C27

Subss. (7), (8) repealed, but retained (see below) for certain excepted purposes, (25.05.2018) by Data Protection Act 2018 (7/2018), s. 7(1)(b), (4), S.I. No. 174 of 2018. The excepted purposes in subs. (4) are 7/2018, s. 8(1)(b) (the processing of such data under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 (11/2014) or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018 (5/2018) to the extent that the Act of 1988 is applied in those Acts) and s. 8(2), (3) (transitional provisions).

F9[(7) Where—

(a)  personal data are kept for the purpose of direct marketing, and

(b)  the data subject concerned requests the data controller in writing—

(i)  not to process the data for that purpose, or

(ii) to cease processing the data for that purpose,

then—

(I)  if the request is under paragraph (b)(i)  of this subsection, the data controller—

(A) shall, where the data are kept only for the purpose aforesaid, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, erase the data, and

(B) shall not, where the data are kept for that purpose and other purposes, process the data for that purpose after the expiration of the period aforesaid,

(II) if the request is under paragraph (b)(ii) of this subsection, as soon as may be and in any event not more than 40 days after the request has been given or sent to the data controller, he or she—

(A) shall, where the data are kept only for the purpose aforesaid, erase the data, and

(B) shall, where the data are kept for that purpose and other purposes, cease processing the data for that purpose,

and

(III) the data controller shall notify the data subject in writing accordingly and, where appropriate, inform him or her of those other purposes.

(8) Where a data controller anticipates that personal data, including personal data that is required by law to be made available to the public, kept by him or her will be processed for the purposes of direct marketing, the data controller shall inform the persons to whom the data relates that they may object, by means of a request in writing to the data controller and free of charge, to such processing.]

C28

Section applied with modifications by Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 (11/2014), s. 123(1), (2)(b), partially commenced insofar as the 2014 Act, part 12 ch. 4 (which includes s. 123) relates to an Article 7 request within the meaning of that chapter (20.11.2015) by S.I. No. 508 of 2015, otherwise (3.12.2018) by S.I. No. 503 of 2018.

Application of Act of 1988

123. (1) The Act of 1988 shall, with the modifications specified in subsection (2) and any other necessary modifications, apply to the processing of personal data supplied or received pursuant to—

(a) Chapter 2,

(b) Chapter 3, or

(c) an Article 7 request,

and, for the purposes of the foregoing application of the Act of 1988, references in it to that Act or the provisions of that Act shall, unless the context otherwise requires, be construed as including references to—

(i) Chapter 2 or the provisions of that Chapter,

(ii) Chapter 3 or the provisions of that Chapter, and

(iii) Chapter 3 of Part 5 of the Act of 2008 insofar as that Chapter applies to an Article 7 request or the provisions of that Chapter insofar as they apply to such a request.

(2) The modifications of the Act of 1988 referred to in subsection (1) are the following, namely— ...

(b) in section 2, the insertion of the following subsections after subsection (1):

“(1A) A data controller (including a national contact point) shall in order to comply with subsection (1) (b) as respects personal data kept by him or her also comply with section 125 of the Act of 2014 in respect of those data.

(1B) For the purposes of subparagraphs (i) and (ii) of subsection (1) (c), the processing of personal data supplied or received pursuant to—

(a) Chapter 2 of Part 12 of the Act of 2014, or

(b) Chapter 3 of that Part of that Act,

is deemed to be a purpose compatible with the purpose for which those data were obtained.”,

...

C29

Application of section extended with modification (27.01.2014) by Credit Reporting Act 2013 (45/2013), s. 19(2), (4), S.I. No. 19 of 2014.

Data protection

19. ...

(2) Sections 2 , 4 and 6 of the Data Protection Act 1988 shall have effect as if—

(a) references to personal data included relevant credit data, and

(b) a person to whom this section applies were a living individual, and sections 9, 10, 12 and 24 to 31 of that Act apply accordingly.

(3) ...

(4) This section applies to any person with an annual turnover of not more than €3,000,000 (and to whom sections 2, 4 and 6 of the Data Protection Act 1988 would not apply apart from this section).

...