28. The Commission may, with the consent of the Minister, prescribe the fees to be paid to it—

(a) for the performance of its functions under Article 57(1)(r) and (s), and

(b) in relation to requests that are manifestly unfounded or excessive in accordance with Article 57(4).

29. For the purposes of the application of the Data Protection Regulation in the State, a reference to “child” in the Regulation shall be taken to be a reference to a person under the age of 18 years.

30. It shall be an offence under this Act for any company or corporate body to process the personal data of a child as defined by section 29 for the purposes of direct marketing, profiling or micro-targeting. Such an offence shall be punishable by an administrative fine under section 141.

31. (1) The age of a child specified for the purposes of Article 8 is 16 years of age.

(2) For the purposes of the application of Article 8 in the State, the reference in that Article to “information society services” does not include a reference to preventative or counselling services.

(3) The Minister shall—

(a) not later than 3 years after the coming into operation of this section, commence a review of the operation of subsection (1), and

(b) complete that review not later than one year after its commencement.

32. (1) Without prejudice to the generality of Article 40, the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of the Data Protection Regulation with regard to—

(a) the protection of children,

(b) the information to be provided by a controller to children,

(c) the manner in which the consent of the holders of parental responsibility over a child is to be obtained for the purposes of Article 8,

(d) integrating the necessary safeguards into processing in order to protect the rights of children in an age-appropriate manner for the purpose of Article 25, and

(e) the processing of the personal data of children for the purposes of direct marketing and creating personality and user profiles.

(2) For the purpose of considering whether a draft code of conduct or an extension or amendment to an existing code of conduct referred to in Article 40 provides sufficient appropriate safeguards referred to in that Article, the Commission may, where the draft, extension or amendment, as the case may be, concerns the application of the Data Protection Regulation to children, consult with such persons as it considers appropriate including—

(a) children and bodies who appear to the Commission to represent the interests of children,

(b) the holders of parental responsibility over children, and

(c) the Ombudsman for Children.

33. (1) Subject to subsection (3), in accordance with Article 17, a controller shall, at the request of a data subject, without undue delay erase personal data of the data subject where the data have been collected in relation to the offer to that data subject of information society services referred to in Article 8(1).

(2) Subject to subsection (3), where a controller has disclosed the personal data which are the subject of a request under subsection (1) to another controller or controllers, the first-mentioned controller shall, taking account of available technology and the cost of implementation, take all reasonable steps, including technical measures, to inform the other controller or controllers which are processing that personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

(3) Subsections (1) and (2) shall not apply to the extent that the processing of the personal data concerned is necessary for the purposes set out in Article 17(3).

34. (1) The Minister may, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations requiring controllers, processors, associations or other bodies representing categories of controllers or processors to designate a data protection officer in accordance with Article 37(4).

(2) Regulations under subsection (1) may apply to—

(a) one or more than one class of controller,

(b) one or more than one class of processor, or

(c) one or more than one class of association or other body representing categories of controllers or processors.

(3) In making regulations under subsection (1) the Minister shall have regard to the need for the protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall have regard in particular to—

(a) the nature, scope, context and purposes of the processing,

(b) risks arising for the rights and freedoms of individuals,

(c) the likelihood and the severity of such risk for the individuals concerned, and

(d) the costs of implementation of any requirement if it were imposed under that subsection.

35. The Irish National Accreditation Board is the accreditation body for the purposes of Article 43(1).

36. (1) Where a requirement that suitable and specific measures be taken to safeguard the fundamental rights and freedoms of data subjects in processing personal data of those subjects is imposed by this Act or regulations made under this Act, those measures may include in particular the following—

(a) explicit consent of the data subject for the processing of his or her personal data for one or more specified purposes,

(b) limitations on access to the personal data undergoing processing within a workplace in order to prevent unauthorised consultation, alteration, disclosure or erasure of personal data,

(c) strict time limits for the erasure of personal data and mechanisms to ensure that such limits are observed,

(d) specific targeted training for those involved in processing operations, and

(e) having regard to the state of the art, the context, nature, scope and purposes of data processing and the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subjects—

(i) logging mechanisms to permit verification of whether and by whom the personal data have been consulted, altered, disclosed or erased,

(ii) in cases in which it is not mandatory under the Data Protection Regulation, designation of a data protection officer,

(iii) where the processing involves data relating to the health of a data subject, a requirement that the processing is undertaken by a person referred to in section 52(2),

(iv) pseudonymisation of the personal data, and

(v) encryption of the personal data.

(2) Regulations may be made for either or both of the following purposes—

(a) to identify additional suitable and specific measures (to those referred to in paragraphs (a) to (e) of subsection (1)) that may be taken to safeguard the fundamental rights and freedoms of data subjects in the processing of personal data of those subjects for the purposes of the requirement referred to in subsection (1),

(b) to specify that a measure or measures referred to in paragraphs (a) to (e) of subsection (1) or an additional measure or measures identified under paragraph (a), or both, is or are mandatory in respect of the processing to which they are stated to apply.

(3) Without prejudice to the generality of subsection (2)(a), additional suitable and specific measures identified in regulations made under that subsection may relate to—

(a) governance structures,

(b) processes or procedures for risk assessment purposes,

(c) processes or procedures for the management and conduct of research projects, and

(d) other technical and organisational measures designed to ensure that the processing is carried out in accordance with the Data Protection Regulation and processes for testing and evaluating the effectiveness of such measures.

(4) Regulations under subsection (2) may—

(a) identify different measures for different categories of personal data, different categories of controllers, different types of processing or categories of processing, and

(b) specify that a measure or measures referred to in subsection (2)(b) is or are mandatory in respect of the processing of different categories of personal data, processing by different categories of controllers and in respect of different types of processing or categories of processing.

(5) Subject to subsection (6), regulations may be made under subsection (2)—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(6) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (2).

(7) The Commission may, on being consulted under subsection (6), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(8) In making regulations under subsection (2), the Minister or any other Minister of the Government, as the case may be, shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing shall have regard to—

(a) the nature, scope, context and purposes of the processing,

(b) risks arising for the rights and freedoms of individuals, and

(c) the likelihood and the severity of the risks for the individuals concerned.

37. (1) The Minister may, in the absence of an adequacy decision under Article 45, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations restricting the transfer of categories of personal data to a third country or an international organisation for important reasons of public policy.

(2) Regulations under subsection (1) shall specify the important reasons of public policy for restricting the transfer concerned and may be expressed to apply by reference to one or more of the following—

(a) a category or categories of personal data,

(b) a third country or classes of third country, or

(c) an international organisation.

(3) In making regulations under subsection (1), the Minister shall have regard to the public interest and the need for protection of individuals with regard to the processing of their personal data and, without prejudice to the generality of the foregoing, shall in particular have regard to—

(a) the nature, scope, context and purposes of the processing,

(b) the desirability of facilitating international transfers of data,

(c) risks arising for the rights and freedoms of individuals, and

(d) the likelihood and the severity of such risks for individuals concerned.

38. (1) The processing of personal data shall be lawful to the extent that such processing is necessary and proportionate for—

(a) the performance of a function of a controller conferred by or under an enactment or by the Constitution, or

(b) the administration by or on behalf of a controller of any non-statutory scheme, programme or funds where the legal basis for such administration is a function of a controller conferred by or under an enactment or by the Constitution.

(2) Subject to subsection (3), the processing of personal data and disclosure of that data to a person for the purposes of preserving the Common Travel Area, or any part of that Area, shall be lawful where the controller is an Irish air carrier, an air carrier or a sea carrier.

(3) The Minister shall, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, make regulations for the purposes of subsection (2) specifying—

(a) the part of the Common Travel Area to which the regulations apply,

(b) the personal data that may be processed,

(c) the circumstances in which the personal data may be disclosed, including specifying the person to whom the data may be disclosed, and

(d) such other conditions (if any) as the Minister considers appropriate to impose on such processing.

(4) Subject to subsection (5), the processing of personal data which is necessary for the performance of a task carried out in the public interest by a controller or which is necessary in the exercise of official authority vested in a controller may be specified in regulations made—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(5) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (4).

(6) The Commission may, on being consulted under subsection (5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(7) Regulations made under subsection (4) shall specify—

(a) the personal data that may be processed,

(b) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

(c) such other conditions (if any) as the Minister or any other Minister of the Government, as the case may be, considers appropriate to impose on such processing.

(8) In this section—

“air carrier” means an undertaking established in the State that provides air services;

“air service” has the meaning it has in Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 2008⁷ on common rules for the operation of air services in the Community (Recast);

“Common Travel Area” means the State, the United Kingdom of Great Britain and Northern Ireland, the Channel Islands and the Isle of Man;

“Irish air carrier” means an undertaking with a valid operating licence, within the meaning of Regulation (EC) No. 1008/2008 of the European Parliament and of the Council of 24 September 2008⁸, granted by the Commission for Aviation Regulation;

“passenger” means a person carried by an air carrier on an aircraft, or as the case may be, a sea carrier in a passenger ship, other than a member of the crew of the aircraft or passenger ship concerned;

“passenger ship” means a sea-going ship that carries more than 12 passengers;

“sea carrier” means an undertaking established in the State that, for remuneration, carries passengers by sea in a passenger ship.

39. (1) A specified person may, in the course of that person’s electoral activities in the State, use the personal data of a data subject for the purpose of communicating in writing (including by way of newsletter or circular) with the data subject.

(2) Communicating in accordance with subsection (1) shall, for the purposes of Article 6(1)(e), be considered to be the performance of a task carried out in the public interest.

(3) In this section, “specified person” means—

(a) a political party,

(b) a member of either House of the Oireachtas, the European Parliament or a local authority, or

F4[(c) a candidate for election to the office of President of Ireland, or Mayor of Limerick, or for membership of either House of the Oireachtas, the European Parliament or a local authority.]

(4) In this section and in sections 48, 58 and 59, “electoral activities” includes the dissemination of information, including information as to a person’s activities and policies, that might reasonably be of interest to electors.

40. (1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.

(2) A person may make a request or representation on behalf of a data subject where the data subject—

(a) has given his or her consent to the making of the request or representation, as the case may be, or

(b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

(3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

(4) For the purpose referred to in subsection (1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation.

(5) In this section, “elected representative” means—

(a) a member of either House of the Oireachtas,

(b) a member of the European Parliament,

(c) a member of a local authority.

41. Without prejudice to the processing of personal data for a purpose other than the purpose for which the data has been collected which is lawful under the Data Protection Regulation, the processing of personal data and special categories of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing is necessary and proportionate for the purposes—

(a) of preventing a threat to national security, defence or public security,

(b) of preventing, detecting, investigating or prosecuting criminal offences, or

(c) set out in paragraph (a) or (b) of section 47.

42. (1) Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, personal data may be processed, in accordance with Article 89, for—

(a) archiving purposes in the public interest,

(b) scientific or historical research purposes, or

(c) statistical purposes.

(2) Processing of personal data for the purposes referred to in subsection (1) shall respect the principle of data minimisation.

(3) Where the purposes referred to in paragraph (a), (b) or (c) of subsection (1) can be fulfilled by processing which does not permit, or no longer permits, identification of data subjects, the processing of information for such purposes shall be fulfilled in that manner.

43. (1) The processing of personal data for the purpose of exercising the right to freedom of expression and information, including processing for journalistic purposes or for the purposes of academic, artistic or literary expression, shall be exempt from compliance with a provision of the Data Protection Regulation specified in subsection (2) where, having regard to the importance of the right of freedom of expression and information in a democratic society, compliance with the provision would be incompatible with such purposes.

(2) The provisions of the Data Protection Regulation specified for the purposes of subsection (1) are Chapter II (principles), other than Article 5(1)(f), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries and international organisations), Chapter VI (independent supervisory authorities) and Chapter VII (cooperation and consistency).

(3) The Commission may, on its own initiative, refer any question of law which involves consideration of whether processing of personal data is exempt in accordance with subsection (1) to the High Court for its determination.

(4) An appeal shall, by leave of the High Court, lie from a determination of that Court on a question of law under subsection (3) to the Court of Appeal.

(5) In order to take account of the importance of the right to freedom of expression and information in a democratic society that right shall be interpreted in a broad manner.

