(I) the substitution of “health practitioner” for “health professional” in each place it occurs, (II) the substitution, in paragraph (1)(a), of “a request under the said Article 15 of the Data Protection Regulation” for “a request under the said section 4(1)(a)”, and (III) the substitution, in paragraph (2)(a), of “within the meaning of section 2 of the Medical Practitioners Act 2007 or a medical practitioner practising medicine pursuant to section 50 of that Act” for “within the meaning of the Medical Practitioners Act 1978 (No. 4 of 1978), or registered dentist, within the meaning of the Dentists Act 1985 (No. 9 of 1985)”, and (iv) by the deletion of Regulation 6. (c) A request referred to in Regulation 4(1) of the Data Protection Health Regulations which includes a request for health data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.
\n
(3)(a) The Data Protection Social Work Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 60
\n
(5)(b). (b) The Data Protection Social Work Regulations are amended— (i) in Regulation 3, by— (I) the deletion of the definition of “the Act”, (II) the insertion of the following definition: “ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 201610 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”, and (III) the substitution of the following definition for the definition of “social work data”: “ ‘social work data’ means personal data kept for, or obtained in the course of, carrying out social work by a public authority, public body, voluntary organisation or other body but excludes any health data within the meaning of the Data Protection (Access Modification) (Health) (Regulations) 1989 ( S.I. No. 82 of 1989 ) and ‘social work’ shall be construed accordingly.”, (ii) in Regulation 4— (I) in paragraph (1), by— (A) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and (B) the substitution of “the physical or mental health or emotional condition of the data subject, but this restriction on providing information applies only to the extent to which, and for as long as, that likelihood pertains.” for “the physical or mental health or emotional condition of the data subject.”, and (II) in paragraph (3), by the substitution of “under Article 15 of the Data Protection Regulation” for “under section 4(1)(a) of the Act”, and (iii) the deletion of Regulation 5. (c) A request referred to in Regulation 4(1) of the Data Protection Social Work Regulations which includes a request for social work data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.
\n
(4)The Regulations of 2011 shall apply to— (a) each special category of personal data that, immediately before the coming into operation of this section— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement, and (b) Article 10 data that, immediately before such coming into operation— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.
\n
(5)The Regulations of 2011 are amended— (a) in Regulation 3, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”, (b) in Regulation 4, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”, and (c) by the insertion of the following Regulation after Regulation 6: “7. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.
\n
(6)The Regulations of 2015 shall, in addition to applying to sensitive personal data to which the Act of 1988 applies, apply to— (a) each special category of personal data that, immediately before the coming into operation of this section— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement, and (b) Article 10 data that, immediately before such coming into operation— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.
\n
(7)The Regulations of 2015 are amended— (a) in Regulation 2, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and (b) by the insertion of the following Regulation after Regulation 2: “3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.
\n
(8)The Regulations of 2016 shall, in addition to applying to sensitive personal data to which the Act of 1988 applies, apply to— (a) each special category of personal data that, immediately before the coming into operation of this section— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such commencement, and (b) Article 10 data that, immediately before such coming into operation— (i) constituted sensitive personal data to which those Regulations applied, or (ii) would have constituted sensitive personal data to which those Regulations applied had the data existed immediately before such coming into operation.
\n
(9)The Regulations of 2016 are amended— (a) in Regulation 2, by the substitution of “Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and (b) by the insertion of the following Regulation after Regulation 2: “3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 36 of the Data Protection Act 2018.”.
\n
(10)In this section— “Article 10 data” has the meaning assigned to it in section 55 ; “Data Protection Health Regulations” means the Data Protection (Access Modification) (Health) Regulations 1989 ( S.I. No. 82 of 1989 ); “Data Protection Social Work Regulations” means the Data Protection (Access Modification) (Social Work) Regulations 1989 ( S.I. No. 83 of 1989 ); “Regulations of 2011” means the Data Protection Act 1988 (Section 2B) Regulations 2011 ( S.I. No. 486 of 2011 ); “Regulations of 2015” means the Data Protection Act 1988 (Section 2B) Regulations 2015 ( S.I. No. 240 of 2015 ); “Regulations of 2016” means the Data Protection Act 1988 (Section 2B) (No. 2) Regulations 2016 ( S.I. No. 427 of 2016 ); “sensitive personal data” has the meaning assigned to it by the Act of 1988.
\n
PART 5
\n
Processing of Personal Data for Law Enforcement Purposes
\n
Chapter 1
\n
Preliminary and general (Part 5) Interpretation (Part 5) 69. (1) In this Part— “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual that allow or confirm the unique identification of the individual, including facial images or dactyloscopic data; “competent authority”, subject to subsection (2), means— (a) a public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security, or (b) any other body or entity authorised by law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security; “controller”, subject to subsection (2), means— (a) a competent authority that, whether alone or jointly with others, determines the purposes and means of the processing of personal data, or (b) where the purposes and means of the processing of personal data are determined by the law of the European Union or otherwise by the law of the State, a controller nominated— (i) by that law, or (ii) in accordance with criteria specified in that law; “data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services to the individual, that reveal information about the status of his or her health; “data protection impact assessment” has the meaning assigned to it by section 84
\n
(1); “data protection officer” has the meaning assigned to it by section 88
\n
(1); “data subject” means an individual to whom personal data relate; “genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual that give unique information about the physiology or the health of the individual and that result, in particular, from an analysis of a biological sample from the individual in question; “international organisation” means— (a) an organisation, and subordinate bodies of an organisation, governed by public international law, or (b) any other body that is established by, or on the basis of, an agreement between two or more states; “joint controller” has the meaning assigned to it by section 79
\n
(1); “online identifier” includes an internet protocol address, a cookie identifier or other identifier such as a radio frequency identification tag; “personal data” means information relating to— (a) an identified living individual, or (b) a living individual who can be identified from the data, directly or indirectly, in particular by reference to— (i) an identifier such as a name, an identification number, location data or an online identifier, or (ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual; “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; “processing”, of or in relation to personal data, means an operation or a set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, including— (a) the collection, recording, organisation, structuring or storing of the data, (b) the adaptation or alteration of the data, (c) the retrieval, consultation or use of the data, (d) the disclosure of the data by their transmission, dissemination or otherwise making the data available, (e) the alignment or combination of the data, or (f) the restriction, erasure or destruction of the data; “processor” means an individual who, or a legal person, public authority, agency or other body that, processes personal data on behalf of a controller, but does not include an employee of a controller who processes such data in the course of his or her employment; “profiling” means any form of automated processing of personal data consisting of the use of the data to evaluate certain personal aspects relating to an individual, including to analyse or predict aspects concerning the individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; “pseudonymisation” means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that— (a) such additional information is kept separately from the data, and (b) is subject to technical and organisational measures to ensure that the data are not attributed to an identified or identifiable individual; “rectification”, of or in relation to personal data, includes, where the data concerned are incomplete, the completion of the data, whether by means of a supplementary statement or otherwise;
\n
“recipient”, of or in relation to personal data, means an individual to whom, or a legal person, public authority, agency or other body to which, the data are disclosed, and includes a third party; “relevant filing system” means a set of personal data, whether centralised, decentralised or dispersed on a functional or geographical basis, where the set is structured according to specific criteria in such a way that the data are readily accessible according to those criteria; “restrict”— (a) in relation to the exercise of the right of a data subject— (i) under section 87
\n
(1)to be notified of a personal data breach, (ii) under section 92
\n
(10)to be notified of the restriction of the processing of personal data under subsection (9) of that section, or (iii) under section 92
\n
(11)to be notified of a decision not to rectify or erase data pursuant to a request under subsection (1) or (3) of that section, as the case may be, means— (I) to delay the notification concerned, (II) to limit the information contained in the notification concerned, or (III) not to make the notification concerned, and (b) in relation to the exercise of the right of a data subject— (i) under section 90
\n
(1)in so far as relates to the provision to the data subject of information specified in subsection (2)(f) of that section, or (ii) under section 91
\n
(1)(a) or (b), means— (I) to delay the provision of the information concerned, (II) to limit the information concerned provided to the data subject, or (III) not to provide the information concerned; “restriction of processing” means the marking, by or on behalf of a controller, of personal data for which the controller is responsible for the purpose of limiting their processing in the future; “special categories of personal data” means— (a) personal data revealing— (i) the racial or ethnic origin of the data subject, (ii) the political opinions or the religious or philosophical beliefs of the data subject, or (iii) whether the data subject is a member of a trade union, (b) genetic data, (c) biometric data for the purposes of uniquely identifying an individual, (d) data concerning health, or (e) personal data concerning an individual’s sex life or sexual orientation.
\n
(2)Where a reference is made in this Part— (a) to a controller in a Member State other than the State, for the purposes of that reference— (i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the Member State concerned”, and (ii) in the definition of “controller” in subsection (1), the reference to “the law of the State” shall be construed as meaning “the law of the Member State concerned”, or (b) to a controller in a third country, for the purposes of that reference— (i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the state concerned”, and (ii) in the definition of “controller” in subsection (1), the reference to “the law of the European Union or the law of the State” shall be construed as meaning “the law of the state concerned”.
\n
(3)A word or expression that is used in this Part and is also used in the Directive has, unless the context otherwise requires, the same meaning in this Part as it has in the Directive.
\n
Application of Part 5 70. (1) This Part applies, subject to subsection (2), to the processing of personal data by or on behalf of a controller where the processing is carried out— (a) for the purposes of— (i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security, or (ii) the execution of criminal penalties, and (b) by means that— (i) are wholly or partly automated, or (ii) where the personal data form part of, or are intended to form part of, a relevant filing system, are not automated.
\n
(2)This Part shall not apply to the processing of personal data— (a) that occurs in the course of an activity falling outside the scope of the law of the European Union, (b) by an institution, body, office or agency of the European Union, or (c) to which section 8
\n
(1)(b) applies.
