C1

Application of collectively cited Data Protection Acts restricted (11.03.2022) by European Union (Good Agricultural Practice for Protection of Waters) Regulations 2022 (S.I. No. 113 of 2022), reg. 31, in effect as per reg. 1(2).

Compliance with Data Protection Acts

31. The provision of information by a local authority, the Agency or the Minister for Agriculture, Food and the Marine in accordance with Article 27, 29 or 30 of these Regulations shall not be a breach of the Data Protection Acts, 1988, 2003 and 2018.

C2

Application of collectively cited Data Protection Acts 1988 and 2003 extended with any necessary modifications (1.05.2020) by Criminal Justice (Miscellaneous Provisions) Act 2009 (28/2009), s. 23(2), S.I. No. 152 of 2020.

Data Protection.

23.— (1) The Data Protection Commissioner is hereby designated as the national supervisory authority for the purposes of Article 60 of the Council Decision and Article 114 of the Schengen Convention.

(2) The Data Protection Acts 1988 and 2003 shall apply and have effect with any necessary modification to the collection, processing, keeping, use and disclosure of personal data for the purposes of the operation of the Council Decision and the Schengen Convention.

...

C3

Application of collectively cited Data Protection Acts restricted (2.09.2019) by Childcare Support Act 2018 (11/2019), s. 24(1), S.I. No. 348 of 2019.

Processing of personal data

24. (1) Notwithstanding anything contained in the Data Protection Acts 1988 and 2003 or any other enactment, the data controller of a person listed in Schedule 3 or of a person prescribed for the time being under subsection (2) (in this subsection called “the first named person”) shall, on being requested to do so by the data controller of a person so listed or prescribed, process personal data kept by the first named person, or information extracted from such data, to the data controller of the other person so listed or prescribed for the time being, if the data controller of the first named person is satisfied that it will be used for a relevant purpose only.

(2) If a person (not being a person listed in Schedule 3, or prescribed for the time being under this subsection) keeps personal data that is relevant to any of the functions of the scheme administrator, and the Minister considers that such supply by the person not so listed or prescribed to a person so listed or prescribed will further the attainment of a relevant purpose, then the Minister, following consultation with the Data Protection Commissioner, may prescribe that person for the purposes of subsection (1).

(3) Any processing of personal data for the purposes of subsection (1) shall go no further than is reasonably necessary for the attainment of the relevant purpose.

(4) A data controller may refuse a request under subsection (1) if he or she is satisfied that it would be unwarranted in any particular case by reason of prejudice to the fundamental rights and freedoms or legitimate interests of the data subject.

(5) The Minister may, following consultation with the Data Protection Commissioner, make regulations specifying particular circumstances in which subsection (3) is, or is not, to be taken as satisfied.

...

C4

Application of Act extended (28.05.2018) by Vehicle Registration Data (Automated Searching and Exchange) Act 2018 (5/2018), s. 8, S.I. No. 178 of 2018.

Application of Data Protection Act 1988

8. The Data Protection Act 1988, shall apply to the processing of personal data supplied or received under this Act and, for the purposes of the application of the Data Protection Act 1988, references in it to that Act or the provisions of that Act shall, unless the context otherwise requires, be construed as including references to this Act or the provisions of this Act.

C5

Application of Act restricted (25.05.2018) by Data Protection Act 2018 (7/2018), s. 8, S.I. No. 174 of 2018.

Application of Data Protection Act 1988

8. (1) Subject to this section, the Act of 1988 shall, on and from the date on which this section comes into operation, cease to apply to the processing of personal data (within the meaning of that Act) other than—

(a) the processing of such data for the purposes of safeguarding the security of the State, the defence of the State or the international relations of the State, or

(b) the processing of such data under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018 to the extent that the Act of 1988 is applied in those Acts.

(2) The Act of 1988 shall apply to—

(a) a complaint by an individual under section 10 of that Act made before the commencement of this section, and

(b) a contravention of that Act that occurred before such commencement.

(3) An investigation under section 10 of the Act of 1988 that was begun but not completed before the commencement of this section shall be completed in accordance with that Act and that Act shall apply to such an investigation.

C6

Reference to “Commissioner” construed (25.05.2018, establishment day) by Data Protection Act 2018 (7/2018), s. 14(3)), subs. (4) and S.I. No. 175 of 2018.

Transfer of functions of Data Protection Commissioner to Commission

...