44. (1) For the purposes of Article 86, personal data contained in a record may be disclosed where a request for access to the record is granted under and in accordance with the Act of 2014 pursuant to an FOI request.

(2) For the purposes of Article 86, personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the Access to Information on the Environment Regulations pursuant to a request within the meaning of those Regulations.

(3) In this section—

“Access to Information on the Environment Regulations” means the European Communities (Access to Information on the Environment) Regulations 2007 (S.I. No. 133 of 2007);

“Act of 2014” means the Freedom of Information Act 2014;

“environmental information” has the same meaning as it has in the Access to Information on the Environment Regulations;

“FOI request” has the same meaning as it has in the Act of 2014;

“record” has the same meaning as it has in the Act of 2014.

45. Subject to compliance with the Data Protection Regulation and any other relevant enactment or rule of law, the processing of special categories of personal data shall be lawful to the extent the processing is—

(a) authorised by section 41 and sections 46 to 54, or

(b) otherwise authorised by Article 9.

46. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law.

47. The processing of special categories of personal data shall be lawful where the processing—

(a) is necessary for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

(b) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

48. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of personal data revealing political opinions shall be lawful where the processing is carried out—

(a) in the course of electoral activities in the State for the purpose of compiling data on peoples’ political opinions by—

(i) a political party, or

(ii) a candidate for election to, or a holder of, elective political office in the State,

and

F5[(b) by An Coimisiún Toghcháin in the performance of its functions.]

49. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing respects the essence of the right to data protection and is necessary and proportionate for—

(a) the administration of justice, or

(b) the performance of a function conferred on a person by or under an enactment or by the Constitution.

50. Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of data concerning health shall be lawful where the processing is necessary and proportionate for the purposes of the following:

(a) a policy of insurance or life assurance,

(b) a policy of health insurance or health-related insurance,

(c) an occupational pension, a retirement annuity contract or any other pension arrangement, or

(d) the mortgaging of property.

51. (1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection (3).

(2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).

(3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following—

(a) special categories of personal data, and

(b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.

(4) Without prejudice to the generality of subsection (3), regulations made under that subsection shall identify—

(a) the substantial public interest concerned, and

(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(5) For the purposes of subsection (4)(b), subsections (2) to (8) of section 36 shall apply in like manner to regulations made under subsection (3) as they apply to regulations made under section 36.

(6) Regulations may be made under subsection (3) by—

(a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

(b) any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(8) Regulations made under subsection (3) shall—

(a) respect the essence of the right to data protection, and

(b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(9) In this section, “Article 10 data” has the meaning assigned to it by section 55.

52. (1) Subject to subsection (2) and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary—

(a) for the purposes of preventative or occupational medicine,

(b) for the assessment of the working capacity of an employee,

(c) for medical diagnosis,

(d) for the provision of medical care, treatment or social care,

(e) for the management of health or social care systems and services, or

(f) pursuant to a contract with a health practitioner.

(2) Processing shall be lawful in accordance with subsection (1) where it is undertaken by or under the responsibility of—

(a) a health practitioner, or

(b) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner.

(3) In this section, “health practitioner” has the same meaning as it has in the Health Identifiers Act 2014.

53. Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where it is necessary for public interest reasons in the area of public health including—

(a) protecting against serious cross-border threats to health, and

(b) ensuring high standards of quality and safety of health care and of medicinal products and medical devices.

54. Subject to compliance with section 42, the processing of special categories of personal data is lawful where such processing is necessary and proportionate for—

(a) archiving purposes in the public interest,

(b) scientific or historical research purposes, or

(c) statistical purposes.

55. (1) Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to compliance with Article 6(1) and to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, personal data referred to in Article 10 (in this section referred to as “Article 10 data”) may be processed—

(a) under the control of official authority, or

(b) where—

(i) the data subject has given explicit consent to the processing for one or more specified purposes except where the law of the European Union or the law of the State prohibits such processing,

(ii) processing is necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,

(iii) processing is—

(I) necessary for the purpose of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

(II) otherwise necessary for the purposes of establishing, exercising or defending legal rights,

(iv) processing is necessary to prevent injury or other damage to the data subject or another person or loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or another person, or

(v) processing is permitted in regulations made under subsection (3) or is otherwise authorised by the law of the State.

(2) Processing under the control of official authority referred to in subsection (1)(a) includes processing required for the following purposes:

(a) the administration of justice;

(b) the exercise of a regulatory, authorising or licensing function or determination of eligibility for benefits or services;

(c) protection of the public against harm arising from dishonesty, malpractice, breaches of ethics or other improper conduct by, or the unfitness or incompetence of, persons who are or were authorised to carry on a profession or other activity;

(d) enforcement actions aimed at preventing, detecting or investigating breaches of the law of the European Union or the law of the State that are subject to civil or administrative sanctions;

(e) archiving in the public interest, scientific or historical research purposes or statistical purposes where the processing is carried out in accordance with section 42 for those purposes by or on behalf of a public authority or public body.

(3) Without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 and subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject and subject to subsection (7), regulations may be made permitting the processing of Article 10 data where the processing is necessary and proportionate to—

(a) assess the risk of fraud or prevent fraud,

(b) assess the risk of bribery or corruption, or both, or to prevent bribery or corruption, or both, or

(c) ensure network and information systems security, and prevent attacks on and damage to computer and electronic communications systems.

(4) Subject to subsection (5), regulations may be made under subsection (3)—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(5) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (3).

(6) The Commission may, on being consulted under subsection (5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) any risks arising for the rights and freedoms of individuals, and

(c) the likelihood of any such risks arising and the severity of such risks.

(8) A person who knowingly or recklessly contravenes this section or any regulations made under subsection (3) shall be guilty of an offence and shall be liable—

(a) on summary conviction to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

(9) In this section, “Article 10 data” shall include personal data relating to the alleged commission of an offence and any proceedings in relation to such an offence.

56. (1) Subject to subsection (3), a request by a data subject under Article 15 in relation to the result of an examination at which he or she was a candidate, or in relation to a script completed by him or her in the course of such an examination shall, for the purposes of that Article, be taken to have been made on the later of—

(a) the date of the first publication of the results of the examination, or

(b) the date of the request.

(2) A request by a data subject under Article 15 in relation to the result of an appeal by the data subject against the result of an examination at which he or she was a candidate shall, for the purposes of that Article, be taken to have been made on the later of—

(a) the date of the first publication of the results of the appeal, or

(b) the date of the request.

(3) Where—

(a) a request by a data subject referred to in subsection (1) relates to a script completed by him or her in the course of an examination in the Leaving Certificate Examinations conducted by the State Examinations Commission, and

(b) the data subject, whether before or after the making of that request, appeals the result of the examination referred to in paragraph (a),

that request shall be taken to have been made on the date of the first publication of the results of the appeal referred to in paragraph (b).

(4) In this section—

“appeal” means any formal process to enable a candidate to request a recheck of an examination result which is specified by a person who operates the examination;

“examination” means any process for determining the knowledge, intelligence, skill or ability of a person by reference to his or her performance in any test, work or other activity;

“script” means any work produced by a candidate as part of an examination including any examination answer-book (whether in written or digital form), journal, portfolio, audio and visual recording, practical piece or artefact and, for the purposes of this definition, shall be deemed to include—

(a) an audio or visual recording, produced in the course of an examination, of the performance of the candidate in the examination, and

(b) any marks or comments added to the script, or made in relation to the script, by an examiner in the course of his or her marking of the script.

57. (1) Subject to Article 22(4) and to suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject, for the purposes of Article 22(2)(b), the right of a data subject not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her shall, in addition to the grounds identified in Article 22(2)(a) and (c), not apply where—

(a) the decision is authorised or required by or under an enactment, and

(b) either—

(i) the effect of that decision is to grant a request of the data subject, or

(ii) in all other cases (where subparagraph (i) is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to—

(I) make representations to the controller in relation to the decision,

(II) request human intervention in the decision-making process,

(III) request to appeal the decision.

(2) In the case of requests made under subsection (1)(b)(ii)(II) or (III) the controller shall—

(a) comply with the request, and

(b) notify the data subject in writing of—

(i) the steps taken to comply with the request, and

(ii) in the case of an appeal under subsection (1)(b)(ii)(III), the outcome of the appeal.

58. For the purposes of the application of Article 21 in the State, the reference to “direct marketing” includes a reference to direct mailing other than direct mailing carried out—

(a) in the course of electoral activities in the State by—

(i) a political party or its members, or

(ii) a candidate for election to, or a holder of, elective political office in the State,

and

F6[(b) by An Coimisiún Toghcháin in the performance of its functions.]

59. The right of a data subject to object at any time to the processing of personal data concerning him or her under Article 21 shall not apply to processing carried out—

(a) in the course of electoral activities in the State by—

(i) a political party, or

(ii) a candidate for election to, or a holder of, elective political office in the State,

and

F7[(b) by An Coimisiún Toghcháin in the performance of its functions.]

60. (1) The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22—

(a) are restricted to the extent specified in subsection (3), and

(b) may be restricted in regulations made under subsections (5) or (6).

(2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.

(3) Subject to subsection (4), the rights and obligations referred to in subsection (1) are restricted to the extent that—

(a) the restrictions are necessary and proportionate—

(i) to safeguard cabinet confidentiality, parliamentary privilege, national security, defence and the international relations of the State,

(ii) for the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties,

(iii) for the administration of any tax, duty or other money due or owing to the State or a local authority in any case in which the non-application of the restrictions concerned would be likely to prejudice the aforementioned administration,

(iv) in contemplation of or for the establishment, exercise or defence of, a legal claim, prospective legal claim, legal proceedings or prospective legal proceedings whether before a court, statutory tribunal, statutory body or an administrative or out-of-court procedure,

(v) for the enforcement of civil law claims, including matters relating to any liability of a controller or processor in respect of damages, compensation or other liabilities or debts related to the claim, or

(vi) for the purposes of estimating the amount of the liability of a controller on foot of a claim for the payment of a sum of money, whether in respect of damages or compensation, in any case in which the application of those rights or obligations would be likely to prejudice the commercial interests of the controller in relation to the claim,

(b) the personal data relating to the data subject consist of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential to a person who has a legitimate interest in receiving the information, or

(c) the personal data concerned are kept—

(i) by the Commission for the performance of its functions,

(ii) by the Information Commissioner for the performance of his or her functions, or

(iii) by the Comptroller and Auditor General for the performance of his or her functions.

(4) The Minister may prescribe requirements to be complied with when the rights and obligations referred to in subsection (1) are restricted in accordance with subsection (3).

(5) Subject to subsection (9), regulations may be made by a Minister of the Government where he or she considers it necessary for the protection of a data subject or the rights and freedoms of others restricting the rights and obligations referred to in subsection (1)—

(a) (i) if the application of those rights and obligations would be likely to cause serious harm to the physical or mental health of the data subject, and

(ii) to the extent to which, and for as long as, such application would be likely to cause such serious harm,

and

(b) in relation to personal data kept for, or obtained in the course of, the carrying out of social work by a public authority, public body, a voluntary organisation or other body.

(6) Subject to subsection (9), regulations may be made restricting the rights and obligations referred to in subsection (1) where such restrictions are necessary for the purposes of safeguarding important objectives of general public interest and such regulations shall include, where appropriate, specific provisions required by Article 23(2).

