additional suitable and specific measures identified in regulations made under that subsection may relate to— (

a)governance structures, (
b)processes or procedures for risk assessment purposes, (
c)processes or procedures for the management and conduct of research projects, and (
d)other technical and organisational measures designed to ensure that the processing is carried out in accordance with the Data Protection Regulation and processes for testing and evaluating the effectiveness of such measures.

(4)Regulations under subsection

(2)may— (

a)identify different measures for different categories of personal data, different categories of controllers, different types of processing or categories of processing, and (
b)specify that a measure or measures referred to in subsection

(2)(b) is or are mandatory in respect of the processing of different categories of personal data, processing by different categories of controllers and in respect of different types of processing or categories of processing.

(5)Subject to subsection

(6), regulations may be made under subsection

(2)— (

a)by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or (
b)by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(6)The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection

(2).

(7)The Commission may, on being consulted under subsection

(6), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to— (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and (b) any other Committee (within the meaning of section 19

(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(8)In making regulations under subsection

(2), the Minister or any other Minister of the Government, as the case may be, shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing shall have regard to— (

a)the nature, scope, context and purposes of the processing, (
b)risks arising for the rights and freedoms of individuals, and (
c)the likelihood and the severity of the risks for the individuals concerned. Limitation on transfers of personal data outside the European Union 37.

(1)The Minister may, in the absence of an adequacy decision under Article 45, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations restricting the transfer of categories of personal data to a third country or an international organisation for important reasons of public policy.

(2)Regulations under subsection

(1)shall specify the important reasons of public policy for restricting the transfer concerned and may be expressed to apply by reference to one or more of the following— (

a)a category or categories of personal data, (
b)a third country or classes of third country, or (
c)an international organisation.

(3)In making regulations under subsection

(1), the Minister shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall in particular have regard to— (

a)the nature, scope, context and purposes of the processing, (
b)the desirability of facilitating international transfers of data, (
c)risks arising for the rights and freedoms of individuals, and (
d)the likelihood and the severity of such risks for individuals concerned. Processing for a task carried out in the public interest or in the exercise of official authority 38.

(1)The processing of personal data shall be lawful to the extent that such processing is necessary and proportionate for— (

a)the performance of a function of a controller conferred by or under an enactment or by the Constitution, or (
b)the administration by or on behalf of a controller of any non-statutory scheme, programme or funds where the legal basis for such administration is a function of a controller conferred by or under an enactment or by the Constitution.

(2)Subject to subsection

(3), the processing of personal data and disclosure of that data to a person for the purposes of preserving the Common Travel Area, or any part of that Area, shall be lawful where the controller is an Irish air carrier, an air carrier or a sea carrier.

(3)The Minister shall, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations for the purposes of subsection

(2)specifying— (

a)the part of the Common Travel Area to which the regulations apply, (
b)the personal data that may be processed, (
c)the circumstances in which the personal data may be disclosed, including specifying the person to whom the data may be disclosed, and (
d)such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(4)Subject to subsection

(5), the processing of personal data which is necessary for the performance of a task carried out in the public interest by a controller or which is necessary in the exercise of official authority vested in a controller may be specified in regulations made— (

a)by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or (
b)by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(5)The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection

(4).

(6)The Commission may, on being consulted under subsection

(5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to— (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and (b) any other Committee (within the meaning of section 19

(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(7)Regulations made under subsection

(4)shall specify— (

a)the personal data that may be processed, (
b)the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and (
c)such other conditions (if any) as the Minister or any other Minister of the Government, as the case may be, considers appropriate to impose on such processing.

(8)In this section— “air carrier” means an undertaking established in the State that provides air services; “air service” has the meaning it has in Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 20087 on common rules for the operation of air services in the Community (Recast); “Common Travel Area” means the State, the United Kingdom of Great Britain and Northern Ireland, the Channel Islands and the Isle of Man; “Irish air carrier” means an undertaking with a valid operating licence, within the meaning of Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 20088 , granted by the Commission for Aviation Regulation; “passenger” means a person carried by an air carrier on an aircraft, or as the case may be, a sea carrier in a passenger ship, other than a member of the crew of the aircraft or passenger ship concerned; “passenger ship” means a sea-going ship that carries more than 12 passengers; “sea carrier” means an undertaking established in the State that, for remuneration, carries passengers by sea in a passenger ship. Communication with data subjects by political parties, candidates for and holders of certain elective political offices 39.