(3) A reference in the Act of 1988 (other than in section 1(3)(c)(iii) in so far as it refers to the Commissioner of the Garda Síochána) to the Commissioner shall be construed as a reference to the Commission.

(4) This section shall come into operation on the establishment day.

C7

Application of collectively cited Data Protection Acts 1988 and 2003 extended with any necessary modifications (31.12.2016) by Customs Act 2015 (18/2015), s. 41(4), (5), S.I. No. 611 of 2016.

Naples II Convention and CIS Decision

41. ...

(4) For the purposes of this Act, the Naples II Convention and the CIS Decision, the Data Protection Acts 1988 and 2003 shall apply and have effect, with any necessary modifications, to the collection, processing, keeping, use or disclosure of personal data.

(5) Without prejudice to the generality of subsection (4), for the purposes of—

(a) Article 30 of the CIS Decision, and

(b) Article 25 of the Naples II Convention,

section 7 of the Data Protection Act 1988 shall apply as regards the liability of the State for injury caused to a person through the use of the CIS in the State, and for injury caused to a person through the processing of data communicated in the State, respectively.

...

C8

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (28.01.2014) by European Union (Good Agricultural Practice for Protection of Waters) Regulations 2014 (S.I. No. 31 of 2014), reg. 31.

Compliance with Data Protection Acts

31. The provision of information by a local authority, the Agency or the Minister for Agriculture, Food and the Marine in accordance with Article 27, 29 or 30 of these Regulations shall not be a breach of the Data Protection Acts, 1988 and 2003.

C9

Application of Act restricted by Personal Insolvency Act 2012 (44/2012), s. 21A, as inserted (31.07.2013) by Courts and Civil Law (Miscellaneous Provisions) Act 2013 (32/2013), s. 47, S.I. No. 286 of 2013.

Retention of information by Insolvency Service

21A. Notwithstanding the Data Protection Act 1988, the Insolvency Service shall retain such information or data obtained by it under this Act as is necessary for the performance of its functions under this Act.

C10

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (23.03.2010) by European Communities (Data Collection in the Fisheries Sector) Regulations 2010 (S.I. No. 132 of 2010), reg. 7.

Obligations on certain public bodies

7. Notwithstanding the Data Protection Acts 1998 and 2003, the Sea Fisheries Protection Authority, the Marine Institute, Bord Iascaigh Mhara and the Minister shall make available to a data collection officer such data relating to activities referred to in Regulations 3, 4 or 5 as is available.

...

C11

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (21.12.2009) by National Asset Management Agency Act 2009 (34/2009), s. 201, S.I. No. 545 of 2009.

Operation of Data Protection Acts 1988 and 2003.

201.— To avoid doubt, an obligation on a credit institution or any other person under this Act to disclose information to NAMA, a NAMA group entity or the NTMA extends to personal information, within the meaning of the Data Protection Acts 1988 and 2003.

...

C12

Application of Act restricted and application of Act confirmed (1.09.2008) by Criminal Justice (Mutual Assistance) Act 2008 (7/2008), ss. 94, 107 and sch. 14, S.I. No. 338 of 2008.

Application in State of Ireland - US Treaty.

94.—(1) The Ireland - US Treaty has the force of law in its application in relation to the State.

...

(5) Article 7, in its application in relation to the use of personal data contained in evidence or information obtained under the Treaty by a person in the State, is without prejudice to the application of section 7 (duty of care owed by data controllers and data processors) of the Data Protection Act 1988 in respect of the use of such data.

(6) The Data Protection Acts 1988 and 2003 apply in relation to such data in respects other than those related to their use.

...

Personal data protection.

107.— (1) The provisions of the relevant international instrument have effect in respect of the use of personal data communicated to or otherwise obtained by a person in the State under the instrument.

2) Subsection (1) is without prejudice to the application of section 7 (duty of care owed by data controllers and data processors) of the Data Protection Act 1988 in respect of the use of such data.

3) The Data Protection Acts 1988 and 2003 apply in relation to such data in respects other than those relating to their use.

...

SCHEDULE 14

Text of Ireland/US Treaty of 18 January 2001, as applied by Instrument of 14 July 2005

...