(7) Important objectives of general public interest referred to in subsection (6) include:

(a) preventing threats to public security and public safety;

(b) avoiding obstructions to any official or legal inquiry, investigation or process, including any out-of-court redress procedure, proceedings pending or due before a court, tribunal of inquiry or commission of investigation;

(c) preventing, detecting, investigating and prosecuting breaches of discipline by, or the unfitness or incompetence of, persons who are or were authorised by law to carry on a profession or any other regulated activity and the imposition of sanctions for same;

(d) preventing, detecting, investigating or prosecuting breaches of ethics for regulated professions;

(e) taking any action for the purposes of considering and investigating a complaint made to a regulatory body in respect of a person carrying out a profession or other regulated activity where the profession or activity is regulated by that body and the imposition of sanctions on foot of such a complaint;

(f) preventing, detecting, investigating or prosecuting, whether in the State or elsewhere, breaches of the law which are subject to civil or administrative sanctions and enforcing such sanctions;

(g) the identification of assets which are derived from, or are suspected to derive from, criminal conduct and the taking of appropriate action to deprive or deny persons of those assets or the benefits of those assets and any investigation or preparatory work in relation to any related proceedings;

(h) ensuring the effective operation of the immigration system, the system for granting persons international protection in the State and the system for the acquisition by persons of Irish citizenship, including by preventing, detecting and investigating abuses of those systems or breaches of the law relating to those systems;

(i) safeguarding the economic or financial interests of the European Union or the State, including on monetary, budgetary and taxation matters;

(j) safeguarding monetary policy, the smooth operation of payment systems, the resolution of regulated financial service providers (within the meaning of the Central Bank Act 1942), the operation of deposit-guarantee schemes, the protection of consumers and the effective regulation of financial service providers (within the meaning of the Central Bank Act 1942);

(k) protecting members of the public against—

(i) financial loss or detriment due to the dishonesty, malpractice or other improper conduct of, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate or other entities,

(ii) financial loss or detriment due to the conduct of individuals who have been adjudicated bankrupt, or

(iii) financial loss or detriment due to the conduct of individuals who have been involved in the management of a body corporate which has been the subject of a receivership, examinership or liquidation under the Act of 2014;

(l) protecting—

(i) the health, safety, dignity, well-being of individuals at work against risks arising out of or in connection with their employment, and

(ii) members of the public against discrimination or unfair treatment in the provision of goods or services to them;

(m) the keeping of public registers for reasons of general public interest, whether the registers are accessible to the public on a general or restricted basis;

(n) safeguarding the integrity and security of examinations systems;

(o) safeguarding public health, social security, social protection and humanitarian activities.

(8) Where the rights and obligations referred to in subsection (1) are restricted in regulations made under subsection (6) on the basis of important objectives of general public interest of the State, other than the objectives referred to in subsection (7), the important objective or objectives of general public interest shall be identified in those regulations.

(9) Subject to subsection (10), regulations may be made under subsection (5) or (6)—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(10) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (5) or (6).

(11) The Commission may, on being consulted under subsection (10), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(12) Regulations made under this section shall—

(a) respect the essence of the right to data protection and protect the interests of the data subject, and

(b) restrict the exercise of data subjects’ rights only in so far as is necessary and proportionate to the aim sought to be achieved.

61. (1) Subject to subsection (3), where processing of data is for archiving purposes in the public interest, the rights of a data subject set out in Articles 15, 16, 18, 19, 20 and 21 are restricted to the extent that—

(a) the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and

(b) such restriction is necessary for the fulfilment of those purposes.

(2) Subject to subsection (4), where processing of data is for scientific or historical research purposes or statistical purposes, the rights of a data subject set out in Articles 15, 16, 18 and 21 are restricted to the extent that—

(a) the exercise of any of those rights would be likely to render impossible, or seriously impair, the achievement of those purposes, and

(b) such restriction is necessary for the fulfilment of those purposes.

(3) Where data is being processed for purposes referred to in subsection (1) and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection.

(4) Where data is being processed for purposes referred to in subsection (2) and the processing serves another purpose at the same time, that subsection applies only to the extent that the processing relates to the purposes referred to in that subsection.

69. (1) In this Part—

“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual that allow or confirm the unique identification of the individual, including facial images or dactyloscopic data;

“competent authority”, subject to subsection (2), means—

(a) a public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security, or

(b) any other body or entity authorised by law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in the State, including the safeguarding against, and the prevention of, threats to public security;

“controller”, subject to subsection (2), means—

(a) a competent authority that, whether alone or jointly with others, determines the purposes and means of the processing of personal data, or

(b) where the purposes and means of the processing of personal data are determined by the law of the European Union or otherwise by the law of the State, a controller nominated—

(i) by that law, or

(ii) in accordance with criteria specified in that law;

“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services to the individual, that reveal information about the status of his or her health;

“data protection impact assessment” has the meaning assigned to it by section 84(1);

“data protection officer” has the meaning assigned to it by section 88(1);

“data subject” means an individual to whom personal data relate;

“genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual that give unique information about the physiology or the health of the individual and that result, in particular, from an analysis of a biological sample from the individual in question;

“international organisation” means—

(a) an organisation, and subordinate bodies of an organisation, governed by public international law, or

(b) any other body that is established by, or on the basis of, an agreement between two or more states;

“joint controller” has the meaning assigned to it by section 79(1);

“online identifier” includes an internet protocol address, a cookie identifier or other identifier such as a radio frequency identification tag;

“personal data” means information relating to—

(a) an identified living individual, or

(b) a living individual who can be identified from the data, directly or indirectly, in particular by reference to—

(i) an identifier such as a name, an identification number, location data or an online identifier, or

(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual;

“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

“processing”, of or in relation to personal data, means an operation or a set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, including—

(a) the collection, recording, organisation, structuring or storing of the data,

(b) the adaptation or alteration of the data,

(c) the retrieval, consultation or use of the data,

(d) the disclosure of the data by their transmission, dissemination or otherwise making the data available,

(e) the alignment or combination of the data, or

(f) the restriction, erasure or destruction of the data;

“processor” means an individual who, or a legal person, public authority, agency or other body that, processes personal data on behalf of a controller, but does not include an employee of a controller who processes such data in the course of his or her employment;

“profiling” means any form of automated processing of personal data consisting of the use of the data to evaluate certain personal aspects relating to an individual, including to analyse or predict aspects concerning the individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“pseudonymisation” means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that—

(a) such additional information is kept separately from the data, and

(b) is subject to technical and organisational measures to ensure that the data are not attributed to an identified or identifiable individual;

“rectification”, of or in relation to personal data, includes, where the data concerned are incomplete, the completion of the data, whether by means of a supplementary statement or otherwise;

“recipient”, of or in relation to personal data, means an individual to whom, or a legal person, public authority, agency or other body to which, the data are disclosed, and includes a third party;

“relevant filing system” means a set of personal data, whether centralised, decentralised or dispersed on a functional or geographical basis, where the set is structured according to specific criteria in such a way that the data are readily accessible according to those criteria;

“restrict”—

(a) in relation to the exercise of the right of a data subject—

(i) under section 87(1) to be notified of a personal data breach,

(ii) under section 92(10) to be notified of the restriction of the processing of personal data under subsection (9) of that section, or

(iii) under section 92(11) to be notified of a decision not to rectify or erase data pursuant to a request under subsection (1) or (3) of that section, as the case may be,

means—

(I) to delay the notification concerned,

(II) to limit the information contained in the notification concerned, or

(III) not to make the notification concerned,

and

(b) in relation to the exercise of the right of a data subject—

(i) under section 90(1) in so far as relates to the provision to the data subject of information specified in subsection (2)(f) of that section, or

(ii) under section 91(1)(a) or (b),

means—

(I) to delay the provision of the information concerned,

(II) to limit the information concerned provided to the data subject, or

(III) not to provide the information concerned;

“restriction of processing” means the marking, by or on behalf of a controller, of personal data for which the controller is responsible for the purpose of limiting their processing in the future;

“special categories of personal data” means—

(a) personal data revealing—

(i) the racial or ethnic origin of the data subject,

(ii) the political opinions or the religious or philosophical beliefs of the data subject, or

(iii) whether the data subject is a member of a trade union,

(b) genetic data,

(c) biometric data for the purposes of uniquely identifying an individual,

(d) data concerning health, or

(e) personal data concerning an individual’s sex life or sexual orientation.

(2) Where a reference is made in this Part—

(a) to a controller in a Member State other than the State, for the purposes of that reference—

(i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the Member State concerned”, and

(ii) in the definition of “controller” in subsection (1), the reference to “the law of the State” shall be construed as meaning “the law of the Member State concerned”,

or

(b) to a controller in a third country, for the purposes of that reference—

(i) in the definition of “competent authority” in subsection (1), the references to “in the State” shall be construed as meaning “in the state concerned”, and

(ii) in the definition of “controller” in subsection (1), the reference to “the law of the European Union or the law of the State” shall be construed as meaning “the law of the state concerned”.

(3) A word or expression that is used in this Part and is also used in the Directive has, unless the context otherwise requires, the same meaning in this Part as it has in the Directive.

70. (1) This Part applies, subject to subsection (2), to the processing of personal data by or on behalf of a controller where the processing is carried out—

(a) for the purposes of—

(i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security, or

(ii) the execution of criminal penalties,

and

(b) by means that—

(i) are wholly or partly automated, or

(ii) where the personal data form part of, or are intended to form part of, a relevant filing system, are not automated.

(2) This Part shall not apply to the processing of personal data—

(a) that occurs in the course of an activity falling outside the scope of the law of the European Union,

(b) by an institution, body, office or agency of the European Union, or

(c) to which section 8(1)(b) applies.

71. (1) A controller shall, as respects personal data for which it is responsible, comply with the following provisions:

(a) the data shall be processed lawfully and fairly;

(b) the data shall be collected for one or more specified, explicit and legitimate purposes and shall not be processed in a manner that is incompatible with such purposes;

(c) the data shall be adequate, relevant and not excessive in relation to the purposes for which they are processed;

(d) the data shall be accurate, and, where necessary, kept up to date, and every reasonable step shall be taken to ensure that data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

(e) the data shall be kept in a form that permits the identification of a data subject for no longer than is necessary for the purposes for which the data are processed;

(f) the data shall be processed in a manner that ensures appropriate security of the data, including, by the implementation of appropriate technical or organisational measures, protection against—

(i) unauthorised or unlawful processing, and

(ii) accidental loss, destruction or damage.

(2) The processing of personal data shall be lawful where, and to the extent that—

(a) the processing is necessary for the performance of a function of a controller for a purpose specified in section 70(1)(a) and the function has a legal basis in the law of the European Union or the law of the State, or

(b) the data subject has, subject to subsection (3), given his or her consent to the processing.

(3) Where the processing of personal data is to be carried out on the basis of the consent of the data subject referred to in subsection (2)(b), the processing shall be lawful only where, and to the extent that—

(a) having been informed of the intended purpose of the processing and the identity of the controller, the data subject gives his or her consent freely and explicitly,

(b) the request for consent is expressed in clear and plain language, and where such consent is given in the context of a written statement that also concerns other matters, the request for consent is presented to the data subject in a manner that is clearly distinguishable from those other matters, and

(c) the data subject may withdraw his or her consent at any time, and he or she shall be informed of this possibility prior to giving consent.

(4) Where a data subject withdraws his or her consent to the processing of personal data pursuant to subsection (3)(c), the withdrawal of consent shall not affect the lawfulness of processing based on that consent prior to the consent being withdrawn.

(5) Where a controller collects personal data for a purpose specified in section 70(1)(a), the controller or another controller may process the data for a purpose so specified other than the purpose for which the data were collected, in so far as—

(a) the controller is authorised to process such personal data for such a purpose in accordance with the law of the European Union or the law of the State, and

(b) the processing is necessary and proportionate to the purpose for which the data are being processed.

(6) A controller may process personal data, whether the data were collected by the controller or another controller, for—

(a) archiving purposes in the public interest,

(b) scientific or historical research purposes, or

(c) statistical purposes,

provided that the said processing—

(i) is for a purpose specified in section 70(1)(a), and

(ii) is subject to appropriate safeguards for the rights and freedoms of data subjects.

(7) A controller shall ensure, in relation to personal data for which it is responsible, that an appropriate time limit is established for—

(a) the erasure of the data, or

(b) the carrying out of periodic reviews of the need for the retention of the data.

(8) Where a time limit is established in accordance with subsection (7), the controller shall ensure, by means of procedural measures, that the time limit is observed.

(9) A processor, or any person acting under the authority of the controller or of the processor who has access to personal data, shall not process the data unless the processor or person is—

(a) authorised to do so by the controller, or

(b) required to do so by the law of the European Union or the law of the State,

and then only to the extent so authorised or required, as the case may be.

(10) A controller shall ensure that it is in a position to demonstrate that the processing of personal data for which it is responsible is in compliance with subsections (1) to (8) of this section.