\n
Chapter 2
\n
General principles of data protection Processing of personal data 71. (1) A controller shall, as respects personal data for which it is responsible, comply with the following provisions: (a) the data shall be processed lawfully and fairly; (b) the data shall be collected for one or more specified, explicit and legitimate purposes and shall not be processed in a manner that is incompatible with such purposes; (c) the data shall be adequate, relevant and not excessive in relation to the purposes for which they are processed; (d) the data shall be accurate, and, where necessary, kept up to date, and every reasonable step shall be taken to ensure that data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; (e) the data shall be kept in a form that permits the identification of a data subject for no longer than is necessary for the purposes for which the data are processed; (f) the data shall be processed in a manner that ensures appropriate security of the data, including, by the implementation of appropriate technical or organisational measures, protection against— (i) unauthorised or unlawful processing, and (ii) accidental loss, destruction or damage.
\n
(2)The processing of personal data shall be lawful where, and to the extent that— (a) the processing is necessary for the performance of a function of a controller for a purpose specified in section 70
\n
(1)(a) and the function has a legal basis in the law of the European Union or the law of the State, or (b) the data subject has, subject to subsection (3), given his or her consent to the processing.
\n
(3)Where the processing of personal data is to be carried out on the basis of the consent of the data subject referred to in subsection (2)(b), the processing shall be lawful only where, and to the extent that— (a) having been informed of the intended purpose of the processing and the identity of the controller, the data subject gives his or her consent freely and explicitly, (b) the request for consent is expressed in clear and plain language, and where such consent is given in the context of a written statement that also concerns other matters, the request for consent is presented to the data subject in a manner that is clearly distinguishable from those other matters, and (c) the data subject may withdraw his or her consent at any time, and he or she shall be informed of this possibility prior to giving consent.
\n
(4)Where a data subject withdraws his or her consent to the processing of personal data pursuant to subsection (3)(c), the withdrawal of consent shall not affect the lawfulness of processing based on that consent prior to the consent being withdrawn.
\n
(5)Where a controller collects personal data for a purpose specified in section 70
\n
(1)(a), the controller or another controller may process the data for a purpose so specified other than the purpose for which the data were collected, in so far as— (a) the controller is authorised to process such personal data for such a purpose in accordance with the law of the European Union or the law of the State, and (b) the processing is necessary and proportionate to the purpose for which the data are being processed.
\n
(6)A controller may process personal data, whether the data were collected by the controller or another controller, for— (a) archiving purposes in the public interest, (b) scientific or historical research purposes, or (c) statistical purposes, provided that the said processing— (i) is for a purpose specified in section 70
\n
(1)(a), and (ii) is subject to appropriate safeguards for the rights and freedoms of data subjects.
\n
(7)A controller shall ensure, in relation to personal data for which it is responsible, that an appropriate time limit is established for— (a) the erasure of the data, or (b) the carrying out of periodic reviews of the need for the retention of the data.
\n
(8)Where a time limit is established in accordance with subsection (7), the controller shall ensure, by means of procedural measures, that the time limit is observed.
\n
(9)A processor, or any person acting under the authority of the controller or of the processor who has access to personal data, shall not process the data unless the processor or person is— (a) authorised to do so by the controller, or (b) required to do so by the law of the European Union or the law of the State, and then only to the extent so authorised or required, as the case may be.
\n
(10)A controller shall ensure that it is in a position to demonstrate that the processing of personal data for which it is responsible is in compliance with subsections (1) to (8) of this section.
\n
Security measures for personal data 72. (1) In determining appropriate technical or organisational measures for the purposes of section 71
\n
(1)(f), a controller shall ensure that the measures provide a level of security appropriate to the harm that might result from accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, the data concerned.
\n
(2)A controller or processor shall take all reasonable steps to ensure that— (a) persons employed by the controller or the processor, as the case may be, and (b) other persons at the place of work concerned, are aware of and comply with the relevant technical or organisational measures referred to in subsection (1).
\n
Processing of special categories of personal data (Part 5) 73. (1) The processing of a special category of personal data shall be lawful only where— (a) section 71 is complied with, and (b) at least one of the following conditions is met: (i) where the processing is to be carried out on the basis of the consent of the data subject pursuant to section 71
\n
(2)(b), the consent referred to in that paragraph explicitly refers to the special category of personal data concerned; (ii) the processing is necessary— (I) to prevent injury or other damage to the data subject or another individual, (II) to prevent loss in respect of, or damage to, property, or (III) otherwise to protect the vital interests of the data subject or another individual; (iii) the personal data to which the processing relates have been made public as a result of steps deliberately taken by the data subject; (iv) the processing is necessary for— (I) the administration of justice, (II) the performance of a function conferred on a person by or under an enactment, or (III) the performance of a function of the Government or a Minister of the Government; (v) the processing— (I) is required for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or (II) is otherwise required for the purposes of establishing, exercising or defending legal rights; (vi) the processing is necessary for medical purposes and is carried out by, or under the responsibility of— (I) a health practitioner, or (II) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner; (vii) the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law; (viii) the processing is carried out pursuant to section 71
\n
(6); (ix) the processing is authorised by regulations made under subsection (2).
\n
(2)Regulations may be made permitting the processing of special categories of personal data for the purposes of subsection (1)(b)(ix) where the processing is necessary for reasons of substantial public interest, and without prejudice to the generality of the foregoing, such regulations shall identify the public interest concerned.
\n
(3)Subject to subsection (4), regulations may be made under subsection (2)— (a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or (b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.
\n
(4)The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (2).
\n
(5)The Commission may, on being consulted under subsection (4), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to— (a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and (b) any other Committee (within the meaning of section 19
\n
(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.
\n
(6)The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (2) shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to— (a) the nature, scope and purposes of the processing, (b) the nature of the substantial public interest concerned, (c) any benefits likely to arise for the data subjects concerned, (d) any risks arising for the rights and freedoms of such subjects, and (e) the likelihood of any such risks arising and the severity of such risks.
\n
(7)Where a special category of personal data is processed in accordance with this section, the controller shall ensure that the processing is carried out with appropriate safeguards for the rights and freedoms of the data subject.
\n
(8)In this section— “health practitioner” has the same meaning as it has in the Health Identifiers Act 2014 ; “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of medical care and treatment and the management of healthcare services.
\n
Data quality 74. (1) A controller shall, where relevant and in so far as is possible, make a distinction between the personal data of different categories of data subject.
\n
(2)A controller shall, in so far as is possible, ensure that personal data based on facts are distinguished from personal data based on personal assessments.
\n
(3)A controller shall— (a) take all reasonable steps to ensure that personal data that are inaccurate, incomplete or no longer up to date are not transmitted or otherwise made available, (b) verify, in so far as is possible, the quality of personal data before they are transmitted or otherwise made available, and (c) provide, in so far as is possible, in a transmission of personal data, the information necessary for the recipient to assess the accuracy, completeness and reliability of the data and the extent to which the data are up to date.
\n
(4)Other than where section 92 applies, where a controller becomes aware that incorrect personal data have been transmitted or personal data have been unlawfully transmitted— (a) the controller shall ensure that the recipient of the personal data is notified without delay of that fact, and (b) the recipient shall ensure that the personal data are rectified or erased or the processing of the data is restricted, as may be appropriate.
\n
Chapter 3
\n
Obligations of controllers and processors General obligations of controller with regard to technical and organisational measures 75. (1) A controller shall implement appropriate technical and organisational measures for the purposes of— (a) ensuring that the processing of personal data for which it is responsible is performed in compliance with this Part, and (b) demonstrating such compliance.
\n
(2)A controller shall ensure that measures implemented in accordance with subsection (1) are reviewed at regular intervals and, where required, updated.
\n
(3)The measures referred to in subsection (1) shall include the implementation of an appropriate data protection policy by the controller, where such implementation is proportionate in relation to the processing activities carried out by the controller.
\n
Data protection by design and by default 76. (1) A controller shall, without prejudice to the generality of section 75
\n
(1), for the purposes of meeting the requirements of this Part and protecting the rights of data subjects— (a) when determining the means of processing personal data, and (b) when carrying out the said processing, implement appropriate technical and organisational measures that are designed— (i) to implement the principles of the protection of personal data contained in this Part in an effective manner, and (ii) to integrate the necessary safeguards into the said processing.
\n
(2)Without prejudice to the generality of section 75
\n
(1)and subsection (1), a controller shall, subject to subsection (3), when processing personal data implement appropriate technical and organisational measures to ensure that only personal data that are necessary for each specific purpose of the processing are processed.
\n
(3)The requirement in subsection (2) applies in relation to— (a) the amount of personal data collected for the processing concerned, (b) the extent of the processing of the personal data concerned, (c) the period for which the personal data concerned are stored, and (d) the accessibility of the personal data concerned.
\n
(4)Technical and organisational measures implemented in accordance with subsection (2) shall ensure that personal data are not made generally available unless, and only to the extent, authorised by the controller.
\n
Security of automated processing 77. A controller or processor, prior to carrying out automated processing, shall— (a) evaluate the risks to the rights and freedoms of individuals arising from the processing concerned, and (b) implement measures designed to— (i) deny access to the processing equipment used for the processing to any person other than the persons authorised in that regard by the controller or processor, as the case may be, (ii) prevent the reading, copying, modification or removal of the data media concerned, other than in so far as is authorised by the controller or processor, as the case may be, (iii) prevent the input of personal data other than in so far as is authorised by the controller or processor, as the case may be, (iv) prevent the inspection, modification or deletion of the data other than in so far as is authorised by the controller or processor, as the case may be, (v) prevent the use of the automated processing system by persons using data communication equipment who are not authorised to do so by the controller or processor, as the case may be, (vi) ensure that where a person is authorised to use the automated processing system concerned, he or she has access to personal data on the system only in so far as he or she is so authorised by the controller or processor, as the case may be, (vii) ensure that it is possible to verify or establish the persons to whom personal data have been or may be transmitted or made available using data communication equipment, (viii) ensure that it is possible to verify or establish which personal data have been input into an automated processing system, and in relation to such data, to verify and establish the person who input the data and when the data were input, (ix) prevent the reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media, other than in so far as is authorised by the controller or processor, as the case may be, (x) ensure that an installed automated system may be restored in the event of an interruption in the service of the system, (xi) ensure that the automated processing system properly performs its function and the appearance of a fault in the automated processing system is reported to the controller or processor, as the case may be, and (xii) ensure that personal data that are stored on the automated processing system cannot be corrupted by means of a malfunctioning of the system.