Article 7

1. The Requesting Party may use any evidence or information obtained from the Requested Party:

(a) for the purpose of its criminal investigations and proceedings;

(b) for preventing an immediate and serious threat to its public security;

(c) in its non-criminal judicial or administrative proceedings directly related to investigations or proceedings:

(i) set forth in subparagraph (a); or

(ii) for which mutual legal assistance was rendered under Article 1 (1 bis)(a) of this Treaty;

(d) for any other purpose, if the evidence or information has been made public within the framework of proceedings for which they were transmitted, or in any of the situations described in subparagraphs (a), (b) and (c); and

(e) for any other purpose only with the prior consent of the Requested Party.

...

C13

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (1.11.2009) by European Communities (Payment Services) Regulations 2009 (S.I. No. 383 of 2009), reg. 94, continued in force.

Processing of personal data.

94. The processing, within the meaning of the Data Protection Acts 1988 and 2003, of personal data by a payment system or payment service provider is permitted for the purposes of the prevention, investigation and detection of payment fraud.

C14

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (5.12.2005) by Civil Registration Act 2004 (3/2004), s. 66, S.I. No. 764 of 2005, as amended

• by Housing (Miscellaneous Provisions) Act 2009 (22/2009), s. 8 and sch. 2 part 8 item 1, not commenced as of date of revision;

• (1.01.2011) by Civil Partnership and Certain Rights and Obligations of Cohabitants Act 2010 (24/2010), s. 21, S.I. No. 648 of 2010;

• (1.01.2009) by Health Act 2008 (21/2008), s. 11, commenced as per s. 1(2);

• (17.12.2008) by Social Welfare (Miscellaneous Provisions) Act 2008 (22/2008), s. 25, commenced on enactment;

• (1.01.2005) by Health Act 2004 (42/2004), s. 75 and sch. 6 part 26 item 26, S.I. No. 887 of 2004.

Power of Ard-Chláraitheoir to give information to others.

66.—(1) Notwithstanding anything contained in the Data Protection Acts 1988 to 2003 or any other enactment, an tArd-Chláraitheoir may, after consultation with [...] the Minister for Social and Family Affairs, give such information as may be prescribed in relation to births, [marriages, civil partnerships, decrees of divorce, decrees of nullity of marriage, decrees of dissolution or decrees of nullity of civil partnership], registered under this Act or under any of the repealed enactments to—

(a) the Minister for Defence for the purpose of—

(i) the administration of schemes under the Defence Forces (Pensions) Acts 1932 to 1975, or

(ii) the administration of the Army Pensions Acts 1923 to 1980,

(b) the Minister for the Environment, Heritage and Local Government for the purpose of registration in a register under the Electoral Act 1992,

(c) the Minister for Foreign Affairs for the purpose of—

(i) determining entitlements to passports, or

(ii) verifying the identity of persons applying for or holding passports,

(d) the Minister for Justice, Equality and Law Reform for the purpose of determining the immigration or citizenship status of persons,

(e) the Minister for Social and Family Affairs for the purpose of—

(i) determining entitlement to, or control of, benefit under the Social Welfare (Consolidation) Act 1993, or

(ii) section 223 of that Act,

(f) the Minister for Transport for the purpose of the grant of driving licences and provisional licences under Part III of the Road Traffic Act 1961,

(g) the Minister for the purpose of the enforcement of regulations under section 31 of the Health Act 1947 and the Minister or [the Executive], hospital or other body or agency participating in any cancer screening programme (including any programme of breast or cervical cancer screening) authorised by the Minister, for the purpose of compiling and maintaining a record of the names, addresses and relevant dates of persons who, for public health reasons, may be invited to participate in any such programme,

(h) the Revenue Commissioners for the purpose of the administration of the Taxes Consolidation Act 1997, the Stamp Duties Consolidation Act 1999 and the Capital Acquisitions Tax Consolidation Act 2003,

(i) [the Executive] for the purpose of determining entitlement to a service provided for, by or under section 45[, 45A], 58, 59 or 61 of the Health Act 1970, and

(j) a housing authority (within the meaning of the Housing Act 1966 ) for the purpose of—

(i) the determination of entitlement to houses or grants under the Housing Acts 1966 to 2002,

(ii) the determination of a rent or other payment under section 58 of the Housing Act 1966, or

(iii) the preparation of a housing strategy under the Planning and Development Act 2000.

(2) In this section “information” means personal data (within the meaning of the Data Protection Acts 1988 and 2003) and information extracted from such data.

C15

Application of collectively cited Data Protection Acts 1988 and 2003 restricted (1.05.2004) by European Communities (Clinical Trials on Medicinal Products For Human Use) Regulations 2004 (S.I. No. 190 of 2004), reg. 48(3)(d).