72. (1) In determining appropriate technical or organisational measures for the purposes of section 71(1)(f), a controller shall ensure that the measures provide a level of security appropriate to the harm that might result from accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, the data concerned.

(2) A controller or processor shall take all reasonable steps to ensure that—

(a) persons employed by the controller or the processor, as the case may be, and

(b) other persons at the place of work concerned,

are aware of and comply with the relevant technical or organisational measures referred to in subsection (1).

73. (1) The processing of a special category of personal data shall be lawful only where—

(a) section 71 is complied with, and

(b) at least one of the following conditions is met:

(i) where the processing is to be carried out on the basis of the consent of the data subject pursuant to section 71(2)(b), the consent referred to in that paragraph explicitly refers to the special category of personal data concerned;

(ii) the processing is necessary—

(I) to prevent injury or other damage to the data subject or another individual,

(II) to prevent loss in respect of, or damage to, property, or

(III) otherwise to protect the vital interests of the data subject or another individual;

(iii) the personal data to which the processing relates have been made public as a result of steps deliberately taken by the data subject;

(iv) the processing is necessary for—

(I) the administration of justice,

(II) the performance of a function conferred on a person by or under an enactment, or

(III) the performance of a function of the Government or a Minister of the Government;

(v) the processing—

(I) is required for the purposes of providing or obtaining legal advice or for the purposes of, or in connection with, legal claims, prospective legal claims, legal proceedings or prospective legal proceedings, or

(II) is otherwise required for the purposes of establishing, exercising or defending legal rights;

(vi) the processing is necessary for medical purposes and is carried out by, or under the responsibility of—

(I) a health practitioner, or

(II) a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner;

(vii) the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment or social welfare law;

(viii) the processing is carried out pursuant to section 71(6);

(ix) the processing is authorised by regulations made under subsection (2).

(2) Regulations may be made permitting the processing of special categories of personal data for the purposes of subsection (1)(b)(ix) where the processing is necessary for reasons of substantial public interest, and without prejudice to the generality of the foregoing, such regulations shall identify the public interest concerned.

(3) Subject to subsection (4), regulations may be made under subsection (2)—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(4) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (2).

(5) The Commission may, on being consulted under subsection (4), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee (within the meaning of section 19(1)) which that Minister considers appropriate having regard to the subject matter of the regulations.

(6) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (2) shall have regard to the need for the protection of individuals with regard to the processing of their personal data and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(7) Where a special category of personal data is processed in accordance with this section, the controller shall ensure that the processing is carried out with appropriate safeguards for the rights and freedoms of the data subject.

(8) In this section—

“health practitioner” has the same meaning as it has in the Health Identifiers Act 2014;

“medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of medical care and treatment and the management of healthcare services.

74. (1) A controller shall, where relevant and in so far as is possible, make a distinction between the personal data of different categories of data subject.

(2) A controller shall, in so far as is possible, ensure that personal data based on facts are distinguished from personal data based on personal assessments.

(3) A controller shall—

(a) take all reasonable steps to ensure that personal data that are inaccurate, incomplete or no longer up to date are not transmitted or otherwise made available,

(b) verify, in so far as is possible, the quality of personal data before they are transmitted or otherwise made available, and

(c) provide, in so far as is possible, in a transmission of personal data, the information necessary for the recipient to assess the accuracy, completeness and reliability of the data and the extent to which the data are up to date.

(4) Other than where section 92 applies, where a controller becomes aware that incorrect personal data have been transmitted or personal data have been unlawfully transmitted—

(a) the controller shall ensure that the recipient of the personal data is notified without delay of that fact, and

(b) the recipient shall ensure that the personal data are rectified or erased or the processing of the data is restricted, as may be appropriate.

75. (1) A controller shall implement appropriate technical and organisational measures for the purposes of—

(a) ensuring that the processing of personal data for which it is responsible is performed in compliance with this Part, and

(b) demonstrating such compliance.

(2) A controller shall ensure that measures implemented in accordance with subsection (1) are reviewed at regular intervals and, where required, updated.

(3) The measures referred to in subsection (1) shall include the implementation of an appropriate data protection policy by the controller, where such implementation is proportionate in relation to the processing activities carried out by the controller.

76. (1) A controller shall, without prejudice to the generality of section 75(1), for the purposes of meeting the requirements of this Part and protecting the rights of data subjects—

(a) when determining the means of processing personal data, and

(b) when carrying out the said processing,

implement appropriate technical and organisational measures that are designed—

(i) to implement the principles of the protection of personal data contained in this Part in an effective manner, and

(ii) to integrate the necessary safeguards into the said processing.

(2) Without prejudice to the generality of section 75(1) and subsection (1), a controller shall, subject to subsection (3), when processing personal data implement appropriate technical and organisational measures to ensure that only personal data that are necessary for each specific purpose of the processing are processed.

(3) The requirement in subsection (2) applies in relation to—

(a) the amount of personal data collected for the processing concerned,

(b) the extent of the processing of the personal data concerned,

(c) the period for which the personal data concerned are stored, and

(d) the accessibility of the personal data concerned.

(4) Technical and organisational measures implemented in accordance with subsection (2) shall ensure that personal data are not made generally available unless, and only to the extent, authorised by the controller.

77. A controller or processor, prior to carrying out automated processing, shall—

(a) evaluate the risks to the rights and freedoms of individuals arising from the processing concerned, and

(b) implement measures designed to—

(i) deny access to the processing equipment used for the processing to any person other than the persons authorised in that regard by the controller or processor, as the case may be,

(ii) prevent the reading, copying, modification or removal of the data media concerned, other than in so far as is authorised by the controller or processor, as the case may be,

(iii) prevent the input of personal data other than in so far as is authorised by the controller or processor, as the case may be,

(iv) prevent the inspection, modification or deletion of the data other than in so far as is authorised by the controller or processor, as the case may be,

(v) prevent the use of the automated processing system by persons using data communication equipment who are not authorised to do so by the controller or processor, as the case may be,

(vi) ensure that where a person is authorised to use the automated processing system concerned, he or she has access to personal data on the system only in so far as he or she is so authorised by the controller or processor, as the case may be,

(vii) ensure that it is possible to verify or establish the persons to whom personal data have been or may be transmitted or made available using data communication equipment,

(viii) ensure that it is possible to verify or establish which personal data have been input into an automated processing system, and in relation to such data, to verify and establish the person who input the data and when the data were input,

(ix) prevent the reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media, other than in so far as is authorised by the controller or processor, as the case may be,

(x) ensure that an installed automated system may be restored in the event of an interruption in the service of the system,

(xi) ensure that the automated processing system properly performs its function and the appearance of a fault in the automated processing system is reported to the controller or processor, as the case may be, and

(xii) ensure that personal data that are stored on the automated processing system cannot be corrupted by means of a malfunctioning of the system.

78. For the purposes of determining the appropriate technical and organisational measures in relation to personal data that are required to be taken by a controller or processor in order to ensure compliance with this Part, and in particular sections 71(1)(f), 75(1), 76 and 80, the controller or processor, as the case may be, shall, where relevant, have regard to the following matters:

(a) the nature of the personal data concerned;

(b) the accessibility of the data;

(c) the nature, scope, context and purpose of the processing concerned;

(d) any risks to the rights and freedoms of individuals arising from the processing concerned;

(e) the likelihood of any such risks arising and the severity of such risks;

(f) the state of the art and the cost of implementation;

(g) guidelines, recommendations and descriptions of best practice issued by the Commission or the European Data Protection Board.

79. (1) Where 2 or more controllers jointly determine the purposes and means of the processing of personal data (in this Part referred to as “joint controllers”), they shall determine their respective responsibilities for compliance with this Part in a transparent manner by means of an agreement in writing between them, save in so far as the said responsibilities are determined by the law of the European Union or the law of the State.

(2) An agreement in writing referred to in subsection (1)—

(a) shall include a determination of—

(i) the respective responsibilities of the joint controllers concerned as regards the exercise by data subjects of their rights under this Part, and

(ii) the respective duties of the joint controllers concerned as regards the provision to a data subject of the information specified in section 90(2),

and

(b) may designate a single point of contact in respect of the processing concerned for the data subject to whom it relates, where such designation is not otherwise determined by the law of the State.

80. (1) A controller shall engage a processor to carry out processing on its behalf only where—

(a) the processing is carried out, subject to subsection (3), in pursuance of a contract in writing between the controller and the processor that provides for the matters specified in subsection (2), and

(b) the processor provides sufficient guarantees to implement appropriate technical and organisational measures to ensure that—

(i) the processing shall comply with the provisions of this Part, and

(ii) the rights and freedoms of the data subjects are protected.

(2) A contract entered into between a controller and a processor in accordance with subsection (1)(a) shall—

(a) specify the subject matter, duration, nature and purpose of the processing to be carried out thereunder,

(b) specify the type of personal data to be processed thereunder and the categories of data subjects to whom the personal data relate,

(c) specify the obligations and rights of the controller in relation to the processing, and

(d) provide that the processor shall—

(i) act only on instructions from the controller in relation to the processing, except in so far as the law of the European Union or the law of the State requires the processor to act otherwise,

(ii) procure the services of another processor (in this section referred to as a “secondary processor”) in relation to the processing only where authorised to do so in advance and in writing by the controller, which authorisation may be specific or general in nature,

(iii) ensure that any person authorised to process the personal data has undertaken to maintain the confidentiality of the personal data or is under an appropriate statutory obligation to do so,

(iv) assist the controller in ensuring compliance with this Part in so far as it relates to the exercise by a data subject of his or her rights,

(v) erase or return to the controller, at the election of the controller, all personal data upon completion of the processing services carried out by the processor on behalf of the controller and erase any copy of the data, unless the processor is required by the law of the European Union or the law of the State to retain the data, and

(vi) make available to the controller all information necessary to demonstrate compliance by the processor with this section.

(3) Subsection (1)(a) shall not apply in relation to processing where the form of the processing and the role of the controller and the processor concerned are otherwise specified in the law of the European Union or the law of the State.

(4) Where a controller gives an authorisation, whether specific or general in nature, to a processor, including a secondary processor (in this section referred to as “the procuring processor”) to procure the services of a secondary processor, the procuring processor shall inform—

(a) the controller, and

(b) where relevant, any processor who procured the services of the procuring processor in relation to the processing concerned,

in advance of any such procurement or of a change in the terms of such procurement.

(5) Where a procuring processor procures the services of a secondary processor to carry out processing on behalf of a controller, subsections (1) and (2) shall apply to the procuring processor and the secondary processor, subject to the following modifications and any other necessary modifications:

(a) a reference to a “controller”, other than in subparagraphs (ii), (iv), (v) and (vi) of subsection (2)(d), shall be construed as a reference to the procuring processor;

(b) a reference to a “controller” in subsection (2)(d)(iv) shall be construed as a reference to the controller and the procuring processor;

(c) a reference to a “controller” in subsection (2)(d)(v) shall be construed as a reference to the controller or the procuring processor, as appropriate; and

(d) a reference to a “processor” shall be construed as a reference to a secondary processor.

(6) Where a person, who by virtue of the operation of this Part is a processor of personal data, when purporting to act as such a processor, determines the purpose and means of the processing of the data, the obligations that are placed on a controller under this Part shall apply thereafter to the person as though the person were a controller of the data.

81. (1) A controller shall create and maintain a record in writing containing the following information in relation to each category of processing activity for which it is responsible:

(a) the identity and contact details of the controller and, where applicable, the controller’s data protection officer or any joint controller;

(b) a description of—

(i) the purpose of the processing,

(ii) the categories of personal data concerned,

(iii) the categories of data subjects to which the personal data relate,

(iv) the categories of recipients to which the personal data have been or will be disclosed, including recipients in a third country or an international organisation, if any,

(v) the categories of transfer of personal data to a third country or an international organisation, if any,

(vi) the legal basis for the processing operation for which the personal data are intended, including the transfer of the data, where applicable, and

(vii) where possible, the proposed time limit within which each category of personal data shall be erased;

(c) whether the processing involves the use of profiling;

(d) where possible, a general description of the technical and organisational security measures implemented in respect of the processing activity in accordance with section 72(1).