(1)A specified person may, in the course of that person’s electoral activities in the State, use the personal data of a data subject for the purpose of communicating in writing (including by way of newsletter or circular) with the data subject.

(2)Communicating in accordance with subsection

(1)shall, for the purposes of Article 6

(1)(e), be considered to be the performance of a task carried out in the public interest.

(3)In this section, “specified person” means— (

a)a political party, (
b)a member of either House of the Oireachtas, the European Parliament or a local authority, or (
c)a candidate for election to the office of President of Ireland or for membership of either House of the Oireachtas, the European Parliament or a local authority.

(4)In this section and in sections 48 , 58 and 59 , “electoral activities” includes the dissemination of information, including information as to a person’s activities and policies, that might reasonably be of interest to electors. Processing of personal data and special categories of personal data by elected representatives 40.

(1)For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection

(2), he or she receives a request or representation from another person on behalf of the data subject.

(2)A person may make a request or representation on behalf of a data subject where the data subject— (

a)has given his or her consent to the making of the request or representation, as the case may be, or (
b)is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

(3)In processing special categories of personal data under subsection

(1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

(4)For the purpose referred to in subsection

(1)and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation.

(5)In this section, “elected representative” means— (

a)a member of either House of the Oireachtas, (
b)a member of the European Parliament, (
c)a member of a local authority. Processing for purpose other than purpose for which data collected 41. Without prejudice to the processing of personal data for a purpose other than the purpose for which the data has been collected which is lawful under the Data Protection Regulation, the processing of personal data and special categories of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing is necessary and proportionate for the purposes— (
a)of preventing a threat to national security, defence or public security, (
b)of preventing, detecting, investigating or prosecuting criminal offences, or (
c)set out in paragraph (
a)or (
b)of section 47 . Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 42.

(1)Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, personal data may be processed, in accordance with Article 89, for— (a) archiving purposes in the public interest, (b) scientific or historical research purposes, or (c) statistical purposes.

(2)Processing of personal data for the purposes referred to in subsection

(1)shall respect the principle of data minimisation.

(3)Where the purposes referred to in paragraph (a), (b) or (c) of subsection

(1)can be fulfilled by processing which does not permit, or no longer permits, identification of data subjects, the processing of information for such purposes shall be fulfilled in that manner. Data processing and freedom of expression and information 43.

(1)The processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with a provision of the Data Protection Regulation specified in subsection

(2)where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes.

(2)The provisions of the Data Protection Regulation specified for the purposes of subsection

(1)are Chapter II (principles), other than Article 5

(1)(f), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries and international organisations), Chapter VI (independent supervisory authorities) and Chapter VII (cooperation and consistency).

(3)The Commission may, on its own initiative, refer any question of law which involves consideration of whether processing of personal data is exempt in accordance with subsection

(1)to the High Court for its determination.

(4)An appeal shall, by leave of the High Court, lie from a determination of that Court on a question of law under subsection

(3)to the Court of Appeal.

(5)In order to take account of the importance of the right to freedom of expression and information in a democratic society that right shall be interpreted in a broad manner. Data processing and public access to official documents 44.

(1)For the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to the record is granted under and in accordance with the Act of 2014 pursuant to an FOI request.

(2)For the purposes of Article 86, personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the Access to Information on the Environment Regulations pursuant to a request within the meaning of those Regulations.

(3)In this section— “Access to Information on the Environment Regulations” means the European Communities (Access to Information on the Environment) Regulations 2007 ( S.I. No. 133 of 2007 ); “Act of 2014” means the Freedom of Information Act 2014 ; “environmental information” has the same meaning as it has in the Access to Information on the Environment Regulations; “FOI request” has the same meaning as it has in the Act of 2014; “record” has the same meaning as it has in the Act of 2014. Chapter 2 Processing of special categories of personal data and processing of personal data relating to criminal convictions and offences Processing of special categories of personal data 45. Subject to compliance with the Data Protection Regulation and any other relevant enactment or rule of law, the processing of special categories of personal data shall be lawful to the extent the processing is— (