Enforcement

48. — ...

(3) ...

(d) inspect and copy or extract information from any data (including personal data) within the meaning of the Data Protection Acts 1988 and 2003

...

C16

Application of Act extended with any necessary modifications (24.02.2003) by European Communities (Directive 2000/31/EC) Regulations 2003 (S.I. No. 68 of 2003), reg. 9(6).

Unsolicited commercial communications.

9. ...

(6) The following provisions of the Act, namely —

(a) sections 1, 10, 12, 24 and 25,

(b) section 26 in so far as it relates to a requirement specified in an enforcement notice or an information notice or a decision of the Data Protection Commissioner in relation to a complaint under section 10 (1) (a) of the Act,

and

(c) sections 27 to 30,

apply for the purpose of this Regulation with the modifications specified in paragraphs (7) to (10) and any other necessary modifications.

(7) References, in the provisions of the Act mentioned in paragraph (6), to that Act or the provisions of that Act shall, unless the context otherwise requires be construed as including references to this Regulation or the provisions of this Regulation.

...

(11) In this Regulation —

“Act” means the Data Protection Act 1988 (No. 25 of 1988);

...

C17

Application of Act extended with any necessary modifications (22.02.2002) by Customs and Excise (Mutual Assistance) Act 2001 (2/2001), ss. 5 and 9, S.I. No. 59 of 2002.

Application of Data Protection Act, 1988.

5.—(1) For the purposes of this Act, the CIS Convention and the Customs Co-operation Convention, the Data Protection Act, 1988, shall apply and have effect, with any necessary modifications, to the collection, processing, keeping, use or disclosure of personal data included in or received from the Customs Information System.

(2) Without prejudice to the generality of subsection (1), for the purposes of Article 21 of the CIS Convention, section 7 of the Data Protection Act, 1988, shall apply as regards the liability of the State for injury caused to a person through the use of the Customs Information System in the State.

(3) Without prejudice to the generality of subsection (1), for the purposes of Article 25 of the Customs Co-operation Convention, section 7 of the Data Protection Act, 1988, shall apply as regards the liability of the State for injury caused to a person through the processing of data communicated in the State.

...

Offences.

9.—Without prejudice to the generality of section 5(1), any person who uses personal data from the Customs Information System other than for the purpose of the aim specified in Article 2(2) of the CIS Convention shall, save where such use is in accordance with and is subject to the conditions specified in Article 8(1) of that Convention, be guilty of an offence under the Data Protection Act, 1988.

C18

Application of Act restricted (20.11.2000) by Refugee Act 1996 (17/1996), s. 11(5), S.I. No. 365 of 2000.

Investigation of application by Commissioner.

11.— ...

(5) Nothing in the Data Protection Act, 1988, shall be construed as prohibiting a person from giving to the Commissioner, on request by him or her, such information as is in the person’s possession or control relating to the application.

C19

Act applied to certain bodies with any necessary modifications (2.12.1999) by British-Irish Agreement Act 1999 (1/1999), s. 51, S.I. No. 377 of 1999.

Application of Data Protection Act, 1988.

51.— ...

(2) The Act of 1988 shall apply in relation to the Bodies with any necessary modifications and subject to the subsequent provisions of this section.

...

C20

Application of Act restricted (1.04.1997) by Health (Provision of Information) Act 1997 (9/1997), s. 1(2), commenced on enactment. [Note that functions of specified bodies including health boards were transferred (1.01.2005) to the Health Service Executive by Health Act 2004 (42/2004), s. 59, S.I. No. 887 of 2004].

Requests for and provision of information.

1.—...

(2) Nothing in the Data Protection Act, 1988, shall prevent the Minister for Health or a health board, hospital or other body or agency referred to in subsection (1) (b) from providing—

(a) to the Minister for Health, or to any other such health board, hospital or other body or agency, for the purposes of that programme, or

(b) for the purposes of inviting persons to participate in that programme,

any information provided under subsection (1).

C21

Application of Act restricted (1.11.1994) by Statistics Act 1993 (21/1993), s. 24(2), S.I. No. 323 of 1994.

Invitation to provide information on a voluntary basis.

24.—...

(2) Persons and undertakings may provide information and records, or copies thereof, which they may possess to the Director General or officers of statistics on invitation under the provisions of this Act notwithstanding anything contained in the Data Protection Act, 1988.