(2) A processor shall create and maintain a record in writing of each category of processing activity carried out by the processor on behalf of a controller containing the following information:

(a) the identity and contact details of—

(i) the processor,

(ii) each controller on behalf of which the processor is carrying out the processing, and

(iii) the processor’s data protection officer, where applicable;

(b) a description of each category of processing carried out on behalf of each controller;

(c) details of any transfer of personal data to a third country or an international organisation, if applicable, including the identification of the third country or international organisation to which the data are transferred;

(d) where possible, a general description of the technical and organisational security measures implemented in respect of the processing activity in accordance with section 72(1).

(3) A controller or processor shall, where requested to do so, make a record created and maintained pursuant to subsection (1) or (2), as the case may be, available to the Commission for inspection and examination.

82. (1) Subject to subsection (5), where a controller or processor carries out processing of personal data by automated means, the controller or processor, as the case may be, shall create and maintain a log (in this section referred to as a “data log”) of the following processing operations carried out in automated processing systems in respect of that processing:

(a) the collection of personal data for the purposes of such processing and the alteration of any such data;

(b) the consultation of the personal data by any person;

(c) the disclosure of the personal data, including the transfer of the data, to any other person;

(d) the combination of the personal data with other data;

(e) the erasure of the personal data, or some of the data.

(2) Where a data log contains information specified in paragraph (b) or (c) of subsection (1), the controller or processor, as the case may be, shall ensure that the data log contains sufficient information to establish the following:

(a) the date and time of the consultation or disclosure, as the case may be;

(b) the reason for the consultation or disclosure, as the case may be;

(c) in so far as is possible, the identification of the person who consulted or disclosed, as the case may be, the personal data;

(d) the identity of any recipient to whom the personal data were disclosed.

(3) A data log shall not be used by any person for any purpose other than—

(a) verifying the lawfulness of the processing,

(b) the monitoring by the controller of processing carried out by the controller,

(c) the monitoring by the processor of processing carried out by the processor,

(d) ensuring the integrity and security of the personal data concerned, or

(e) for the purposes of criminal proceedings.

(4) A controller or processor shall, where requested to do so, make a data log created and maintained by the controller or processor, as the case may be, available to the Commission for inspection and examination.

(5) This section shall not apply, in respect of an automated processing system established on or before 6 May 2016—

(a) prior to 6 May 2023, where compliance by a controller or processor, as the case may be, with this section prior to that date would involve disproportionate effort, or

(b) prior to 6 May 2026, where compliance by a controller or a processor, as the case may be, with this section prior to that date would cause serious difficulties for the operation of the automated processing system to which the data log relates.

(6) A controller or processor who intends to rely upon subsection (5)(b) in respect of an automated processing system operated by the controller or processor, as the case may be, shall notify the Minister in writing of the said intention on or before 31 December 2022.

(7) A notification referred to in subsection (6) shall include a description of the serious difficulties referred to in subsection (5)(b) in respect of the automated processing system concerned.

83. A controller or a processor shall, on request by the Commission, cooperate with and assist the Commission in the performance of its functions under this Part.

84. (1) Where having regard to its nature, scope, context and purposes, a type of processing, and in particular a type of processing using new technology, is likely to result in a high risk to the rights and freedoms of individuals, the controller that is proposing to carry out the processing shall conduct an assessment of the likely impact of the proposed processing operations on the protection of personal data (in this Part referred to as a “data protection impact assessment”) prior to carrying out the processing.

(2) A data protection impact assessment carried out in accordance with subsection (1) shall include:

(a) a general description of the proposed processing operations to which it relates;

(b) an assessment of the potential risks to the rights and freedoms of data subjects as a result of the proposed processing; and

(c) a description of any safeguards, security measures or mechanisms proposed to be implemented by the controller to mitigate any risk referred to in paragraph (b) and to ensure the protection of the personal data in compliance with this Part.

(3) Where—

(a) it appears to a controller, having conducted a data protection impact assessment, that the processing concerned would, despite the implementation of safeguards, security measures or mechanisms referred to in subsection (2)(c), result in a high risk to the rights and freedoms of individuals, or

(b) the controller proposes to carry out processing of a type prescribed by the Commission under subsection (9),

the controller shall, prior to commencing the processing, consult the Commission by request in that regard in writing.

(4) A controller shall, when making a request under subsection (3), provide the Commission with—

(a) the data protection impact assessment conducted in relation to the processing concerned, and

(b) any other information required by the Commission to enable it to assess—

(i) the potential risks to the rights and freedoms of individuals arising from the proposed processing, and

(ii) the compliance of the proposed processing with this Part.

(5) The Commission shall, where it is of the view that the proposed processing would not comply with this Part, in particular where it is of the view that the controller has insufficiently identified or mitigated the potential risks to the rights and freedoms of individuals arising from the proposed processing, issue written advice in relation to the processing to the controller and, where applicable, any proposed processor.

(6) Subject to subsection (8), where the Commission issues written advice pursuant to subsection (5), it shall do so within a period of 6 weeks from the date on which it receives the request under subsection (3).

(7) For the purposes of responding to a request under subsection (3), the Commission may use any of its powers referred to in Chapter 4 of Part 6.

(8) Where, taking into account the complexity of the proposed processing, the Commission is of the opinion that it requires additional time to consider a request made under subsection (3), it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (6) by such further period not exceeding one month as it may specify by notice in writing to the controller concerned.

(9) The Commission may, following consultation with the Minister, make regulations prescribing a type of processing for the purposes of subsection (3)(b) as a type of processing in relation to which a controller shall consult the Commission prior to commencing the processing.

(10) The Commission shall, when prescribing a type of processing under subsection (9), have regard to—

(a) the nature, scope and purposes of the type of processing,

(b) the type of processing involved, in particular where the use of new technology is likely to result in a high risk to the rights and freedoms of individuals,

(c) the likelihood of any such risks arising and the severity of such risks, and

(d) any submissions received pursuant to subsection (11)(c) in relation to the proposed regulations.

(11) The Commission shall, prior to making regulations under subsection (9), publish a notice on the website of the Commission and in at least one daily newspaper circulating generally in the State—

(a) indicating that it proposes to make regulations under this section,

(b) indicating that a draft of the regulations is available for inspection on that website for a period specified in the notice, being not less than 28 days from the date of the publication of the notice in the newspaper, and

(c) stating that submissions in relation to the draft regulations may be made in writing to the Commission before a date specified in the notice, which shall be not less than 28 days after the end of the period referred to in paragraph (b).

(12) Where there is a proposal for a legislative measure for which a Minister of the Government is responsible that relates to the processing of personal data, the relevant Minister shall consult with the Commission during the process of the preparation of the legislative measure.

85. Where a processor becomes aware of a personal data breach, the processor shall notify the controller on whose behalf the data are being processed of the breach—

(a) in writing, and

(b) without undue delay.

86. (1) Subject to subsection (3), where a personal data breach occurs, the controller shall, without undue delay and where feasible within 72 hours of becoming aware of the breach, notify the Commission of the breach.

(2) Where a controller does not notify the Commission under subsection (1) of a personal data breach within 72 hours of becoming aware of the breach, the controller shall include in the notification the reason for not so notifying.

(3) Subsection (1) shall not apply where, taking into account the nature of the personal data and the scope, context and purposes of the processing, the personal data breach is unlikely to result in a risk to the rights and freedoms of data subjects.

(4) A notification under subsection (1) shall include—

(a) a description of the personal data breach, including, where possible the categories and number, or approximate number, of—

(i) data subjects concerned, and

(ii) personal data records concerned,

(b) a description of the likely consequences of the personal data breach,

(c) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including any measures taken or proposed to be taken to mitigate its possible adverse effects, and

(d) the name and contact details of the controller’s data protection officer (if any) or other point of contact.

(5) Where, at the time of the making of a notification under subsection (1), it is not possible for a controller to include in the notification all the information specified in subsection (4) in relation to the personal data breach concerned, the controller shall—

(a) nevertheless make the notification including such information as is possible to include at that time, and

(b) supply the Commission with such information specified in subsection (4) as is outstanding without undue delay.

(6) A controller shall create and maintain a detailed record in writing of a personal data breach, including a description of—

(a) the breach,

(b) the effects of the breach, and

(c) the measures taken to address the breach, including any measures taken to mitigate its possible adverse effects.

(7) A controller shall, where so requested by the Commission, provide a copy of a record created and maintained under subsection (6) to the Commission.

(8) Where a personal data breach involves personal data that have been transmitted—

(a) by a controller in the State to a controller in another Member State, or

(b) by a controller in another Member State to a controller in the State,

the controller in the State shall provide the controller in the other Member State with the information specified in subsection (4) without undue delay.

87. (1) Subject to subsections (2), (4) and (7), where a personal data breach occurs that is likely to result in a high risk to the rights and freedoms of a data subject, the controller shall, without undue delay, notify the data subject to whom the breach relates.

(2) Subsection (1) shall not apply where—

(a) the controller has implemented appropriate technological and organisational protection measures that were applied to the personal data affected by the personal data breach, in particular where the said measures, including encryption, render the personal data unintelligible to any person who is not authorised to access it, or

(b) the controller has taken measures in response to the personal data breach that ensure that the high risk to the rights and freedoms of a data subject from the breach is no longer likely to materialise.

(3) A notification under subsection (1) shall—

(a) describe, in clear and plain language, the nature of the personal data breach concerned, and

(b) contain at least the information specified in paragraphs (b) to (d) of section 86(4).

(4) Where a notification under subsection (1) would involve a disproportionate effort, the controller shall notify the data subjects concerned of the personal data breach by way of public communication or other similar measure that ensures the data subjects are informed of the personal data breach in an equally effective manner.

(5) A notification under subsection (4) shall—

(a) describe, in clear and plain language, the nature of the personal data breach concerned, and

(b) contain such other information as is appropriate in all the circumstances.

(6) Where—

(a) a controller notifies the Commission under section 86 of a personal data breach, and

(b) the controller has not notified the data subject to whom the personal data relate under subsection (1) or (4), as the case may be, of the personal data breach,

the Commission may, having considered the likelihood of the data breach resulting in a high risk to the rights and freedoms of a data subject—

(i) require the controller to notify the data subject under subsection (1) or (4), as the case may be, or

(ii) determine that subsection (2) applies in relation to the personal data breach.

(7) A controller may, in relation to the exercise of the right of a data subject to be notified under subsection (1) of a personal data breach, restrict the exercise of the said right where to do so constitutes a necessary and proportionate measure in a democratic society, with due regard for the fundamental rights and legitimate interests of the data subject, for a purpose specified in section 94(2).

(8) Where a controller restricts the exercise of the right of a data subject under subsection (7), subsections (5), (6) and (7) of section 94 shall apply in respect of the said restriction, with all necessary modifications.

88. (1) A controller, other than—

(a) a court, or

(b) another independent judicial authority,

acting in its judicial capacity, shall, subject to subsections (2) and (3), appoint a person to carry out the functions specified in subsection (5) in respect of the controller (in this Part referred to as a “data protection officer”).

(2) Two or more controllers may, subject to subsection (3), having regard to their organisational structure and size, appoint a single data protection officer to carry out the functions specified in subsection (5) in respect of each of the controllers.

(3) A controller, when appointing a data protection officer, shall do so on the basis of—

(a) the person’s expert knowledge of the law and the practice relating to the protection of personal data, and

(b) his or her ability to carry out the functions specified in subsection (5).

(4) Where a controller appoints a data protection officer, the controller shall—

(a) publish or cause to be published the contact details of the data protection officer,

(b) inform the Commission of the appointment of the data protection officer and provide the Commission with his or her contact details,

(c) ensure that the data protection officer—

(i) reports directly, in relation to his or her functions under subsection (5), to the highest level of management of the controller,

(ii) does not receive any instructions regarding the exercise of such functions, and

(iii) is involved in an appropriate and timely manner in all matters relating to the protection of personal data, and

(d) support the data protection officer in performing his or her functions under subsection (5), including by—

(i) providing him or her with the resources that he or she requires to perform those functions,

(ii) ensuring that he or she has access to processing operations carried out by the controller, and

(iii) assisting him or her to maintain his or her expert knowledge in the law and practice relating to the protection of personal data.