\n
Technical and organisational measures 78. For the purposes of determining the appropriate technical and organisational measures in relation to personal data that are required to be taken by a controller or processor in order to ensure compliance with this Part, and in particular sections 71
\n
(1)(f), 75
\n
(1), 76 and 80 , the controller or processor, as the case may be, shall, where relevant, have regard to the following matters: (a) the nature of the personal data concerned; (b) the accessibility of the data; (c) the nature, scope, context and purpose of the processing concerned; (d) any risks to the rights and freedoms of individuals arising from the processing concerned; (e) the likelihood of any such risks arising and the severity of such risks; (f) the state of the art and the cost of implementation; (g) guidelines, recommendations and descriptions of best practice issued by the Commission or the European Data Protection Board.
\n
Joint controllers 79. (1) Where 2 or more controllers jointly determine the purposes and means of the processing of personal data (in this Part referred to as “joint controllers”), they shall determine their respective responsibilities for compliance with this Part in a transparent manner by means of an agreement in writing between them, save in so far as the said responsibilities are determined by the law of the European Union or the law of the State.
\n
(2)An agreement in writing referred to in subsection (1)— (a) shall include a determination of— (i) the respective responsibilities of the joint controllers concerned as regards the exercise by data subjects of their rights under this Part, and (ii) the respective duties of the joint controllers concerned as regards the provision to a data subject of the information specified in section 90
\n
(2), and (b) may designate a single point of contact in respect of the processing concerned for the data subject to whom it relates, where such designation is not otherwise determined by the law of the State.
\n
Processors 80. (1) A controller shall engage a processor to carry out processing on its behalf only where— (a) the processing is carried out, subject to subsection (3), in pursuance of a contract in writing between the controller and the processor that provides for the matters specified in subsection (2), and (b) the processor provides sufficient guarantees to implement appropriate technical and organisational measures to ensure that— (i) the processing shall comply with the provisions of this Part, and (ii) the rights and freedoms of the data subjects are protected.
\n
(2)A contract entered into between a controller and a processor in accordance with subsection (1)(a) shall— (a) specify the subject matter, duration, nature and purpose of the processing to be carried out thereunder, (b) specify the type of personal data to be processed thereunder and the categories of data subjects to whom the personal data relate, (c) specify the obligations and rights of the controller in relation to the processing, and (d) provide that the processor shall— (i) act only on instructions from the controller in relation to the processing, except in so far as the law of the European Union or the law of the State requires the processor to act otherwise, (ii) procure the services of another processor (in this section referred to as a “secondary processor”) in relation to the processing only where authorised to do so in advance and in writing by the controller, which authorisation may be specific or general in nature, (iii) ensure that any person authorised to process the personal data has undertaken to maintain the confidentiality of the personal data or is under an appropriate statutory obligation to do so, (iv) assist the controller in ensuring compliance with this Part in so far as it relates to the exercise by a data subject of his or her rights, (v) erase or return to the controller, at the election of the controller, all personal data upon completion of the processing services carried out by the processor on behalf of the controller and erase any copy of the data, unless the processor is required by the law of the European Union or the law of the State to retain the data, and (vi) make available to the controller all information necessary to demonstrate compliance by the processor with this section.
\n
(3)Subsection (1)(a) shall not apply in relation to processing where the form of the processing and the role of the controller and the processor concerned are otherwise specified in the law of the European Union or the law of the State.
\n
(4)Where a controller gives an authorisation, whether specific or general in nature, to a processor, including a secondary processor (in this section referred to as “the procuring processor”) to procure the services of a secondary processor, the procuring processor shall inform— (a) the controller, and (b) where relevant, any processor who procured the services of the procuring processor in relation to the processing concerned, in advance of any such procurement or of a change in the terms of such procurement.
\n
(5)Where a procuring processor procures the services of a secondary processor to carry out processing on behalf of a controller, subsections (1) and (2) shall apply to the procuring processor and the secondary processor, subject to the following modifications and any other necessary modifications: (a) a reference to a “controller”, other than in subparagraphs (ii), (iv), (v) and (vi) of subsection (2)(d), shall be construed as a reference to the procuring processor; (b) a reference to a “controller” in subsection (2)(d)(iv) shall be construed as a reference to the controller and the procuring processor; (c) a reference to a “controller” in subsection (2)(d)(v) shall be construed as a reference to the controller or the procuring processor, as appropriate; and (d) a reference to a “processor” shall be construed as a reference to a secondary processor.
\n
(6)Where a person, who by virtue of the operation of this Part is a processor of personal data, when purporting to act as such a processor, determines the purpose and means of the processing of the data, the obligations that are placed on a controller under this Part shall apply thereafter to the person as though the person were a controller of the data.
\n
Record of data processing activities 81. (1) A controller shall create and maintain a record in writing containing the following information in relation to each category of processing activity for which it is responsible: (a) the identity and contact details of the controller and, where applicable, the controller’s data protection officer or any joint controller; (b) a description of— (i) the purpose of the processing, (ii) the categories of personal data concerned, (iii) the categories of data subjects to which the personal data relate, (iv) the categories of recipients to which the personal data have been or will be disclosed, including recipients in a third country or an international organisation, if any, (v) the categories of transfer of personal data to a third country or an international organisation, if any, (vi) the legal basis for the processing operation for which the personal data are intended, including the transfer of the data, where applicable, and (vii) where possible, the proposed time limit within which each category of personal data shall be erased; (c) whether the processing involves the use of profiling; (d) where possible, a general description of the technical and organisational security measures implemented in respect of the processing activity in accordance with section 72
\n
(1).
\n
(2)A processor shall create and maintain a record in writing of each category of processing activity carried out by the processor on behalf of a controller containing the following information: (a) the identity and contact details of— (i) the processor, (ii) each controller on behalf of which the processor is carrying out the processing, and (iii) the processor’s data protection officer, where applicable; (b) a description of each category of processing carried out on behalf of each controller; (c) details of any transfer of personal data to a third country or an international organisation, if applicable, including the identification of the third country or international organisation to which the data are transferred; (d) where possible, a general description of the technical and organisational security measures implemented in respect of the processing activity in accordance with section 72
\n
(1).
\n
(3)A controller or processor shall, where requested to do so, make a record created and maintained pursuant to subsection (1) or (2), as the case may be, available to the Commission for inspection and examination.
\n
Data logging for automated processing system 82. (1) Subject to subsection (5), where a controller or processor carries out processing of personal data by automated means, the controller or processor, as the case may be, shall create and maintain a log (in this section referred to as a “data log”) of the following processing operations carried out in automated processing systems in respect of that processing: (a) the collection of personal data for the purposes of such processing and the alteration of any such data; (b) the consultation of the personal data by any person; (c) the disclosure of the personal data, including the transfer of the data, to any other person; (d) the combination of the personal data with other data; (e) the erasure of the personal data, or some of the data.
\n
(2)Where a data log contains information specified in paragraph (b) or (c) of subsection (1), the controller or processor, as the case may be, shall ensure that the data log contains sufficient information to establish the following: (a) the date and time of the consultation or disclosure, as the case may be; (b) the reason for the consultation or disclosure, as the case may be; (c) in so far as is possible, the identification of the person who consulted or disclosed, as the case may be, the personal data; (d) the identity of any recipient to whom the personal data were disclosed.
\n
(3)A data log shall not be used by any person for any purpose other than— (a) verifying the lawfulness of the processing, (b) the monitoring by the controller of processing carried out by the controller, (c) the monitoring by the processor of processing carried out by the processor, (d) ensuring the integrity and security of the personal data concerned, or (e) for the purposes of criminal proceedings.
\n
(4)A controller or processor shall, where requested to do so, make a data log created and maintained by the controller or processor, as the case may be, available to the Commission for inspection and examination.
\n
(5)This section shall not apply, in respect of an automated processing system established on or before 6 May 2016— (a) prior to 6 May 2023, where compliance by a controller or processor, as the case may be, with this section prior to that date would involve disproportionate effort, or (b) prior to 6 May 2026, where compliance by a controller or a processor, as the case may be, with this section prior to that date would cause serious difficulties for the operation of the automated processing system to which the data log relates.
\n
(6)A controller or processor who intends to rely upon subsection (5)(b) in respect of an automated processing system operated by the controller or processor, as the case may be, shall notify the Minister in writing of the said intention on or before 31 December 2022.
\n
(7)A notification referred to in subsection (6) shall include a description of the serious difficulties referred to in subsection (5)(b) in respect of the automated processing system concerned.
\n
Cooperation with Commission 83. A controller or a processor shall, on request by the Commission, cooperate with and assist the Commission in the performance of its functions under this Part.
\n
Data protection impact assessment and prior consultation with Commission 84. (1) Where having regard to its nature, scope, context and purposes, a type of processing, and in particular a type of processing using new technology, is likely to result in a high risk to the rights and freedoms of individuals, the controller that is proposing to carry out the processing shall conduct an assessment of the likely impact of the proposed processing operations on the protection of personal data (in this Part referred to as a “data protection impact assessment”) prior to carrying out the processing.
\n
(2)A data protection impact assessment carried out in accordance with subsection (1) shall include: (a) a general description of the proposed processing operations to which it relates; (b) an assessment of the potential risks to the rights and freedoms of data subjects as a result of the proposed processing; and (c) a description of any safeguards, security measures or mechanisms proposed to be implemented by the controller to mitigate any risk referred to in paragraph (b) and to ensure the protection of the personal data in compliance with this Part.