a)authorised by section 41 and sections 46 to 54 , or (
b)otherwise authorised by Article 9. Processing of special categories of personal data for purposes of employment and social welfare law 46. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law. Processing of special categories of personal data for purpose of legal advice and legal proceedings 47. The processing of special categories of personal data shall be lawful where the processing— (
a)is necessary for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or (
b)is otherwise necessary for the purposes of establishing, exercising or defending legal rights. Processing of personal data revealing political opinions for electoral activities and functions of Referendum Commission 48. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of personal data revealing political opinions shall be lawful where the processing is carried out— (
a)in the course of electoral activities in the State for the purpose of compiling data on peoples’ political opinions by— (
i)a political party, or (
ii)a candidate for election to, or a holder of, elective political office in the State, and (
b)by the Referendum Commission in the performance of its functions. Processing of special categories of personal data for purposes of administration of justice and performance of functions 49. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing respects the essence of the right to data protection and is necessary and proportionate for— (
a)the administration of justice, or (
b)the performance of a function conferred on a person by or under an enactment or by the Constitution. Processing of special categories of personal data for insurance and pension purposes 50. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of data concerning health shall be lawful where the processing is necessary and proportionate for the purposes of the following: (
a)a policy of insurance or life assurance, (
b)a policy of health insurance or health-related insurance, (
c)an occupational pension, a retirement annuity contract or any other pension arrangement, or (
d)the mortgaging of property. Processing of special categories of personal data and Article 10 data for reasons of substantial public interest 51.

(1)Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection

(3).

(2)Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection

(3).

(3)Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following— (

a)special categories of personal data, and (
b)without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 , Article 10 data.

(4)Without prejudice to the generality of subsection

(3), regulations made under that subsection shall identify— (

a)the substantial public interest concerned, and (
b)the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(5)For the purposes of subsection

(4)(b), subsections

(2)to

(8)of section 36 shall apply in like manner to regulations made under subsection

(3)as they apply to regulations made under section 36 .

(6)Regulations may be made under subsection

(3)by— (

a)the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or (
b)any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(7)The Minister or any other Minister of the Government, as the case may be, making regulations under subsection

(3)shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to— (

a)the nature, scope and purposes of the processing, (
b)the nature of the substantial public interest concerned, (
c)any benefits likely to arise for the data subjects concerned, (
d)any risks arising for the rights and freedoms of such subjects, and (
e)the likelihood of any such risks arising and the severity of such risks.

(8)Regulations made under subsection

(3)shall— (

a)respect the essence of the right to data protection, and (
b)enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(9)In this section, “Article 10 data” has the meaning assigned to it by section 55 . Processing of special categories of personal data for purposes of Article 9

(2)(h) 52.

(1)Subject to subsection

(2)and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary— (

a)for the purposes of preventative or occupational medicine, (
b)for the assessment of the working capacity of an employee, (
c)for medical diagnosis, (
d)for the provision of medical care, treatment or social care, (
e)for the management of health or social care systems and services, or (
f)pursuant to a contract with a health practitioner.

(2)Processing shall be lawful in accordance with subsection

(1)where it is undertaken by or under the responsibility of— (

a)a health practitioner, or (
b)a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner.

(3)In this section, “health practitioner” has the same meaning as it has in the Health Identifiers Act 2014 . Processing of special categories of personal data for purposes of public interest in the area of public health 53. Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary for public interest reasons in the area of public health including— (

a)protecting against serious cross-border threats to health, and (
b)ensuring high standards of quality and safety of health care and of medicinal products and medical devices. Processing of special categories of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 54. Subject to compliance with section 42 , the processing of special categories of personal data is lawful where such processing is necessary and proportionate for— (
a)archiving purposes in the public interest, (
b)scientific or historical research purposes, or (
c)statistical purposes. Processing of personal data relating to criminal convictions and offences 55.

(1)Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to compliance with Article 6

(1)and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, personal data referred to in Article 10 (in this section referred to as “Article 10 data”) may be processed— (

a)under the control of official authority, or (
b)where— (
i)the data subject has given explicit consent to the processing for one or more specified purposes except where the law of the European Union or the law of the State prohibits such processing, (
ii)processing is necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract, (iii) processing is— (I) necessary for the purpose of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or (II) otherwise necessary for the purposes of establishing, exercising or defending legal rights, (
iv)processing is necessary to prevent injury or other damage to the data subject or another person or loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or another person, or (
v)processing is permitted in regulations made under subsection

(3)or is otherwise authorised by the law of the State.