(5) The functions of a data protection officer shall include the following:

(a) informing and advising the controller, and the employees of the controller who carry out processing, of their obligations under this Part and under any other law of the European Union or law of the State that relates to the protection of personal data;

(b) monitoring the compliance of the controller with—

(i) this Part,

(ii) any other law of the European Union or law of the State that relates to the protection of personal data, and

(iii) the policies of the controller in relation to the protection of personal data, including the assignment of responsibilities in the controller in relation to the protection of personal data, the raising of awareness and the training of staff involved in processing operations in that regard, and any audit activity related to the protection of personal data;

(c) providing advice, where requested to do so, in relation to the carrying out of a data protection impact assessment in accordance with section 84 and monitoring any steps taken on foot of that assessment;

(d) acting as the contact point for data subjects with regard to all issues related to the processing of their personal data and to the exercise of their rights under this Part;

(e) cooperating with the Commission and acting as a contact point for the Commission for issues related to processing carried out by the controller, including consultation by the controller with the Commission under section 84.

89. (1) Subject to subsection (2), a decision that produces an adverse legal effect for a data subject or significantly affects a data subject shall not be based solely on automated processing, including profiling, of personal data that relate to him or her.

(2) Subsection (1) shall not apply where—

(a) the taking of a decision based solely on automated processing is authorised by the law of the European Union or the law of the State and the law so authorising contains appropriate safeguards for the rights and freedoms of the data subject, including the right of the data subject to make representations to the controller in relation to the decision, and

(b) the controller has taken adequate steps to safeguard the legitimate interests of the data subject.

(3) Profiling that results in discrimination against an individual on the basis of a special category of personal data shall be prohibited.

90. (1) Subject to subsection (4) and section 94, a controller shall ensure that the data subject is provided with, or, as appropriate, has made available to him or her, the information specified in subsection (2) in relation to personal data relating to him or her within a reasonable period after the date on which the controller obtains the personal data concerned, having regard to the circumstances in which the data are or are to be processed.

(2) The information to which subsection (1) applies is:

(a) the identity and the contact details of the controller;

(b) the contact details of the data protection officer of the controller, where applicable;

(c) the purpose for which the personal data are intended to be processed or are being processed;

(d) information detailing the right of the data subject to request from the controller access to, and the rectification or erasure of, the personal data;

(e) information detailing the right of the data subject to lodge a complaint with the Commission and the contact details of the Commission;

(f) in individual cases where further information is necessary to enable the data subject to exercise his or her rights under this Part, having regard to the circumstances in which the personal data are or are to be processed, including the manner in which the data are or have been collected, any such information including:

(i) the legal basis for the processing of the data concerned, including the legal basis for any transfers of data;

(ii) the period for which the data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine the said period;

(iii) where applicable, each category of recipients of the data.

(3) The information referred to in paragraphs (a) to (e) of subsection (2) may be made available to the data subject by means of publication on the website of the controller.

(4) Without prejudice to section 94, subsection (1) shall not apply to information specified in subsection (2)—

(a) where the information is already in the possession of the data subject, or

(b) where, in particular in the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the provision of the information proves impossible or would involve a disproportionate effort.

91. (1) Subject to subsections (7), (9) and (12) and sections 93(4)(ii) and 94, an individual who believes that personal data relating to him or her have been or are being processed by or on behalf of a controller, if he or she so requests the controller by notice in writing shall—

(a) be informed by the controller whether personal data relating to him or her have been or are being processed by or on behalf of the controller, and

(b) where such data have been or are being so processed, be provided by the controller with the following information:

(i) a description of—

(I) the purpose of, and the legal basis for, the processing,

(II) the categories of personal data concerned,

(III) the recipients or categories of recipients to whom the personal data concerned have been disclosed, and

(IV) the period for which the personal data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine the said period;

(ii) information detailing the right of the data subject to request from the controller the rectification or erasure of the personal data concerned;

(iii) information detailing the right of the data subject to lodge a complaint with the Commission and the contact details of the Commission;

(iv) a communication of the personal data concerned;

(v) any available information as to the origin of the personal data concerned, unless the communication of that information is contrary to the public interest.

(2) A controller shall respond to a request made under subsection (1) and provide the information specified in paragraph (b) thereof to the data subject as soon as may be and, subject to subsections (4) and (5), in any event not later than one month after the date on which the request is made.

(3) When making a request under subsection (1), the individual making the request shall provide the controller with such information as the controller may reasonably require to satisfy itself of the identity of the individual and to locate any relevant personal data or information.

(4) Where a controller has reasonable doubts as to the identity of an individual making a request under subsection (1) or reasonably requires additional information to locate any relevant personal data, it may request such additional information from the data subject as may be necessary to confirm his or her identity or to enable it to locate such personal data or information, as the case may be, and the period of time from the making of such a request for additional information until the request is complied with shall not be reckonable for the purposes of subsection (2).

(5) Where, taking into account the complexity of a request made under subsection (1) and the number of such requests received by the controller, the controller is of the opinion that it requires additional time to consider the request, it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (2) by such further period not exceeding 2 months as it may specify by notice in writing to the individual making the request.

(6) A notice in writing referred to in subsection (5) shall include the reason for which the controller is of the opinion that it requires additional time to consider the request made under subsection (1).

(7) Where information that a controller would otherwise be required to provide to a data subject pursuant to subsection (1) includes personal data relating to another individual that would reveal, or would be capable of revealing, the identity of the individual, the controller—

(a) shall not, subject to subsection (8), provide the data subject with the information that constitutes such personal data relating to the other individual, and

(b) shall provide the data subject with a summary of the personal data concerned that—

(i) in so far as is possible, permits the data subject to exercise his or her rights under this Part, and

(ii) does not reveal, or is not capable of revealing, the identity of the other individual.

(8) Subsection (7) shall not apply where the individual to whom the personal data that would reveal, or would be capable of revealing, his or her identity, relate consents to the provision of the information concerned to the data subject making a request pursuant to subsection (1).

(9) Subsection (1) shall not apply—

(a) in respect of personal data relating to the data subject that consists of an expression of opinion about the data subject by another person given in confidence or on the understanding that it would be treated as confidential, or

(b) to information specified in paragraph (b)(i)(III) of that subsection in so far as a recipient referred to therein is a public authority which may receive data in the context of a particular inquiry in accordance with the law of the State.

(10) Information provided pursuant to a request under subsection (1) may take account of any amendment of the personal data concerned made since the receipt of the request by the controller (being an amendment that would have been made irrespective of the receipt of the request) but not of any other amendment.

(11) The obligations imposed by subparagraphs (iv) and (v) of subsection (1)(b) shall be complied with by supplying the data subject with a copy of the information concerned in permanent form unless—

(a) the supply of such a copy is not possible or would involve disproportionate effort, or

(b) the data subject agrees otherwise.

(12) Where a controller has previously complied with a request under subsection (1), the controller is not obliged to comply with a subsequent identical or similar request under that subsection by the same individual unless, in the opinion of the controller, a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

(13) In determining for the purposes of subsection (12) whether the reasonable interval specified in that subsection has elapsed, regard shall be had to the nature of the personal data, the purpose for which the personal data are processed and the frequency with which the personal data are altered.

(14) Where a controller, pursuant to subsection (12) refuses to act upon a request under subsection (1), it shall, as soon as practicable, so notify the data subject in writing.

92. (1) Where a data subject is of the opinion that a controller is processing personal data relating to him or her that are inaccurate, the data subject may make a request in writing to the controller for the controller to rectify the data concerned.

(2) A controller that receives a request under subsection (1) shall, subject to subsections (6), (7) and (9) and section 93(4)(ii), where it is satisfied that the personal data to which the request relates are inaccurate, rectify the data as soon as may be and in any event no later than one month after the date on which the request is made.

(3) Where a data subject is of the opinion that a controller is processing personal data relating to him or her—

(a) in a manner that contravenes subsections (1) to (6) of section 71 or section 73(1), or

(b) that are required to be erased by the controller in accordance with a legal obligation to which the controller is subject,

the data subject may make a request in writing to the controller to erase the data concerned.

(4) A controller that receives a request under subsection (3) shall, subject to subsections (6), (7) and (9) and section 93(4)(ii), where it is satisfied that paragraph (a) or (b) of subsection (3) applies to the personal data to which the request relates, erase the data as soon as may be and in any event no later than one month after the date on which the request is made.

(5) When making a request under subsection (1) or (3), the data subject shall provide such information as the controller may reasonably require to—

(a) satisfy itself as to the identity of the data subject,

(b) locate any relevant personal data, and

(c) satisfy itself as to whether the personal data concerned are inaccurate or as to the basis on which the data should be erased, as the case may be.

(6) Where a controller—

(a) has reasonable doubts as to the identity of an individual making a request under subsection (1) or (3), or

(b) reasonably requires additional information—

(i) to locate any relevant personal data, or

(ii) to satisfy itself as to whether the personal data concerned are inaccurate or as to the basis on which the data should be erased, as the case may be,

it may request such additional information from the data subject as may be necessary to confirm his or her identity or to so locate or satisfy itself, as the case may be, and the period of time from the making of such a request for additional information until the request is complied with shall not be reckonable for the purposes of subsection (2) or (4), as the case may be.

(7) Where, taking into account the complexity of a request made under subsection (1) or (3) and the number of such requests received by the controller, the controller is of the opinion that it requires additional time to consider the request, it may, once only and within one month from the date of the receipt of the request, extend the time period referred to in subsection (2) or (4), as the case may be, by such further period not exceeding 2 months as it may specify by notice in writing to the data subject making the request.

(8) A notice in writing referred to in subsection (7) shall include the reason for which the controller is of the opinion that it requires additional time to consider the request made under subsection (1) or (3), as the case may be.

(9) Where a data subject makes a request under subsection (1) or (3), and—

(a) the accuracy of the data is contested by the data subject and it is not possible to ascertain whether the data are so inaccurate, or

(b) the personal data are required for the purposes of evidence in proceedings before a court or tribunal or in another form of official inquiry,

the controller shall restrict the processing of the data and shall not rectify or erase the data, as the case may be.

(10) Where a controller—

(a) complies with a request under subsection (1) or (3), or

(b) restricts the processing of personal data under subsection (9),

the controller shall, as soon as practicable, notify in writing—

(i) subject to section 94, the data subject concerned,

(ii) each controller from which the personal data concerned were received, and

(iii) each person to whom the personal data concerned were disclosed,

of the rectification, erasure or restriction concerned, as the case may be.

(11) Where a controller receives a request under subsection (1) or (3), and—

(a) the controller is not satisfied that, as the case may be,—

(i) in relation to a request under subsection (1), the personal data to which the request relates should be rectified pursuant to subsection (2), or

(ii) in relation to a request under subsection (3), the personal data to which the request relates should be erased pursuant to subsection (4),

and

(b) subsection (9) does not apply to the data,

the controller shall, subject to section 94, as soon as practicable, so notify the data subject in writing.

(12) A notification under subsection (11) shall include—

(a) the reasons for the controller’s decision under that subsection, and

(b) information relating to the data subject’s right under section 95 to request the Commission to verify the lawfulness of the processing concerned.

(13) Where a person to whom personal data were disclosed is notified under subsection (10) of—

(a) the rectification or erasure of the data pursuant to a request under subsection (1) or (3), as the case may be, or

(b) the restriction of the processing of the data under subsection (9),

the person shall rectify or erase, or restrict the processing of, as the case may be, any of the data concerned that the person has under his or her control in the same manner, and to the same extent, as the controller making the notification has rectified or erased, or restricted the processing of, as the case may be, the data concerned.

(14) Where a controller has restricted the processing of personal data pursuant to subsection (9) and proposes to lift the said restriction, the controller shall inform the data subject prior to the lifting of the restriction.

(15) Where a controller that restricted the processing of personal data pursuant to subsection (9) lifts the said restriction—

(a) the controller shall notify any person who was notified under subsection (10) of the said restriction of the lifting of the restriction as soon as practicable, and

(b) the person so notified shall lift any restriction of the processing of the data concerned implemented under subsection (13) in the same manner, and to the same extent, as the controller making the notification has lifted the restriction on the processing of the data concerned.