\n
(3)Where— (a) it appears to a controller, having conducted a data protection impact assessment, that the processing concerned would, despite the implementation of safeguards, security measures or mechanisms referred to in subsection (2)(c), result in a high risk to the rights and freedoms of individuals, or (b) the controller proposes to carry out processing of a type prescribed by the Commission under subsection (9), the controller shall, prior to commencing the processing, consult the Commission by request in that regard in writing.
\n
(4)A controller shall, when making a request under subsection (3), provide the Commission with— (a) the data protection impact assessment conducted in relation to the processing concerned, and (b) any other information required by the Commission to enable it to assess— (i) the potential risks to the rights and freedoms of individuals arising from the proposed processing, and (ii) the compliance of the proposed processing with this Part.
\n
(5)The Commission shall, where it is of the view that the proposed processing would not comply with this Part, in particular where it is of the view that the controller has insufficiently identified or mitigated the potential risks to the rights and freedoms of individuals arising from the proposed processing, issue written advice in relation to the processing to the controller and, where applicable, any proposed processor.
\n
(6)Subject to subsection (8), where the Commission issues written advice pursuant to subsection (5), it shall do so within a period of 6 weeks from the date on which it receives the request under subsection (3).
\n
(7)For the purposes of responding to a request under subsection (3), the Commission may use any of its powers referred to in Chapter 4 of Part 6.
\n
(8)Where, taking into account the complexity of the proposed processing, the Commission is of the opinion that it requires additional time to consider a request made under subsection (3), it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (6) by such further period not exceeding one month as it may specify by notice in writing to the controller concerned.
\n
(9)The Commission may, following consultation with the Minister, make regulations prescribing a type of processing for the purposes of subsection (3)(b) as a type of processing in relation to which a controller shall consult the Commission prior to commencing the processing.
\n
(10)The Commission shall, when prescribing a type of processing under subsection (9), have regard to— (a) the nature, scope and purposes of the type of processing, (b) the type of processing involved, in particular where the use of new technology is likely to result in a high risk to the rights and freedoms of individuals, (c) the likelihood of any such risks arising and the severity of such risks, and (d) any submissions received pursuant to subsection (11)(c) in relation to the proposed regulations.
\n
(11)The Commission shall, prior to making regulations under subsection (9), publish a notice on the website of the Commission and in at least one daily newspaper circulating generally in the State— (a) indicating that it proposes to make regulations under this section, (b) indicating that a draft of the regulations is available for inspection on that website for a period specified in the notice, being not less than 28 days from the date of the publication of the notice in the newspaper, and (c) stating that submissions in relation to the draft regulations may be made in writing to the Commission before a date specified in the notice, which shall be not less than 28 days after the end of the period referred to in paragraph (b).
\n
(12)Where there is a proposal for a legislative measure for which a Minister of the Government is responsible that relates to the processing of personal data, the relevant Minister shall consult with the Commission during the process of the preparation of the legislative measure.
\n
Notification of personal data breach by processor 85. Where a processor becomes aware of a personal data breach, the processor shall notify the controller on whose behalf the data are being processed of the breach— (a) in writing, and (b) without undue delay.
\n
Notification of personal data breach to Commission, etc.
\n
86.(1) Subject to subsection (3), where a personal data breach occurs, the controller shall, without undue delay and where feasible within 72 hours of becoming aware of the breach, notify the Commission of the breach.
\n
(2)Where a controller does not notify the Commission under subsection (1) of a personal data breach within 72 hours of becoming aware of the breach, the controller shall include in the notification the reason for not so notifying.
\n
(3)Subsection (1) shall not apply where, taking into account the nature of the personal data and the scope, context and purposes of the processing, the personal data breach is unlikely to result in a risk to the rights and freedoms of data subjects.
\n
(4)A notification under subsection (1) shall include— (a) a description of the personal data breach, including, where possible the categories and number, or approximate number, of— (i) data subjects concerned, and (ii) personal data records concerned, (b) a description of the likely consequences of the personal data breach, (c) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including any measures taken or proposed to be taken to mitigate its possible adverse effects, and (d) the name and contact details of the controller’s data protection officer (if any) or other point of contact.
\n
(5)Where, at the time of the making of a notification under subsection (1), it is not possible for a controller to include in the notification all the information specified in subsection (4) in relation to the personal data breach concerned, the controller shall— (a) nevertheless make the notification including such information as is possible to include at that time, and (b) supply the Commission with such information specified in subsection (4) as is outstanding without undue delay.
\n
(6)A controller shall create and maintain a detailed record in writing of a personal data breach, including a description of— (a) the breach, (b) the effects of the breach, and (c) the measures taken to address the breach, including any measures taken to mitigate its possible adverse effects.
\n
(7)A controller shall, where so requested by the Commission, provide a copy of a record created and maintained under subsection (6) to the Commission.
\n
(8)Where a personal data breach involves personal data that have been transmitted— (a) by a controller in the State to a controller in another Member State, or (b) by a controller in another Member State to a controller in the State, the controller in the State shall provide the controller in the other Member State with the information specified in subsection (4) without undue delay.
\n
Communication of personal data breach to data subject 87. (1) Subject to subsections (2), (4) and (7), where a personal data breach occurs that is likely to result in a high risk to the rights and freedoms of a data subject, the controller shall, without undue delay, notify the data subject to whom the breach relates.
\n
(2)Subsection (1) shall not apply where— (a) the controller has implemented appropriate technological and organisational protection measures that were applied to the personal data affected by the personal data breach, in particular where the said measures, including encryption, render the personal data unintelligible to any person who is not authorised to access it, or (b) the controller has taken measures in response to the personal data breach that ensure that the high risk to the rights and freedoms of a data subject from the breach is no longer likely to materialise.
\n
(3)A notification under subsection (1) shall— (a) describe, in clear and plain language, the nature of the personal data breach concerned, and (b) contain at least the information specified in paragraphs (b) to (d) of section 86
\n
(4).
\n
(4)Where a notification under subsection (1) would involve a disproportionate effort, the controller shall notify the data subjects concerned of the personal data breach by way of public communication or other similar measure that ensures the data subjects are informed of the personal data breach in an equally effective manner.
\n
(5)A notification under subsection (4) shall— (a) describe, in clear and plain language, the nature of the personal data breach concerned, and (b) contain such other information as is appropriate in all the circumstances.
\n
(6)Where— (a) a controller notifies the Commission under section 86 of a personal data breach, and (b) the controller has not notified the data subject to whom the personal data relate under subsection (1) or (4), as the case may be, of the personal data breach, the Commission may, having considered the likelihood of the data breach resulting in a high risk to the rights and freedoms of a data subject— (i) require the controller to notify the data subject under subsection (1) or (4), as the case may be, or (ii) determine that subsection (2) applies in relation to the personal data breach.
\n
(7)A controller may, in relation to the exercise of the right of a data subject to be notified under subsection (1) of a personal data breach, restrict the exercise of the said right where to do so constitutes a necessary and proportionate measure in a democratic society, with due regard for the fundamental rights and legitimate interests of the data subject, for a purpose specified in section 94
\n
(2).
\n
(8)Where a controller restricts the exercise of the right of a data subject under subsection (7), subsections (5), (6) and (7) of section 94 shall apply in respect of the said restriction, with all necessary modifications.
\n
Data protection officer 88. (1) A controller, other than— (a) a court, or (b) another independent judicial authority, acting in its judicial capacity, shall, subject to subsections (2) and (3), appoint a person to carry out the functions specified in subsection (5) in respect of the controller (in this Part referred to as a “data protection officer”).
\n
(2)Two or more controllers may, subject to subsection (3), having regard to their organisational structure and size, appoint a single data protection officer to carry out the functions specified in subsection (5) in respect of each of the controllers.
\n
(3)A controller, when appointing a data protection officer, shall do so on the basis of— (a) the person’s expert knowledge of the law and the practice relating to the protection of personal data, and (b) his or her ability to carry out the functions specified in subsection (5).
\n
(4)Where a controller appoints a data protection officer, the controller shall— (a) publish or cause to be published the contact details of the data protection officer, (b) inform the Commission of the appointment of the data protection officer and provide the Commission with his or her contact details, (c) ensure that the data protection officer— (i) reports directly, in relation to his or her functions under subsection (5), to the highest level of management of the controller, (ii) does not receive any instructions regarding the exercise of such functions, and (iii) is involved in an appropriate and timely manner in all matters relating to the protection of personal data, and (d) support the data protection officer in performing his or her functions under subsection (5), including by— (i) providing him or her with the resources that he or she requires to perform those functions, (ii) ensuring that he or she has access to processing operations carried out by the controller, and (iii) assisting him or her to maintain his or her expert knowledge in the law and practice relating to the protection of personal data.
\n
(5)The functions of a data protection officer shall include the following: (a) informing and advising the controller, and the employees of the controller who carry out processing, of their obligations under this Part and under any other law of the European Union or law of the State that relates to the protection of personal data; (b) monitoring the compliance of the controller with— (i) this Part, (ii) any other law of the European Union or law of the State that relates to the protection of personal data, and (iii) the policies of the controller in relation to the protection of personal data, including the assignment of responsibilities in the controller in relation to the protection of personal data, the raising of awareness and the training of staff involved in processing operations in that regard, and any audit activity related to the protection of personal data; (c) providing advice, where requested to do so, in relation to the carrying out of a data protection impact assessment in accordance with section 84 and monitoring any steps taken on foot of that assessment; (d) acting as the contact point for data subjects with regard to all issues related to the processing of their personal data and to the exercise of their rights under this Part; (e) cooperating with the Commission and acting as a contact point for the Commission for issues related to processing carried out by the controller, including consultation by the controller with the Commission under section 84 .
\n
Chapter 4
\n
Rights, and restriction of rights, of data subject (Part 5) Rights in relation to automated decision making (Part 5) 89. (1) Subject to subsection (2), a decision that produces an adverse legal effect for a data subject or significantly affects a data subject shall not be based solely on automated processing, including profiling, of personal data that relate to him or her.