(2)Processing under the control of official authority referred to in subsection

(1)(

a)includes processing required for the following purposes: (
a)the administration of justice; (
b)the exercise of a regulatory, authorising or licensing function or determination of eligibility for benefits or services; (
c)protection of the public against harm arising from dishonesty, malpractice, breaches of ethics or other improper conduct by, or the unfitness or incompetence of, persons who are or were authorised to carry on a profession or other activity; (
d)enforcement actions aimed at preventing, detecting or investigating breaches of the law of the European Union or the law of the State that are subject to civil or administrative sanctions; (
e)archiving in the public interest, scientific or historical research purposes or statistical purposes where the processing is carried out in accordance with section 42 for those purposes by or on behalf of a public authority or public body.

(3)Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject and subject to subsection

(7), regulations may be made permitting the processing of Article 10 data where the processing is necessary and proportionate to— (

a)assess the risk of fraud or prevent fraud, (
b)assess the risk of bribery or corruption, or both, or to prevent bribery or corruption, or both, or (
c)ensure network and information systems security, and prevent attacks on and damage to computer and electronic communications systems.

(4)Subject to subsection

(5), regulations may be made under subsection

(3)— (

a)by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or (
b)by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(5)The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection

(3).

(6)The Commission may, on being consulted under subsection

(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(7)The Minister or any other Minister of the Government, as the case may be, making regulations under subsection

(3)shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to— (

a)the nature, scope and purposes of the processing, (
b)any risks arising for the rights and freedoms of individuals, and (
c)the likelihood of any such risks arising and the severity of such risks.

(8)A person who knowingly or recklessly contravenes this section or any regulations made under subsection

(3)shall be guilty of an offence and shall be liable— (

a)on summary conviction to a class A fine or imprisonment for a term not exceeding 12 months or both, or (
b)on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

(9)In this section, “Article 10 data” shall include personal data relating to the alleged commission of an offence and any proceedings in relation to such an offence. Chapter 3 Rights, and restrictions of rights, of data subject and restrictions on obligations of controllers Right of access to results and scripts of examination and results of appeal 56.

(1)Subject to subsection

(3), a request by a data subject under Article 15 in relation to the result of an examination at which he or she was a candidate, or in relation to a script completed by him or her in the course of such an examination shall, for the purposes of that Article, be taken to have been made on the later of— (a) the date of the first publication of the results of the examination, or (b) the date of the request.

(2)A request by a data subject under Article 15 in relation to the result of an appeal by the data subject against the result of an examination at which he or she was a candidate shall, for the purposes of that Article, be taken to have been made on the later of— (a) the date of the first publication of the results of the appeal, or (b) the date of the request.

(3)Where— (a) a request by a data subject referred to in subsection

(1)relates to a script completed by him or her in the course of an examination in the Leaving Certificate Examinations conducted by the State Examinations Commission, and (b) the data subject, whether before or after the making of that request, appeals the result of the examination referred to in paragraph (a), that request shall be taken to have been made on the date of the first publication of the results of the appeal referred to in paragraph (b).

(4)In this section— “appeal” means any formal process to enable a candidate to request a recheck of an examination result which is specified by a person who operates the examination; “examination” means any process for determining the knowledge, intelligence, skill or ability of a person by reference to his or her performance in any test, work or other activity; “script” means any work produced by a candidate as part of an examination including any examination answer-book (whether in written or digital form), journal, portfolio, audio and visual recording, practical piece or artefact and, for the purposes of this definition, shall be deemed to include— (a) an audio or visual recording, produced in the course of an examination, of the performance of the candidate in the examination, and (b) any marks or comments added to the script, or made in relation to the script, by an examiner in the course of his or her marking of the script. Rights in relation to automated decision making 57.

(1)Subject to Article 22

(4)and to suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject, for the purposes of Article 22

(2)(b), the right of a data subject not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her shall, in addition to the grounds identified in Article 22

(2)(

a)and (c), not apply where— (
a)the decision is authorised or required by or under an enactment, and (
b)either— (
i)the effect of that decision is to grant a request of the data subject, or (
ii)in all other cases (where subparagraph (
i)is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to— (I) make representations to the controller in relation to the decision, (II) request human intervention in the decision-making process, (III) request to appeal the decision.