(16) This section shall not apply to personal data that are contained in witness statements.

(17) For the purposes of this section, personal data are inaccurate if—

(a) they are incorrect or misleading as to any matter of fact, or

(b) they are incomplete in a material manner.

93. (1) Where a controller—

(a) provides or makes available information to a data subject under section 90,

(b) provides or makes available information to, or communicates with, a data subject pursuant to a request under section 91 or 92,

the controller shall take all reasonable steps to ensure the information is provided or made available, or the communication is made, as the case may be, in a concise, intelligible and easily accessible form using clear and plain language.

(2) The information or communication, as the case may be, referred to in subsection (1), shall—

(a) be provided to the data subject by appropriate means, including by electronic means, and

(b) in the case of a communication with a data subject pursuant to a request under section 91 or 92, in so far as is possible, be provided in the same form as that in which the request is made.

(3) A controller shall not impose a charge on a data subject for information provided to him or her under section 90 or, subject to subsection (4)(i), pursuant to a request under section 91 or 92.

(4) Where a data subject makes a request to a controller under section 91 or 92 that is—

(a) manifestly unfounded, or

(b) excessive in nature, having regard to the number of requests made by the data subject to the controller under those sections,

the controller may—

(i) charge a reasonable fee to the data subject in respect of the request, having regard to the administrative cost to the controller of complying with the request, or

(ii) refuse to act upon the request.

(5) Where a controller, pursuant to subsection (4)(ii), refuses to act upon a request under section 91 or 92 it shall, as soon as practicable, so notify the data subject in writing.

(6) A notification under subsection (5) shall include—

(a) the reasons for which the controller is refusing to act upon the request under section 91 or 92, as the case may be, pursuant to subsection (4)(ii), and

(b) information relating to the right of the data subject under Chapter 3 of Part 6 to lodge a complaint with the Commission and the contact details of the Commission.

(7) Where, pursuant to subsection (4)(ii), a controller refuses to act upon a request made to the controller by a data subject under section 91 or 92, it shall be for the controller to demonstrate that the request was manifestly unfounded or excessive in nature.

(8) In this section, a reference to a “data subject” shall be construed as including an individual who makes a request under section 91(1), irrespective of whether the controller is processing personal data relating to the individual.

94. (1) Subject to subsection (2), a controller, with respect to personal data for which it is responsible, may restrict, wholly or partly, the exercise of a right of a data subject specified in subsection (4).

(2) Subsection (1) shall apply where the controller is satisfied that restricting the exercise of a right under that subsection constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the data subject for the purposes of—

(a) avoiding obstructing official or legal inquiries, investigations or procedures,

(b) avoiding prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties,

(c) protecting public security,

(d) protecting national security, or

(e) protecting the rights and freedoms of other persons.

(3) Without prejudice to the generality of subsection (2), the purposes specified in paragraphs (a) to (e) of subsection (2) include the following:

(a) the prevention, detection or investigation of offences, the apprehension or prosecution of offenders or the effectiveness of lawful methods, systems, plans or procedures employed for the purposes of the matters aforesaid;

(b) the enforcement of, compliance with or administration of any enactment related to a purpose specified in section 70(1)(a);

(c) ensuring the safety of the public and the safety or security of individuals and property;

(d) ensuring the fairness of criminal proceedings in a court or other tribunal;

(e) ensuring the security of—

(i) a penal institution,

(ii) a children detention school within the meaning of section 3 of the Children Act 2001,

(iii) a remand centre designated under section 88 of the Children Act 2001,

(iv) the Central Mental Hospital, or

(v) any system of communications, whether internal or external, of the Garda Síochána, the Defence Forces, the Revenue Commissioners or a penal institution;

(f) protecting the life, safety or well-being of any person;

(g) preventing the facilitation of the commission of an offence;

(h) avoiding the prejudice or impairment of national security, defence or the international relations of the State;

(i) avoiding the obstruction or impairment of official or legal inquiries, investigations or procedures or the operation of legal privilege;

(j) the performance by the Commission of its functions.

(4) The rights of a data subject to which subsection (1) applies are:

(a) the right of the data subject under section 90(1) in so far as relates to information specified in subsection (2)(f) of that section;

(b) the rights of the data subject under paragraphs (a) and (b) of section 91(1);

(c) the right of the data subject to be notified—

(i) under section 92(10) of the restriction of the processing of personal data under subsection (9) of that section, or

(ii) under section 92(11) of a decision not to rectify or erase data pursuant to a request under subsection (1) or (3) of that section, as the case may be.

(5) Subject to subsection (6), where a controller restricts, pursuant to subsection (1), the exercise of the right of a data subject specified in paragraph (b) or (c) of subsection (4), the controller shall notify the data subject in writing of—

(a) the restriction of the exercise of the said right and the reasons for such restriction, and

(b) the right of the data subject—

(i) under section 95 to request the Commission to verify the lawfulness of the processing concerned, or

(ii) under section 128 to seek a judicial remedy in relation to the said restriction.

(6) Subsection (5) shall not apply where to notify the data subject in accordance with that subsection of the matters specified therein would be contrary to a purpose specified in subsection (2).

(7) Where a controller restricts, pursuant to subsection (1), the exercise of the right of a data subject specified in paragraph (b) or (c) of subsection (4), the controller shall—

(a) create and maintain a record in writing of the factual or legal basis for the decision to so restrict the right concerned, and

(b) make such a record available to the Commission, if so requested by the Commission.

(8) Regulations may be made specifying a category of processing to be a category of processing in respect of which the exercise of the rights specified in subsection (4) may, in accordance with subsection (2), be restricted under subsection (1).

(9) Regulations under subsection (8) may be made by—

(a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

(b) any other Minister of the Government, following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(10) The Minister of the Government making regulations under subsection (8) shall have regard to—

(a) the nature, scope and purposes of the category of processing concerned,

(b) whether, having regard to the matters referred to in paragraph (a), the restriction concerned is one to which subsection (2) would apply, and

(c) any risks arising for the rights and freedoms of data subjects.

(11) Regulations made under this section shall—

(a) respect the essence of the right to data protection and protect the interests of the data subject, and

(b) restrict the exercise of data subject rights only in so far as is necessary and proportionate to the aim sought to be achieved.

(12) For the purposes of this section, “penal institution” means—

(a) a place to which the Prisons Acts 1826 to 2015 apply, or

(b) a military prison or detention barrack within the meaning, in each case, of the Defence Act 1954.

95. (1) Where an individual—

(a) is aware, having been notified under section 94(5), that the exercise of his or her rights have been restricted by a controller pursuant to section 94, or

(b) believes that the exercise of his or her rights have been so restricted and that he or she has not been notified of the said restriction by virtue of the operation of subsection (6) of that section,

the individual may make a request in writing to the Commission to verify whether the controller is processing personal data relating to him or her and if so, whether the processing is in compliance with this Part.

(2) Where the Commission receives a request under subsection (1), it may take such steps as appear to it to be appropriate, including the exercise of its powers under section 132.

(3) The Commission, having taken the steps referred to in subsection (2), shall inform the individual making the request under subsection (1)—

(a) that all necessary verifications or reviews have been carried out by the Commission, and

(b) of his or her right to seek a judicial remedy under section 128.

(4) Nothing in this section shall require the Commission to disclose to a data subject whether or not a controller has processed, or is processing, personal data relating to him or her.

96. (1) The transfer of personal data to a third country or an international organisation shall not take place, subject to section 100, unless—

(a) the transfer is necessary for a purpose specified in section 70(1)(a),

(b) the personal data are to be transferred to a controller in a third country or an international organisation that is an authority competent for the purposes specified in section 70(1)(a),

(c) where the personal data were transmitted or made available to the controller making the transfer from a controller in another Member State, subject to subsection (2), the controller in the other Member State or another relevant controller in that state has given its prior authorisation to the transfer,

(d) section 97, 98 or 99 applies, and

(e) the transfer is subject to a condition that a subsequent transfer to another third country or international organisation from the third country or international organisation to which the data are being transferred by the controller shall only occur where the controller authorises the subsequent transfer, having taken into due account all relevant factors, including—

(i) the seriousness of any criminal offence to which the data relate,

(ii) the purpose for which the data were originally transferred, and

(iii) the level of protection for personal data in the third country or the international organisation to which the data are to be transferred onwards.

(2) Subsection (1)(c) shall not apply where—

(a) the transfer of the personal data concerned is necessary for the prevention of an immediate and serious threat to—

(i) public security in a Member State or a third country, or

(ii) the essential interests of a Member State,

and

(b) an authorisation under the said subsection (1)(c) cannot be obtained in good time.

(3) Where subsection (2) applies and personal data are transferred to a third country or an international organisation without an authorisation from the controller in the other Member State that transmitted or made available the personal data, the controller making the transfer, or on whose behalf the transfer is being made, shall inform the controller in the other Member State of the transfer without delay.

(4) Without prejudice to the generality of section 71, a processor shall not transfer personal data to a third country or an international organisation, or to a recipient in a third country, under this Chapter unless explicitly instructed in writing to do so by the controller.

97. (1) Personal data may be transferred in accordance with section 96(1), subject to subsection (2), to a third country or an international organisation where a decision has been taken by the European Commission under Article 36 of the Directive that the third country or the international organisation, as the case may be, ensures an adequate level of protection of personal data.

(2) Where the European Commission has taken a decision under Article 36 of the Directive that applies to a specified territory within a third country or a specified sector in a third country, personal data may be transferred under subsection (1) to a controller in the specified territory or sector only, as the case may be.

98. (1) Personal data may be transferred in accordance with section 96(1) to a third country, a territory or sector thereof, or an international organisation, in respect of which a decision has not been taken by the European Commission under Article 36 of the Directive that the third country, territory or sector thereof, or the international organisation, as the case may be, ensures an adequate level of protection of personal data, where—

(a) there is a legally binding instrument that applies to the transfer and that ensures appropriate safeguards with regard to the processing of personal data, or

(b) the controller transferring the personal data, or on whose behalf the personal data are being transferred, has—

(i) assessed all the circumstances relating to the transfer, and

(ii) is satisfied that appropriate safeguards exist with regard to the protection of the personal data.

(2) Where personal data are transferred to a third country, a territory or sector thereof, or an international organisation pursuant to subsection (1)(b), the controller transferring the personal data, or on whose behalf the personal data are being transferred, shall—

(a) inform the Commission about each category of such transfers, and

(b) create and maintain a record in writing of each such transfer containing at least the following:

(i) details of the personal data transferred;

(ii) the date and time of the transfer;

(iii) information about the controller in the third country or the international organisation to which the data were transferred;

(iv) the reasons for the transfer.

(3) A controller shall make available a record created and maintained pursuant to subsection (2)(b) to the Commission for inspection upon a request in that regard by the Commission.

99. (1) Where section 97 or 98 does not apply in relation to a transfer of personal data to a third country or an international organisation, personal data may be transferred in accordance with section 96(1) to the third country or the international organisation, where the transfer is necessary—

(a) to protect the vital interests of the data subject or another individual,

(b) to safeguard the legitimate interests of a data subject,

(c) for the prevention of an immediate and serious threat to public security in a Member State or a third country,

(d) subject to subsection (2), in an individual case, for a purpose specified in section 70(1)(a), or

(e) subject to subsection (2), in an individual case, for the establishment, exercise or defence of legal claims relating to a purpose specified in section 70(1)(a).

(2) Paragraphs (d) and (e) of subsection (1) shall not apply where the controller transferring the personal data, or on whose behalf the personal data are being transferred, is of the opinion that the rights and freedoms of the data subject override the public interest in the transfer concerned.

(3) Where personal data are transferred to a third country or an international organisation pursuant to subsection (1), the controller transferring the personal data, or on whose behalf the personal data are being transferred, shall create and maintain a record in writing of each such transfer containing at least the following:

(a) details of the personal data transferred;

(b) the date and the time of the transfer;

(c) information about the controller in the third country or the international organisation to which the data were transferred;

(d) the reasons for the transfer.

(4) A controller shall make available a record created and maintained pursuant to subsection (3) to the Commission for inspection upon a request in that regard by the Commission.