\n
(2)Subsection (1) shall not apply where— (a) the taking of a decision based solely on automated processing is authorised by the law of the European Union or the law of the State and the law so authorising contains appropriate safeguards for the rights and freedoms of the data subject, including the right of the data subject to make representations to the controller in relation to the decision, and (b) the controller has taken adequate steps to safeguard the legitimate interests of the data subject.
\n
(3)Profiling that results in discrimination against an individual on the basis of a special category of personal data shall be prohibited.
\n
Right to information 90. (1) Subject to subsection (4) and section 94 , a controller shall ensure that the data subject is provided with, or, as appropriate, has made available to him or her, the information specified in subsection (2) in relation to personal data relating to him or her within a reasonable period after the date on which the controller obtains the personal data concerned, having regard to the circumstances in which the data are or are to be processed.
\n
(2)The information to which subsection (1) applies is: (a) the identity and the contact details of the controller; (b) the contact details of the data protection officer of the controller, where applicable; (c) the purpose for which the personal data are intended to be processed or are being processed; (d) information detailing the right of the data subject to request from the controller access to, and the rectification or erasure of, the personal data; (e) information detailing the right of the data subject to lodge a complaint with the Commission and the contact details of the Commission; (f) in individual cases where further information is necessary to enable the data subject to exercise his or her rights under this Part, having regard to the circumstances in which the personal data are or are to be processed, including the manner in which the data are or have been collected, any such information including: (i) the legal basis for the processing of the data concerned, including the legal basis for any transfers of data; (ii) the period for which the data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine the said period; (iii) where applicable, each category of recipients of the data.
\n
(3)The information referred to in paragraphs (a) to (e) of subsection (2) may be made available to the data subject by means of publication on the website of the controller.
\n
(4)Without prejudice to section 94 , subsection (1) shall not apply to information specified in subsection (2)— (a) where the information is already in the possession of the data subject, or (b) where, in particular in the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the provision of the information proves impossible or would involve a disproportionate effort.
\n
Right of access 91. (1) Subject to subsections (7), (9) and (12) and sections 93
\n
(4)(ii) and 94 , an individual who believes that personal data relating to him or her have been or are being processed by or on behalf of a controller, if he or she so requests the controller by notice in writing shall— (a) be informed by the controller whether personal data relating to him or her have been or are being processed by or on behalf of the controller, and (b) where such data have been or are being so processed, be provided by the controller with the following information: (i) a description of— (I) the purpose of, and the legal basis for, the processing, (II) the categories of personal data concerned, (III) the recipients or categories of recipients to whom the personal data concerned have been disclosed, and (IV) the period for which the personal data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine the said period; (ii) information detailing the right of the data subject to request from the controller the rectification or erasure of the personal data concerned; (iii) information detailing the right of the data subject to lodge a complaint with the Commission and the contact details of the Commission; (iv) a communication of the personal data concerned; (v) any available information as to the origin of the personal data concerned, unless the communication of that information is contrary to the public interest.
\n
(2)A controller shall respond to a request made under subsection (1) and provide the information specified in paragraph (b) thereof to the data subject as soon as may be and, subject to subsections (4) and (5), in any event not later than one month after the date on which the request is made.
\n
(3)When making a request under subsection (1), the individual making the request shall provide the controller with such information as the controller may reasonably require to satisfy itself of the identity of the individual and to locate any relevant personal data or information.
\n
(4)Where a controller has reasonable doubts as to the identity of an individual making a request under subsection (1) or reasonably requires additional information to locate any relevant personal data, it may request such additional information from the data subject as may be necessary to confirm his or her identity or to enable it to locate such personal data or information, as the case may be, and the period of time from the making of such a request for additional information until the request is complied with shall not be reckonable for the purposes of subsection (2).
\n
(5)Where, taking into account the complexity of a request made under subsection (1) and the number of such requests received by the controller, the controller is of the opinion that it requires additional time to consider the request, it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (2) by such further period not exceeding 2 months as it may specify by notice in writing to the individual making the request.
\n
(6)A notice in writing referred to in subsection (5) shall include the reason for which the controller is of the opinion that it requires additional time to consider the request made under subsection (1).
\n
(7)Where information that a controller would otherwise be required to provide to a data subject pursuant to subsection (1) includes personal data relating to another individual that would reveal, or would be capable of revealing, the identity of the individual, the controller— (a) shall not, subject to subsection (8), provide the data subject with the information that constitutes such personal data relating to the other individual, and (b) shall provide the data subject with a summary of the personal data concerned that— (i) in so far as is possible, permits the data subject to exercise his or her rights under this Part, and (ii) does not reveal, or is not capable of revealing, the identity of the other individual.
\n
(8)Subsection (7) shall not apply where the individual to whom the personal data that would reveal, or would be capable of revealing, his or her identity, relate consents to the provision of the information concerned to the data subject making a request pursuant to subsection (1).
\n
(9)Subsection (1) shall not apply— (a) in respect of personal data relating to the data subject that consists of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential, or (b) to information specified in paragraph (b)(i)(III) of that subsection in so far as a recipient referred to therein is a public authority which may receive data in the context of a particular inquiry in accordance with the law of the State.
\n
(10)Information provided pursuant to a request under subsection (1) may take account of any amendment of the personal data concerned made since the receipt of the request by the controller (being an amendment that would have been made irrespective of the receipt of the request) but not of any other amendment.
\n
(11)The obligations imposed by subparagraphs (iv) and (v) of subsection (1)(b) shall be complied with by supplying the data subject with a copy of the information concerned in permanent form unless— (a) the supply of such a copy is not possible or would involve disproportionate effort, or (b) the data subject agrees otherwise.
\n
(12)Where a controller has previously complied with a request under subsection (1), the controller is not obliged to comply with a subsequent identical or similar request under that subsection by the same individual unless, in the opinion of the controller, a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
\n
(13)In determining for the purposes of subsection (12) whether the reasonable interval specified in that subsection has elapsed, regard shall be had to the nature of the personal data, the purpose for which the personal data are processed and the frequency with which the personal data are altered.
\n
(14)Where a controller, pursuant to subsection (12) refuses to act upon a request under subsection (1), it shall, as soon as practicable, so notify the data subject in writing.
\n
Right to rectification or erasure and restriction of processing 92. (1) Where a data subject is of the opinion that a controller is processing personal data relating to him or her that are inaccurate, the data subject may make a request in writing to the controller for the controller to rectify the data concerned.
\n
(2)A controller that receives a request under subsection (1) shall, subject to subsections (6), (7) and (9) and section 93
\n
(4)(ii), where it is satisfied that the personal data to which the request relates are inaccurate, rectify the data as soon as may be and in any event no later than one month after the date on which the request is made.
\n
(3)Where a data subject is of the opinion that a controller is processing personal data relating to him or her— (a) in a manner that contravenes subsections (1) to (6) of section 71 or section 73
\n
(1), or (b) that are required to be erased by the controller in accordance with a legal obligation to which the controller is subject, the data subject may make a request in writing to the controller to erase the data concerned.
\n
(4)A controller that receives a request under subsection (3) shall, subject to subsections (6), (7) and (9) and section 93
\n
(4)(ii), where it is satisfied that paragraph (a) or (b) of subsection (3) applies to the personal data to which the request relates, erase the data as soon as may be and in any event no later than one month after the date on which the request is made.
\n
(5)When making a request under subsection (1) or (3), the data subject shall provide such information as the controller may reasonably require to— (a) satisfy itself as to the identity of the data subject, (b) locate any relevant personal data, and (c) satisfy itself as to whether the personal data concerned are inaccurate or as to the basis on which the data should be erased, as the case may be.
\n
(6)Where a controller— (a) has reasonable doubts as to the identity of an individual making a request under subsection (1) or (3), or (b) reasonably requires additional information— (i) to locate any relevant personal data, or (ii) to satisfy itself as to whether the personal data concerned are inaccurate or as to the basis on which the data should be erased, as the case may be, it may request such additional information from the data subject as may be necessary to confirm his or her identity or to so locate or satisfy itself, as the case may be, and the period of time from the making of such a request for additional information until the request is complied with shall not be reckonable for the purposes of subsection (2) or (4), as the case may be.
\n
(7)Where, taking into account the complexity of a request made under subsection (1) or (3) and the number of such requests received by the controller, the controller is of the opinion that it requires additional time to consider the request, it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (2) or (4), as the case may be, by such further period not exceeding 2 months as it may specify by notice in writing to the data subject making the request.
\n
(8)A notice in writing referred to in subsection (7) shall include the reason for which the controller is of the opinion that it requires additional time to consider the request made under subsection (1) or (3), as the case may be.
\n
(9)Where a data subject makes a request under subsection (1) or (3), and— (a) the accuracy of the data is contested by the data subject and it is not possible to ascertain whether the data are so inaccurate, or (b) the personal data are required for the purposes of evidence in proceedings before a court or tribunal or in another form of official inquiry, the controller shall restrict the processing of the data and shall not rectify or erase the data, as the case may be.
\n
(10)Where a controller— (a) complies with a request under subsection (1) or (3), or (b) restricts the processing of personal data under subsection (9), the controller shall, as soon as practicable, notify in writing— (i) subject to section 94 , the data subject concerned, (ii) each controller from which the personal data concerned were received, and (iii) each person to whom the personal data concerned were disclosed, of the rectification, erasure or restriction concerned, as the case may be.
\n
(11)Where a controller receives a request under subsection (1) or (3), and— (a) the controller is not satisfied that, as the case may be,— (i) in relation to a request under subsection (1), the personal data to which the request relates should be rectified pursuant to subsection (2), or (ii) in relation to a request under subsection (3), the personal data to which the request relates should be erased pursuant to subsection (4), and (b) subsection (9) does not apply to the data, the controller shall, subject to section 94 , as soon as practicable, so notify the data subject in writing.
\n
(12)A notification under subsection (11) shall include— (a) the reasons for the controller’s decision under that subsection, and (b) information relating to the data subject’s right under section 95 to request the Commission to verify the lawfulness of the processing concerned.