(2)In the case of requests made under subsection

(1)(b)(ii)(II) or (III) the controller shall— (

a)comply with the request, and (
b)notify the data subject in writing of— (
i)the steps taken to comply with the request, and (
ii)in the case of an appeal under subsection

(1)(b)(ii)(III), the outcome of the appeal. Direct marketing for purposes of Article 21 58. For the purposes of the application of Article 21 in the State, the reference to “direct marketing” includes a reference to direct mailing other than direct mailing carried out— (

a)in the course of electoral activities in the State by— (
i)a political party or its members, or (
ii)a candidate for election to, or a holder of, elective political office in the State, and (
b)by the Referendum Commission in the performance of its functions. Restriction on right of data subject to object to processing for election purposes and processing by Referendum Commission 59. The right of a data subject to object at any time to the processing of personal data concerning him or her under Article 21 shall not apply to processing carried out— (
a)in the course of electoral activities in the State by— (
i)a political party, or (
ii)a candidate for election to, or a holder of, elective political office in the State, and (
b)by the Referendum Commission in the performance of its functions. Restrictions on obligations of controllers and rights of data subjects for important objectives of general public interest 60.

(1)The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22— (a) are restricted to the extent specified in subsection

(3), and (b) may be restricted in regulations made under subsections

(5)or

(6).

(2)Subsection

(1)is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.

(3)Subject to subsection

(4), the rights and obligations referred to in subsection

(1)are restricted to the extent that— (

a)the restrictions are necessary and proportionate— (
i)to safeguard cabinet confidentiality, parliamentary privilege, national security, defence and the international relations of the State, (
ii)for the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties, (iii) for the administration of any tax, duty or other money due or owing to the State or a local authority in any case in which the non-application of the restrictions concerned would be likely to prejudice the aforementioned administration, (
iv)in contemplation of or for the establishment, exercise or defence of, a legal claim, prospective legal claim, legal proceedings or prospective legal proceedings whether before a court, statutory tribunal, statutory body or an administrative or out-of-court procedure, (
v)for the enforcement of civil law claims, including matters relating to any liability of a controller or processor in respect of damages, compensation or other liabilities or debts related to the claim, or (
vi)for the purposes of estimating the amount of the liability of a controller on foot of a claim for the payment of a sum of money, whether in respect of damages or compensation, in any case in which the application of those rights or obligations would be likely to prejudice the commercial interests of the controller in relation to the claim, (
b)the personal data relating to the data subject consist of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential to a person who has a legitimate interest in receiving the information, or (
c)the personal data concerned are kept— (
i)by the Commission for the performance of its functions, (
ii)by the Information Commissioner for the performance of his or her functions, or (iii) by the Comptroller and Auditor General for the performance of his or her functions.

(4)The Minister may prescribe requirements to be complied with when the rights and obligations referred to in subsection

(1)are restricted in accordance with subsection

(3).

(5)Subject to subsection

(9), regulations may be made by a Minister of the Government where he or she considers it necessary for the protection of a data subject or the rights and freedoms of others restricting the rights and obligations referred to in subsection

(1)— (

a)(
i)if the application of those rights and obligations would be likely to cause serious harm to the physical or mental health of the data subject, and (
ii)to the extent to which, and for as long as, such application would be likely to cause such serious harm, and (
b)in relation to personal data kept for, or obtained in the course of, the carrying out of social work by a public authority, public body, a voluntary organisation or other body.

(6)Subject to subsection

(9), regulations may be made restricting the rights and obligations referred to in subsection

(1)where such restrictions are necessary for the purposes of safeguarding important objectives of general public interest and such regulations shall include, where appropriate, specific provisions required by Article 23

(2).

(7)Important objectives of general public interest referred to in subsection

(6)include: (

a)preventing threats to public security and public safety; (
b)avoiding obstructions to any official or legal inquiry, investigation or process, including any out-of-court redress procedure, proceedings pending or due before a court, tribunal of inquiry or commission of investigation; (
c)preventing, detecting, investigating and prosecuting breaches of discipline by, or the unfitness or incompetence of, persons who are or were authorised by law to carry on a profession or any other regulated activity and the imposition of sanctions for same; (
d)preventing, detecting, investigating or prosecuting breaches of ethics for regulated professions; (
e)taking any action for the purposes of considering and investigating a complaint made to a regulatory body in respect of a person carrying out a profession or other regulated activity where the profession or activity is regulated by that body and the imposition of sanctions on foot of such a complaint; (
f)preventing, detecting, investigating or prosecuting, whether in the State or elsewhere, breaches of the law which are subject to civil or administrative sanctions and enforcing such sanctions; (
g)the identification of assets which are derived from, or are suspected to derive from, criminal conduct and the taking of appropriate action to deprive or deny persons of those assets or the benefits of those assets and any investigation or preparatory work in relation to any related proceedings; (
h)ensuring the effective operation of the immigration system, the system for granting persons international protection in the State and the system for the acquisition by persons of Irish citizenship, including by preventing, detecting and investigating abuses of those systems or breaches of the law relating to those systems; (
i)safeguarding the economic or financial interests of the European Union or the State, including on monetary, budgetary and taxation matters; (
j)safeguarding monetary policy, the smooth operation of payment systems, the resolution of regulated financial service providers (within the meaning of the Central Bank Act 1942 ), the operation of deposit-guarantee schemes, the protection of consumers and the effective regulation of financial service providers (within the meaning of the Central Bank Act 1942 ); (
k)protecting members of the public against— (
i)financial loss or detriment due to the dishonesty, malpractice or other improper conduct of, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate or other entities, (
ii)financial loss or detriment due to the conduct of individuals who have been adjudicated bankrupt, or (iii) financial loss or detriment due to the conduct of individuals who have been involved in the management of a body corporate which has been the subject of a receivership, examinership or liquidation under the Act of 2014; (
l)protecting— (
i)the health, safety, dignity, well-being of individuals at work against risks arising out of or in connection with their employment, and (
ii)members of the public against discrimination or unfair treatment in the provision of goods or services to them; (
m)the keeping of public registers for reasons of general public interest, whether the registers are accessible to the public on a general or restricted basis; (
n)safeguarding the integrity and security of examinations systems; (
o)safeguarding public health, social security, social protection and humanitarian activities.

(8)Where the rights and obligations referred to in subsection

(1)are restricted in regulations made under subsection

(6)on the basis of important objectives of general public interest of the State, other than the objectives referred to in subsection

(7), the important objective or objectives of general public interest shall be identified in those regulations.

(9)Subject to subsection

(10), regulations may be made under subsection

(5)or

(6)— (

a)by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or (
b)by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(10)The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection

(5)or

(6).

(11)The Commission may, on being consulted under subsection

(10), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to— (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and (b) any other Committee (within the meaning of section 19

(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(12)Regulations made under this section shall— (

a)respect the essence of the right to data protection and protect the interests of the data subject, and (
b)restrict the exercise of data subjects’ rights only in so far as is necessary and proportionate to the aim sought to be achieved. Restriction on exercise of data subjects’ rights: archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 61.

(1)Subject to subsection

(3), where processing of data is for archiving purposes in the public interest, the rights of a data subject set out in Articles 15, 16, 18, 19, 20 and 21 are restricted to the extent that— (

a)the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and (
b)such restriction is necessary for the fulfilment of those purposes.

(2)Subject to subsection

(4), where processing of data is for scientific or historical research purposes or statistical purposes, the rights of a data subject set out in Articles 15, 16, 18 and 21 are restricted to the extent that— (

a)the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and (
b)such restriction is necessary for the fulfilment of those purposes.

(3)Where data is being processed for purposes referred to in subsection

(1)and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection.

(4)Where data is being processed for purposes referred to in subsection

(2)and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection. PART 4 Provisions Consequent on Repeal of Certain Provisions of Data Protection Act 1988 Transfer of property of Data Protection Commissioner to Commission 62.

(1)On the establishment day, all property (other than land), including choses-in-action, that immediately before that day was vested in the Data Protection Commissioner shall stand vested in the Commission.

(2)Every chose-in-action vested in the Commission by virtue of subsection

(1)may, on and from the establishment day, be sued on, recovered or enforced by the Commission in its own name, and it shall not be necessary for the Commission to give notice to any person bound by the chose-in-action of the vesting effected by that subsection.

(3)On the establishment day all records that, immediately before that day, were records of the Data Protection Commissioner shall be records of the Commission and shall, accordingly, be transferred to the Commission. Transfer of rights and liabilities of Data Protection Commissioner to Commission 63.

(1)All rights and liabilities of the Data Protection Commissioner subsisting immediately before the establishment day and arising by virtue of any contract or commitment (express or implied) shall on that day stand transferred to the Commission.

(2)Every right and liability transferred by subsection

(1)to the Commission may, on and after the establishment day, be sued on, recovered or enforced by or against the Commission in its own name, and it shall not be necessary for the Commission to give notice to the person whose right or liability is transferred by that subsection of such transfer. Liability for loss occurring before establishment day 64.