\n
(13)Where a person to whom personal data were disclosed is notified under subsection (10) of— (a) the rectification or erasure of the data pursuant to a request under subsection (1) or (3), as the case may be, or (b) the restriction of the processing of the data under subsection (9), the person shall rectify or erase, or restrict the processing of, as the case may be, any of the data concerned that the person has under his or her control in the same manner, and to the same extent, as the controller making the notification has rectified or erased, or restricted the processing of, as the case may be, the data concerned.
\n
(14)Where a controller has restricted the processing of personal data pursuant to subsection (9) and proposes to lift the said restriction, the controller shall inform the data subject prior to the lifting of the restriction.
\n
(15)Where a controller that restricted the processing of personal data pursuant to subsection (9) lifts the said restriction— (a) the controller shall notify any person who was notified under subsection (10) of the said restriction of the lifting of the restriction as soon as practicable, and (b) the person so notified shall lift any restriction of the processing of the data concerned implemented under subsection (13) in the same manner, and to the same extent, as the controller making the notification has lifted the restriction on the processing of the data concerned.
\n
(16)This section shall not apply to personal data that are contained in witness statements.
\n
(17)For the purposes of this section, personal data are inaccurate if— (a) they are incorrect or misleading as to any matter of fact, or (b) they are incomplete in a material manner.
\n
Communication with data subject 93. (1) Where a controller— (a) provides or makes available information to a data subject under section 90 , (b) provides or makes available information to, or communicates with, a data subject pursuant to a request under section 91 or 92, the controller shall take all reasonable steps to ensure the information is provided or made available, or the communication is made, as the case may be, in a concise, intelligible and easily accessible form using clear and plain language.
\n
(2)The information or communication, as the case may be, referred to in subsection (1), shall— (a) be provided to the data subject by appropriate means, including by electronic means, and (b) in the case of a communication with a data subject pursuant to a request under section 91 or 92 , in so far as is possible, be provided in the same form as that in which the request is made.
\n
(3)A controller shall not impose a charge on a data subject for information provided to him or her under section 90 or, subject to subsection (4)(i), pursuant to a request under section 91 or 92 .
\n
(4)Where a data subject makes a request to a controller under section 91 or 92 that is— (a) manifestly unfounded, or (b) excessive in nature, having regard to the number of requests made by the data subject to the controller under those sections, the controller may— (i) charge a reasonable fee to the data subject in respect of the request, having regard to the administrative cost to the controller of complying with the request, or (ii) refuse to act upon the request.
\n
(5)Where a controller, pursuant to subsection (4)(ii), refuses to act upon a request under section 91 or 92 it shall, as soon as practicable, so notify the data subject in writing.
\n
(6)A notification under subsection (5) shall include— (a) the reasons for which the controller is refusing to act upon the request under section 91 or 92 , as the case may be, pursuant to subsection (4)(ii), and (b) information relating to the right of the data subject under Chapter 3 of Part 6 to lodge a complaint with the Commission and the contact details of the Commission.
\n
(7)Where, pursuant to subsection (4)(ii), a controller refuses to act upon a request made to the controller by a data subject under section 91 or 92 , it shall be for the controller to demonstrate that the request was manifestly unfounded or excessive in nature.
\n
(8)In this section, a reference to a “data subject” shall be construed as including an individual who makes a request under section 91
\n
(1), irrespective of whether the controller is processing personal data relating to the individual.
\n
Restrictions on exercise of data subject rights (Part 5) 94. (1) Subject to subsection (2), a controller, with respect to personal data for which it is responsible, may restrict, wholly or partly, the exercise of a right of a data subject specified in subsection (4).
\n
(2)Subsection (1) shall apply where the controller is satisfied that restricting the exercise of a right under that subsection constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the data subject for the purposes of— (a) avoiding obstructing official or legal inquiries, investigations or procedures, (b) avoiding prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, (c) protecting public security, (d) protecting national security, or (e) protecting the rights and freedoms of other persons.
\n
(3)Without prejudice to the generality of subsection (2), the purposes specified in paragraphs (a) to (e) of subsection (2) include the following: (a) the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid; (b) the enforcement of, compliance with or administration of any enactment related to a purpose specified in section 70
\n
(1)(a); (c) ensuring the safety of the public and the safety or security of individuals and property; (d) ensuring the fairness of criminal proceedings in a court or other tribunal; (e) ensuring the security of— (i) a penal institution, (ii) a children detention school within the meaning of section 3 of the Children Act 2001 , (iii) a remand centre designated under section 88 of the Children Act 2001 , (iv) the Central Mental Hospital, or (v) any system of communications, whether internal or external, of the Garda Síochána, the Defence Forces, the Revenue Commissioners or a penal institution; (f) protecting the life, safety or well-being of any person; (g) preventing the facilitation of the commission of an offence; (h) avoiding the prejudice or impairment of national security, defence or the international relations of the State; (i) avoiding the obstruction or impairment of official or legal inquiries, investigations or procedures or the operation of legal privilege; (j) the performance by the Commission of its functions.
\n
(4)The rights of a data subject to which subsection (1) applies are: (a) the right of the data subject under section 90
\n
(1)in so far as relates to information specified in subsection (2)(f) of that section; (b) the rights of the data subject under paragraphs (a) and (b) of section 91
\n
(1); (c) the right of the data subject to be notified— (i) under section 92
\n
(10)of the restriction of the processing of personal data under subsection (9) of that section, or (ii) under section 92
\n
(11)of a decision not to rectify or erase data pursuant to a request under subsection (1) or (3) of that section, as the case may be.
\n
(5)Subject to subsection (6), where a controller restricts, pursuant to subsection (1), the exercise of the right of a data subject specified in paragraph (b) or (c) of subsection (4), the controller shall notify the data subject in writing of— (a) the restriction of the exercise of the said right and the reasons for such restriction, and (b) the right of the data subject— (i) under section 95 to request the Commission to verify the lawfulness of the processing concerned, or (ii) under section 128 to seek a judicial remedy in relation to the said restriction.
\n
(6)Subsection (5) shall not apply where to notify the data subject in accordance with that subsection of the matters specified therein would be contrary to a purpose specified in subsection (2).
\n
(7)Where a controller restricts, pursuant to subsection (1), the exercise of the right of a data subject specified in paragraph (b) or (c) of subsection (4), the controller shall— (a) create and maintain a record in writing of the factual or legal basis for the decision to so restrict the right concerned, and (b) make such a record available to the Commission, if so requested by the Commission.
\n
(8)Regulations may be made specifying a category of processing to be a category of processing in respect of which the exercise of the rights specified in subsection (4) may, in accordance with subsection (2), be restricted under subsection (1).
\n
(9)Regulations under subsection (8) may be made by— (a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or (b) any other Minister of the Government, following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.
\n
(10)The Minister of the Government making regulations under subsection (8) shall have regard to— (a) the nature, scope and purposes of the category of processing concerned, (b) whether, having regard to the matters referred to in paragraph (a), the restriction concerned is one to which subsection (2) would apply, and (c) any risks arising for the rights and freedoms of data subjects.
\n
(11)Regulations made under this section shall— (a) respect the essence of the right to data protection and protect the interests of the data subject, and (b) restrict the exercise of data subject rights only in so far as is necessary and proportionate to the aim sought to be achieved.
\n
(12)For the purposes of this section, “penal institution” means— (a) a place to which the Prisons Acts 1826 to 2015 apply, or (b) a military prison or detention barrack within the meaning, in each case, of the Defence Act 1954 .
\n
Indirect exercise of rights and verification by Commission 95. (1) Where an individual— (a) is aware, having been notified under section 94
\n
(5), that the exercise of his or her rights have been restricted by a controller pursuant to section 94 , or (b) believes that the exercise of his or her rights have been so restricted and that he or she has not been notified of the said restriction by virtue of the operation of subsection (6) of that section, the individual may make a request in writing to the Commission to verify whether the controller is processing personal data relating to him or her and if so, whether the processing is in compliance with this Part.
\n
(2)Where the Commission receives a request under subsection (1), it may take such steps as appear to it to be appropriate, including the exercise of its powers under section 132 .
\n
(3)The Commission, having taken the steps referred to in subsection (2), shall inform the individual making the request under subsection (1)— (a) that all necessary verifications or reviews have been carried out by the Commission, and (b) of his or her right to seek a judicial remedy under section 128 .
\n
(4)Nothing in this section shall require the Commission to disclose to a data subject whether or not a controller has processed, or is processing, personal data relating to him or her.
\n
Chapter 5
\n
Transfers of personal data to third countries or international organisations Transfer to third country or international organisation 96. (1) The transfer of personal data to a third country or an international organisation shall not take place, subject to section 100 , unless— (a) the transfer is necessary for a purpose specified in section 70
\n
(1)(a), (b) the personal data are to be transferred to a controller in a third country or an international organisation that is an authority competent for the purposes specified in section 70
\n
(1)(a), (c) where the personal data were transmitted or made available to the controller making the transfer from a controller in another Member State, subject to subsection (2), the controller in the other Member State or another relevant controller in that state has given its prior authorisation to the transfer, (d) section 97 , 98 or 99 applies, and (e) the transfer is subject to a condition that a subsequent transfer to another third country or international organisation from the third country or international organisation to which the data are being transferred by the controller shall only occur where the controller authorises the subsequent transfer, having taken into due account all relevant factors, including— (i) the seriousness of any criminal offence to which the data relate, (ii) the purpose for which the data were originally transferred, and (iii) the level of protection for personal data in the third country or the international organisation to which the data are to be transferred onwards.
\n
(2)Subsection (1)(c) shall not apply where— (a) the transfer of the personal data concerned is necessary for the prevention of an immediate and serious threat to— (i) public security in a Member State or a third country, or (ii) the essential interests of a Member State, and (b) an authorisation under the said subsection (1)(c) cannot be obtained in good time.
\n
(3)Where subsection (2) applies and personal data are transferred to a third country or an international organisation without an authorisation from the controller in the other Member State that transmitted or made available the personal data, the controller making the transfer, or on whose behalf the transfer is being made, shall inform the controller in the other Member State of the transfer without delay.