(1)A claim in respect of any loss or injury alleged to have been suffered by any person arising out of the performance before the establishment day of any of the functions of the Data Protection Commissioner shall after that day, lie against the Commission and not against the Data Protection Commissioner.

(2)Any legal proceedings pending immediately before the establishment day to which the Data Protection Commissioner is a party, shall be continued, with the substitution in the proceedings of the Commission for the Data Protection Commissioner.

(3)Where, before the establishment day, agreement has been reached between the parties concerned in settlement of a claim to which subsection

(1)relates, the terms of which have not been implemented, or judgment in such a claim has been given in favour of a person but has not been enforced, the terms of the agreement or judgment, as the case may be, shall, in so far as they are enforceable against the Data Protection Commissioner, be enforceable against the Commission and not the Data Protection Commissioner.

(4)Any claim made or proper to be made by the Data Protection Commissioner in respect of any loss or injury arising from the act or default of any person before the establishment day shall be regarded as having been made by or proper to be made by the Commission and may be pursued and sued for by the Commission as if the loss or injury had been suffered by the Commission. Provisions consequent upon transfer of functions, assets, rights and liabilities to Commission 65.

(1)Anything commenced and not completed before the establishment day by or under the authority of the Data Protection Commissioner may, in so far as it relates to a function transferred to the Commission under section 14 , be carried on or completed on or after the establishment day by the Commission.

(2)Every instrument made under an enactment and every document (including any certificate or notice) granted, made or issued, in the performance of a function transferred by section 14 , shall, if and in so far as it was operative immediately before the establishment day, have effect on and after that day as if it had been granted, made or issued by the Commission.

(3)References to the Data Protection Commissioner in the memorandum or articles of association of any company shall, on and after the establishment day, be construed as references to the Commission.

(4)A certificate signed by the Minister that any property, right or liability has or, as the case may be, has not vested in the Commission under section 62 or 63 shall be sufficient evidence, unless the contrary is shown, of the fact so certified for all purposes. Final accounts and final annual report of Data Protection Commissioner 66.

(1)The Commission shall, in respect of the period specified under subsection

(3), prepare final accounts of the Data Protection Commissioner.

(2)The Commission shall submit the final accounts to the Comptroller and Auditor General for audit not later than 3 months after the establishment day.

(3)For the purposes of subsection

(1), the Minister may specify a period that is longer or shorter than a financial year of the Data Protection Commissioner.

(4)The Commission shall prepare the final annual report for the Data Protection Commissioner and cause a copy of the report to be laid before each House of the Oireachtas not later than 6 months after the establishment day. Saver for scheme relating to superannuation 67. A scheme made under section 9 and paragraph 7(

a)of the Second Schedule to the Act of 1988 that was in force immediately prior to coming into operation of section 7 in so far as it relates to the repeal of section 9 and paragraph 7(
a)of the Second Schedule to the Act of 1988 shall continue in force on and after that coming into operation as if the scheme had been made under section 22 and— (
a)a person who was a member of the scheme on that coming into operation shall continue to be a member, and (
b)the provisions of that section shall apply accordingly. Saver for regulations under Act of 1988 68.

(1)Notwithstanding subsection

(1)of section 8 , the Data Protection Act 1988 (Section 2A) Regulations 2013 ( S.I. No. 313 of 2013 ) and the Data Protection Act 1988 (Section 2A) Regulations 2016 ( S.I. No. 220 of 2016 ) shall, in addition to applying for the purposes referred to in that subsection, apply for all other purposes for which they applied immediately before the commencement of that subsection and, in so far only as they apply for the second-mentioned purposes, they shall be deemed to have been made under section 38 and may be amended or revoked accordingly.

(2)(a) The Data Protection Health Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4

(8)of the Act of 1988) until the first set of regulations are made under section 60

(5)(a). (

b)The Data Protection Health Regulations are amended— (
i)in Regulation 3, by— (I) the deletion of the definition of “the Act”, (II) the deletion of the definition of “health professional”, and (III) the insertion of the following definitions: “ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20169 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); ‘health practitioner’ has the same meaning as it has in the Health Identifiers Act 2014 .”, (
ii)in Regulation 4

(1), by— (I) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4

(1)(a) of the Act”, and (II) the substitution of “the physical or mental health of the data subject, but this restriction on providing information applies only to the extent to which, and for so long as, that likelihood pertains.” for “the physical or mental health of the data subject.”, (iii) in Regulation 5, by— (I) the substitution of “health practitioner”

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.