\n
(4)Without prejudice to the generality of section 71 , a processor shall not transfer personal data to a third country or an international organisation, or to a recipient in a third country, under this Chapter unless explicitly instructed in writing to do so by the controller.
\n
Adequacy decision 97. (1) Personal data may be transferred in accordance with section 96
\n
(1), subject to subsection (2), to a third country or an international organisation where a decision has been taken by the European Commission under Article 36 of the Directive that the third country or the international organisation, as the case may be, ensures an adequate level of protection of personal data.
\n
(2)Where the European Commission has taken a decision under Article 36 of the Directive that applies to a specified territory within a third country or a specified sector in a third country, personal data may be transferred under subsection (1) to a controller in the specified territory or sector only, as the case may be.
\n
Transfer subject to appropriate safeguards 98. (1) Personal data may be transferred in accordance with section 96
\n
(1)to a third country, a territory or sector thereof, or an international organisation, in respect of which a decision has not been taken by the European Commission under Article 36 of the Directive that the third country, territory or sector thereof, or the international organisation, as the case may be, ensures an adequate level of protection of personal data, where— (a) there is a legally binding instrument that applies to the transfer and that ensures appropriate safeguards with regard to the processing of personal data, or (b) the controller transferring the personal data, or on whose behalf the personal data are being transferred, has— (i) assessed all the circumstances relating to the transfer, and (ii) is satisfied that appropriate safeguards exist with regard to the protection of the personal data.
\n
(2)Where personal data are transferred to a third country, a territory or sector thereof, or an international organisation pursuant to subsection (1)(b), the controller transferring the personal data, or on whose behalf the personal data are being transferred, shall— (a) inform the Commission about each category of such transfers, and (b) create and maintain a record in writing of each such transfer containing at least the following: (i) details of the personal data transferred; (ii) the date and time of the transfer; (iii) information about the controller in the third country or the international organisation to which the data were transferred; (iv) the reasons for the transfer.
\n
(3)A controller shall make available a record created and maintained pursuant to subsection (2)(b) to the Commission for inspection upon a request in that regard by the Commission.
\n
Derogations for specific situations 99. (1) Where section 97 or 98 does not apply in relation to a transfer of personal data to a third country or an international organisation, personal data may be transferred in accordance with section 96
\n
(1)to the third country or the international organisation, where the transfer is necessary— (a) to protect the vital interests of the data subject or another individual, (b) to safeguard the legitimate interests of a data subject, (c) for the prevention of an immediate and serious threat to public security in a Member State or a third country, (d) subject to subsection (2), in an individual case, for a purpose specified in section 70
\n
(1)(a), or (e) subject to subsection (2), in an individual case, for the establishment, exercise or defence of legal claims relating to a purpose specified in section 70
\n
(1)(a).
\n
(2)Paragraphs (d) and (e) of subsection (1) shall not apply where the controller transferring the personal data, or on whose behalf the personal data are being transferred, is of the opinion that the rights and freedoms of the data subject override the public interest in the transfer concerned.
\n
(3)Where personal data are transferred to a third country or an international organisation pursuant to subsection (1), the controller transferring the personal data, or on whose behalf the personal data are being transferred, shall create and maintain a record in writing of each such transfer containing at least the following: (a) details of the personal data transferred; (b) the date and the time of the transfer; (c) information about the controller in the third country or the international organisation to which the data were transferred; (d) the reasons for the transfer.
\n
(4)A controller shall make available a record created and maintained pursuant to subsection (3) to the Commission for inspection upon a request in that regard by the Commission.
\n
Transfer to recipient in third country 100. (1) Notwithstanding section 96
\n
(1)(b) and the provisions of any relevant international agreement, a controller may, in an individual case, transfer personal data directly to a recipient located in a third country who is not a controller or organisation referred to in section 96
\n
(1)(b) where the relevant provisions of this Part are complied with and each of the following conditions are fulfilled— (a) the transfer is necessary for the performance of a function of the controller making the transfer under the law of the European Union or the law of the State for a purpose specified in section 70
\n
(1)(a); (b) the transfer is in the public interest; (c) the controller is satisfied that the fundamental rights and freedoms of the data subject do not override the public interest necessitating the transfer in the particular instance; (d) the controller is satisfied that the transfer of the data to an authority in the third country that is competent for the purposes specified in section 70
\n
(1)(a) would be ineffective or inappropriate, having regard to the purpose for which the data are being transferred, in particular where the transfer could not be made to such an authority in time to achieve the purpose of the transfer.
\n
(2)A controller, when transferring personal data to a recipient pursuant to subsection (1) shall— (a) specify to the recipient the purpose for which the recipient may process the data, and (b) inform the recipient that the data are to be processed by the recipient for the specified purpose only and then only to the extent that such processing is necessary for that purpose.
\n
(3)Where a controller transfers personal data to a recipient pursuant to subsection (1), the controller shall— (a) notify the relevant authority in the third country that is competent for the purpose for which the data are transferred of the transfer without undue delay, unless to do so would be ineffective or inappropriate, having regard to the purpose for which the data are being transferred, (b) notify the Commission of the transfer, and (c) create and maintain a record in writing of the transfer containing at least the following information: (i) details of the personal data transferred; (ii) the date and the time of the transfer; (iii) the identity of the recipient; (iv) the reason for which the data were transferred.
\n
(4)A controller shall make available a record created and maintained pursuant to subsection (3)(c) to the Commission for inspection upon a request in that regard by the Commission.
\n
(5)In this section— “controller” means a controller that is a competent authority specified in paragraph (a) of the definition of “competent authority” in section 69 ; “relevant international agreement” means an international agreement— (a) to which the State and the third country in which the recipient is located are parties, and (b) that relates to judicial cooperation in criminal matters or to police cooperation.
\n
Chapter 6
\n
Independent supervisory authority Functions of Commission under Part 5 101. (1) Subject to subsection (2), the functions of the Commission under this Part shall be to— (a) monitor and enforce application of this Part and regulations made under it, (b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing, (c) advise, on request by the body concerned, the Houses of the Oireachtas, Government and public authorities on legislative and administrative measures relating to the protection of individuals’ rights and freedoms with regard to processing, (d) promote the awareness of controllers and processors of their obligations under this Part and the Directive, (e) provide, on request by them, information to data subjects on the exercise of their rights under this Part and the Directive and, where appropriate, cooperate with the supervisory authorities of other Member States for that purpose, (f) handle, in accordance with Part 6, complaints lodged by or on behalf of a data subject under Chapter 3 of that Part, (g) examine the lawfulness of processing pursuant to section 95 and inform the data subject within a reasonable period of the outcome of the examination or of the reasons why the examination has not been carried out, (h) cooperate with, and provide mutual assistance to, other supervisory authorities in accordance with section 103 and Chapter VII of the Directive with a view to ensuring consistent application and enforcement of the Directive, (i) conduct, of its own volition or on the basis of information received from another supervisory authority or other public authority, investigations, in accordance with Part 6, on the application of this Part, (j) monitor relevant developments insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies, (k) provide advice to a controller or processor, as the case may be, pursuant to section 84 , and (l) contribute to the activities of the European Data Protection Board.
\n
(2)The Commission shall not be competent for the supervision of data processing operations of the courts when acting in their judicial capacity.
\n
(3)Subject to subsections (4) and (5), the Commission shall not charge a data subject or data protection officer a fee in respect of the performance by it of its functions under this section.
\n
(4)Where a request referred to in Article 46(4) of the Directive is manifestly unfounded or excessive, the Commission may— (a) charge the person who made the request a reasonable fee, based on its administrative costs, or (b) refuse to act on the request.
\n
(5)It shall be for the Commission to demonstrate that a request referred to in subsection (4) is manifestly unfounded or excessive.
\n
(6)In this section, “excessive” includes, in particular, repetitive.
\n
(7)For the purposes of this section, a request is repetitive where it is substantially the same as a request previously made by or on behalf of the same person and dealt with under this Part.
\n
Power of the Commission to advise and issue opinions 102. The Commission shall have the power to issue opinions on matters related to the protection of personal data to— (a) on its own initiative or on request by the body concerned, the Houses of the Oireachtas, Government, public authorities and bodies, and (b) on its own initiative, the public.
\n
Mutual assistance 103. (1) The Commission shall, for the purposes referred to in section 101
\n
(1)(h)— (a) in accordance with this Chapter, provide other supervisory authorities with mutual assistance, and (b) put in place measures for effective cooperation with those authorities.
\n
(2)The Commission, on receipt by it of a request of another supervisory authority (“requesting supervisory authority”) shall— (a) without undue delay and no later than one month after receiving the request, take all appropriate measures required to reply to the request, and (b) inform the requesting supervisory authority of the results of, or progress made in response to, the request.
\n
(3)The measures referred to in subsection (2)(a) include the exercise by the Commission of its powers under Chapters 3, 4 and 5 of Part 6.
\n
(4)(a) The Commission shall not refuse to comply with a request unless— (i) it is not responsible under the Directive for the subject matter of the request or for the measures it is requested to carry out, or (ii) compliance with the request would infringe the law of the State or European Union. (b) The Commission shall provide the requesting supervisory authority concerned with the reasons for its refusal under paragraph (a) to comply with a request.
\n
(5)The Commission, where providing information to a requesting supervisory authority in response to a request, shall, insofar as practicable, and in accordance with any implementing acts to which Article 50(8) of the Directive apply, do so— (a) by electronic means, and (b) using a standardised format, if any.
\n
(6)Without prejudice to subsection (7), the Commission shall not charge a fee for any action taken in response to a request for mutual assistance.
\n
(7)The Commission may enter into an agreement with other supervisory authorities on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.
\n
(8)In this section and section 104 — “mutual assistance” includes— (a) responding to requests for information, and (b) undertaking supervisory measures, such as the carrying out of inspections or investigations under Part 6 or consultations; “request” means a request for mutual assistance referred to in Article 50 of the Directive.
\n
Requests by Commission for mutual assistance 104. (1) A request by the Commission to another supervisory authority shall contain all the information necessary for the purpose of the request, which shall include the purpose of and reasons for the request.
\n
(2)The Commission shall use information received by it from another supervisory authority in response to a request only for the purpose for which it was requested.
\n
PART 6
\n
Enforcement of Data Protection Regulation and Directive
\n
Chapter 1
\n
Preliminary Interpretation (Part 6) 105. (1) In this Part— “complaint” means a complaint within the meaning of Chapter 2 or 3; “investigation” means an investigation under Chapter 5; “investigation report” has the meaning assigned to it by section 139 ; “relevant enactment” means— (a) the Data Protection Regulation, or (b) a provision of this Act, or a regulation under this Act, that gives further effect to the Data Protection Regulation; “relevant provision” means a provision of this Act, or a regulation under this Act, that gives effect to the Directive.
\n
(2)A reference in this Part (other than in Chapter 2) to a controller or a processor includes a reference to a controller or a processor, as the case may be, within the meaning of Part 5.
\n
(3)Where a person is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3 — (a) a reference in sections 117 , 128 and 135
\n
(10)to a controller shall be deemed to be a reference to the appropriate authority that, or the Minister who, made the designation, and not to the person, and (b) a reference in sections 132
\n
(6)and 133
\n
(10)to a controller shall be deemed not to include a reference to the person.
\n
(4)A reference in this Part to information obtained in an inquiry (within the meaning of section 110 or 123 ) shall be construed as including, where applicable— (a) an investigation report prepared in the course of the inquiry, and any submissions annexed to the report, and (b) any additional information obtained, in the course of the inquiry, by the Commission under section 140
\n
(2).
\n
Service of documents (Part 6) 106. (1) Subject to section 116
\n
(4)(a), a notice or other document that is required to be served on or given to a person under this Part shall be addressed to the person concerned by name and shall be so served on or given to the person in one of the following ways: (a) by delivering it to the person; (b) by leaving it at the address at which the person ordinarily resides or carries on business or, in a case in which an address for service has been furnished, at that address; (c) by sending it by post in a prepaid registered letter or by any other form of recorded delivery service to the address referred to in paragraph (b); or (d) by electronic means, in a case in which the person has given notice in writing to the person serving or giving the notice or document concerned of his or her consent to the notice or document (or notices or documents of a class to which the notice or document belongs) being served on, or given to, him or her in that manner.
\n
(2)For the purposes of this section, a company within the meaning of the Act of 2014 is deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body of persons shall be deemed to be ordinarily resident at its principal office or place of business.
\n
Chapter 2
\n
Enforcement of Data Protection Regulation Interpretation (Chapter 2) 107. In this Chapter— “complainant” means a data subject who lodges a complaint or, as the case may be, a not-for-profit body, organisation or association that, in accordance with Article 80(1), lodges a complaint on behalf of a data subject; “complaint” means a complaint lodged pursuant to Article 77(1) or in accordance with Article 80(1), and shall be deemed to include a complaint so lodged by or on behalf of a data subject where— (a) the data subject considers that the processing of personal data relating to him or her infringes a relevant enactment, and (b) the Commission is the competent supervisory authority in respect of the complaint; “corrective power” means a power conferred by Article 58(2) of the Data Protection Regulation; “infringement” means an infringement of a relevant enactment; “inquiry” means an inquiry referred to in section 110
\n
(1).
\n
Complaints under Chapter 2: General 108. (1) Where a complaint is lodged with the Commission, the Commission shall, as soon as practicable, give the complainant concerned a notice in writing acknowledging the lodging of the complaint, and informing the complainant of— (a) where the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right under section 150
\n
(5)and (7), and (b) where a supervisory authority other than the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right to a judicial remedy against that competent supervisory authority where it does not— (i) handle the complaint, or (ii) inform the complainant within 3 months from the date on which the complaint is received by that authority on the progress or outcome of the complaint.
\n
(2)Where the Commission is the competent supervisory authority in respect of a complaint, it shall— (a) handle the complaint in accordance with this Part, and (b) inform the complainant, within 3 months from the date on which the complaint is received by the Commission, on the progress or outcome of the complaint.
\n
(3)For the purposes of subsection (2)(b), the Commission shall be taken to have informed a complainant of the outcome of the complaint concerned where it gives the complainant a notice under section 109
\n
(6)or, as the case may be, section 116 .
\n
Commission to handle complaint under Chapter 2 109. (1) For the purposes of section 108
\n
(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.
\n
(2)The Commission, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.
\n
(3)Where the parties concerned reach an amicable resolution of the subject matter of the complaint, the complaint shall, from the date on which the amicable resolution is reached, be deemed to have been withdrawn by the complainant concerned.
\n
(4)Where the Commission considers that an amicable resolution cannot be reached by the parties within a reasonable time, it shall proceed— (a) in the case of a complaint to which section 113 applies, to comply with section 113
\n
(2), or (b) in the case of any other complaint, to take an action specified in subsection (5).
\n
(5)The actions referred to in subsection (4)(b) include one or more than one of the following: (a) rejection of the complaint; (b) dismissal of the complaint; (c) provision to the complainant of advice in relation to the subject matter of the complaint; (d) serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following: (i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment; (ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject; (iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2); (e) causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint; (f) taking of such other action in respect of the complaint as the Commission considers appropriate.
\n
(6)The Commission shall, as soon as practicable after taking an action referred to in subsection (5) (other than paragraph (e) of that subsection), give the complainant a notice in writing informing the complainant of the action taken.
\n
Commission may conduct inquiry into suspected infringement of relevant enactment 110. (1) The Commission, whether for the purpose of section 109
\n
(5)(e), section 113
\n
(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.
\n
(2)The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following: (a) cause any of its powers under Chapter 4 (other than section 135 ) to be exercised; (b) cause an investigation under Chapter 5 to be carried out.
\n
Decision of Commission where inquiry under Chapter 2 conducted of own volition 111. (1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall— (a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and (b) if not so satisfied, make a decision to that effect.
\n
(2)Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision— (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.
\n
(3)The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.
\n
Decision of Commission where inquiry conducted in respect of complaint to which Article 55 or 56(5) applies 112. (1) Where an inquiry has been conducted in respect of a complaint in respect of which the Commission is the competent supervisory authority under Article 55 or 56(5), the Commission, having considered the information obtained in the examination, may— (a) if satisfied that an infringement by the controller or processor to which the complaint relates has occurred or is occurring, make a decision to that effect, or (b) if not so satisfied, make a decision to dismiss the complaint.
\n
(2)Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision— (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.
\n
(3)The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.
\n
Complaint to which Article 60 applies 113. (1) This section applies to a complaint in respect of which the Commission is the lead supervisory authority.
\n
(2)Where section 109
\n
(4)(a) applies, the Commission shall— (a) in accordance with subsection (3), make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor concerned, and (b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint.
\n
(3)In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have regard to— (a) the information obtained by the Commission in its examination of the complaint, including, where an inquiry has been conducted in respect of the complaint, the information obtained in the inquiry, and (b) any draft for a decision that is submitted to the Commission by a supervisory authority in accordance with Article 56(4).
\n
(4)Where the Commission adopts a decision under subsection (2)(b) to the effect that an infringement by the controller or processor concerned has occurred or is occurring, it shall, in addition, make a decision— (a) where an inquiry has been conducted in respect of the complaint— (i) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and (ii) where it decides to so exercise a corrective power, the corrective power that is to be exercised, or (b) where an inquiry has not been conducted in respect of the complaint— (i) as to whether an action specified in subsection (6) should be taken in respect of the controller or processor concerned, and (ii) where it decides to take such an action, the action that is to be taken.
\n
(5)The Commission, in making its decision under subsection (4), shall have due regard to the decision as to the envisaged action to be taken in relation to the controller or processor included in the Commission’s draft decision under subsection (2)(a) or, as the case may be, its revised draft decision under Article 60.
\n
(6)The actions referred to in subsection (4)(b) include either or both of the following: (a) the serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following: (i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment; (ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject; (iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2); (b) the taking of such other action in respect of the complaint as the Commission considers appropriate.
\n
(7)The Commission— (a) where it makes a decision referred to in subsection (4)(a)(ii), shall exercise the corrective power concerned, and (b) where it makes a decision referred to in subsection (4)(b)(ii), shall take the action concerned.
\n
Commission to adopt decision in certain circumstances 114. Where— (a) a complaint is lodged with the Commission, or a complaint is lodged with another supervisory authority and the Commission is the supervisory authority in respect of the complainant concerned, (b) another supervisory authority is the lead supervisory authority in respect of the complaint, and (c) a decision is made, in accordance with Article 60, to dismiss or reject the complaint or, where Article 60(9) applies, part of the complaint, the Commission shall adopt the decision referred to in paragraph (c) in respect of the complaint or, as the case may be, part of the complaint.
\n
Exercise by Commission of corrective power 115. (1) For the purposes of exercising a corrective power under section 111 , 112 or 113, the Commission may do either or both of the following: (a) subject to Chapter 6, decide to impose an administrative fine on the controller or processor concerned; (b) exercise any other corrective power specified in Article 58(2).
\n
(2)Without prejudice to the generality of subsection (1)(b), the Commission may, for the purposes of exercising a power referred to in that provision, serve on the controller or processor concerned an enforcement notice requiring it to take such steps as the Commission considers necessary for those purposes.
\n
Notification of decision of Commission under Chapter 2 116. (1) The Commission shall— (a) as soon as practicable after it makes a decision under section 111 or 112, give the controller or processor concerned a notice in writing setting out— (i) the decision and the reasons for it, and (ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor, and (b) in the case of a decision under section 112 , and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out— (i) the decision and the reasons for it, and (ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor.
\n
(2)Subject to subsection (4), the Commission shall— (a) as soon as practicable after it adopts a decision under section 113
\n
(2)(b), give the controller or processor concerned a notice in writing setting out— (i) the decision and the reasons for it, and (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor, and (b) in the case of a complaint lodged with the Commission, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out— (i) the decision and the reasons for it, and