100. (1) Notwithstanding section 96(1)(b) and the provisions of any relevant international agreement, a controller may, in an individual case, transfer personal data directly to a recipient located in a third country who is not a controller or organisation referred to in section 96(1)(b) where the relevant provisions of this Part are complied with and each of the following conditions are fulfilled—

(a) the transfer is necessary for the performance of a function of the controller making the transfer under the law of the European Union or the law of the State for a purpose specified in section 70(1)(a);

(b) the transfer is in the public interest;

(c) the controller is satisfied that the fundamental rights and freedoms of the data subject do not override the public interest necessitating the transfer in the particular instance;

(d) the controller is satisfied that the transfer of the data to an authority in the third country that is competent for the purposes specified in section 70(1)(a) would be ineffective or inappropriate, having regard to the purpose for which the data are being transferred, in particular where the transfer could not be made to such an authority in time to achieve the purpose of the transfer.

(2) A controller, when transferring personal data to a recipient pursuant to subsection (1) shall—

(a) specify to the recipient the purpose for which the recipient may process the data, and

(b) inform the recipient that the data are to be processed by the recipient for the specified purpose only and then only to the extent that such processing is necessary for that purpose.

(3) Where a controller transfers personal data to a recipient pursuant to subsection (1), the controller shall—

(a) notify the relevant authority in the third country that is competent for the purpose for which the data are transferred of the transfer without undue delay, unless to do so would be ineffective or inappropriate, having regard to the purpose for which the data are being transferred,

(b) notify the Commission of the transfer, and

(c) create and maintain a record in writing of the transfer containing at least the following information:

(i) details of the personal data transferred;

(ii) the date and the time of the transfer;

(iii) the identity of the recipient;

(iv) the reason for which the data were transferred.

(4) A controller shall make available a record created and maintained pursuant to subsection (3)(c) to the Commission for inspection upon a request in that regard by the Commission.

(5) In this section—

“controller” means a controller that is a competent authority specified in paragraph (a) of the definition of “competent authority” in section 69;

“relevant international agreement” means an international agreement—

(a) to which the State and the third country in which the recipient is located are parties, and

(b) that relates to judicial cooperation in criminal matters or to police cooperation.

101. (1) Subject to subsection (2), the functions of the Commission under this Part shall be to—

(a) monitor and enforce application of this Part and regulations made under it,

(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing,

(c) advise, on request by the body concerned, the Houses of the Oireachtas, Government and public authorities on legislative and administrative measures relating to the protection of individuals’ rights and freedoms with regard to processing,

(d) promote the awareness of controllers and processors of their obligations under this Part and the Directive,

(e) provide, on request by them, information to data subjects on the exercise of their rights under this Part and the Directive and, where appropriate, cooperate with the supervisory authorities of other Member States for that purpose,

(f) handle, in accordance with Part 6, complaints lodged by or on behalf of a data subject under Chapter 3 of that Part,

(g) examine the lawfulness of processing pursuant to section 95 and inform the data subject within a reasonable period of the outcome of the examination or of the reasons why the examination has not been carried out,

(h) cooperate with, and provide mutual assistance to, other supervisory authorities in accordance with section 103 and Chapter VII of the Directive with a view to ensuring consistent application and enforcement of the Directive,

(i) conduct, of its own volition or on the basis of information received from another supervisory authority or other public authority, investigations, in accordance with Part 6, on the application of this Part,

(j) monitor relevant developments insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies,

(k) provide advice to a controller or processor, as the case may be, pursuant to section 84, and

(l) contribute to the activities of the European Data Protection Board.

(2) The Commission shall not be competent for the supervision of data processing operations of the courts when acting in their judicial capacity.

(3) Subject to subsections (4) and (5), the Commission shall not charge a data subject or data protection officer a fee in respect of the performance by it of its functions under this section.

(4) Where a request referred to in Article 46(4) of the Directive is manifestly unfounded or excessive, the Commission may—

(a) charge the person who made the request a reasonable fee, based on its administrative costs, or

(b) refuse to act on the request.

(5) It shall be for the Commission to demonstrate that a request referred to in subsection (4) is manifestly unfounded or excessive.

(6) In this section, “excessive” includes, in particular, repetitive.

(7) For the purposes of this section, a request is repetitive where it is substantially the same as a request previously made by or on behalf of the same person and dealt with under this Part.

102. The Commission shall have the power to issue opinions on matters related to the protection of personal data to—

(a) on its own initiative or on request by the body concerned, the Houses of the Oireachtas, Government, public authorities and bodies, and

(b) on its own initiative, the public.

103. (1) The Commission shall, for the purposes referred to in section 101(1)(h)—

(a) in accordance with this Chapter, provide other supervisory authorities with mutual assistance, and

(b) put in place measures for effective cooperation with those authorities.

(2) The Commission, on receipt by it of a request of another supervisory authority (“requesting supervisory authority”) shall—

(a) without undue delay and no later than one month after receiving the request, take all appropriate measures required to reply to the request, and

(b) inform the requesting supervisory authority of the results of, or progress made in response to, the request.

(3) The measures referred to in subsection (2)(a) include the exercise by the Commission of its powers under Chapters 3, 4 and 5 of Part 6.

(4) (a) The Commission shall not refuse to comply with a request unless—

(i) it is not responsible under the Directive for the subject matter of the request or for the measures it is requested to carry out, or

(ii) compliance with the request would infringe the law of the State or European Union.

(b) The Commission shall provide the requesting supervisory authority concerned with the reasons for its refusal under paragraph (a) to comply with a request.

(5) The Commission, where providing information to a requesting supervisory authority in response to a request, shall, insofar as practicable, and in accordance with any implementing acts to which Article 50(8) of the Directive apply, do so—

(a) by electronic means, and

(b) using a standardised format, if any.

(6) Without prejudice to subsection (7), the Commission shall not charge a fee for any action taken in response to a request for mutual assistance.

(7) The Commission may enter into an agreement with other supervisory authorities on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.

(8) In this section and section 104—

“mutual assistance” includes—

(a) responding to requests for information, and

(b) undertaking supervisory measures, such as the carrying out of inspections or investigations under Part 6 or consultations;

“request” means a request for mutual assistance referred to in Article 50 of the Directive.

104. (1) A request by the Commission to another supervisory authority shall contain all the information necessary for the purpose of the request, which shall include the purpose of and reasons for the request.

(2) The Commission shall use information received by it from another supervisory authority in response to a request only for the purpose for which it was requested.

105. (1) In this Part—

“complaint” means a complaint within the meaning of Chapter 2 or 3;

“investigation” means an investigation under Chapter 5;

“investigation report” has the meaning assigned to it by section 139;

“relevant enactment” means—

(a) the Data Protection Regulation, or

(b) a provision of this Act, or a regulation under this Act, that gives further effect to the Data Protection Regulation;

“relevant provision” means a provision of this Act, or a regulation under this Act, that gives effect to the Directive.

(2) A reference in this Part (other than in Chapter 2) to a controller or a processor includes a reference to a controller or a processor, as the case may be, within the meaning of Part 5.

(3) Where a person is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3—

(a) a reference in sections 117, 128 and 135(10) to a controller shall be deemed to be a reference to the appropriate authority that, or the Minister who, made the designation, and not to the person, and

(b) a reference in sections 132(6) and 133(10) to a controller shall be deemed not to include a reference to the person.

(4) A reference in this Part to information obtained in an inquiry (within the meaning of section 110 or 123) shall be construed as including, where applicable—

(a) an investigation report prepared in the course of the inquiry, and any submissions annexed to the report, and

(b) any additional information obtained, in the course of the inquiry, by the Commission under section 140(2).

106. (1) Subject to section 116(4)(a), a notice or other document that is required to be served on or given to a person under this Part shall be addressed to the person concerned by name and shall be so served on or given to the person in one of the following ways:

(a) by delivering it to the person;

(b) by leaving it at the address at which the person ordinarily resides or carries on business or, in a case in which an address for service has been furnished, at that address;

(c) by sending it by post in a prepaid registered letter or by any other form of recorded delivery service to the address referred to in paragraph (b); or

(d) by electronic means, in a case in which the person has given notice in writing to the person serving or giving the notice or document concerned of his or her consent to the notice or document (or notices or documents of a class to which the notice or document belongs) being served on, or given to, him or her in that manner.

(2) For the purposes of this section, a company within the meaning of the Act of 2014 is deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body of persons shall be deemed to be ordinarily resident at its principal office or place of business.

107. In this Chapter—

“complainant” means a data subject who lodges a complaint or, as the case may be, a not-for-profit body, organisation or association that, in accordance with Article 80(1), lodges a complaint on behalf of a data subject;

“complaint” means a complaint lodged pursuant to Article 77(1) or in accordance with Article 80(1), and shall be deemed to include a complaint so lodged by or on behalf of a data subject where—

(a) the data subject considers that the processing of personal data relating to him or her infringes a relevant enactment, and

(b) the Commission is the competent supervisory authority in respect of the complaint;

“corrective power” means a power conferred by Article 58(2) of the Data Protection Regulation;

“infringement” means an infringement of a relevant enactment;

“inquiry” means an inquiry referred to in section 110(1).

108. (1) Where a complaint is lodged with the Commission, the Commission shall, as soon as practicable, give the complainant concerned a notice in writing acknowledging the lodging of the complaint, and informing the complainant of—

(a) where the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right under section 150(5) and (7), and

(b) where a supervisory authority other than the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right to a judicial remedy against that competent supervisory authority where it does not—

(i) handle the complaint, or

(ii) inform the complainant within 3 months from the date on which the complaint is received by that authority on the progress or outcome of the complaint.

(2) Where the Commission is the competent supervisory authority in respect of a complaint, it shall—

(a) handle the complaint in accordance with this Part, and

(b) inform the complainant, within 3 months from the date on which the complaint is received by the Commission, on the progress or outcome of the complaint.

(3) For the purposes of subsection (2)(b), the Commission shall be taken to have informed a complainant of the outcome of the complaint concerned where it gives the complainant a notice under section 109(6) or, as the case may be, section 116.

109. (1) For the purposes of section 108(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.

(2) The Commission, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.

(3) Where the parties concerned reach an amicable resolution of the subject matter of the complaint, the complaint shall, from the date on which the amicable resolution is reached, be deemed to have been withdrawn by the complainant concerned.

(4) Where the Commission considers that an amicable resolution cannot be reached by the parties within a reasonable time, it shall proceed—

(a) in the case of a complaint to which section 113 applies, to comply with section 113(2), or

(b) in the case of any other complaint, to take an action specified in subsection (5).

(5) The actions referred to in subsection (4)(b) include one or more than one of the following:

(a) rejection of the complaint;

(b) dismissal of the complaint;

(c) provision to the complainant of advice in relation to the subject matter of the complaint;

(d) serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

F8[(da) where the Commission considers the processing of personal data the subject of the complaint infringes a relevant enactment, issuing a reprimand to the controller or processor concerned;]

(e) causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint;

(f) taking of such other action in respect of the complaint as the Commission considers appropriate.

(6) The Commission shall, as soon as practicable after taking an action referred to in subsection (5) (other than paragraph (e) of that subsection), give the complainant a notice in writing informing the complainant of the action taken.

110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

(2) The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following:

(a) cause any of its powers under Chapter 4 (other than section 135) to be exercised;

(b) cause an investigation under Chapter 5 to be carried out.

111. (1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall—

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

112. (1) Where an inquiry has been conducted in respect of a complaint in respect of which the Commission is the competent supervisory authority under Article 55 or 56(5), the Commission, having considered the information obtained in the examination, may—

(a) if satisfied that an infringement by the controller or processor to which the complaint relates has occurred or is occurring, make a decision to that effect, or

(b) if not so satisfied, make a decision to dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

113. (1) This section applies to a complaint in respect of which the Commission is the lead supervisory authority.

(2) Where section 109(4)(a) applies, the Commission shall—

(a) in accordance with subsection (3), make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor concerned, and

(b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint.

(3) In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have regard to—

(a) the information obtained by the Commission in its examination of the complaint, including, where an inquiry has been conducted in respect of the complaint, the information obtained in the inquiry, and

(b) any draft for a decision that is submitted to the Commission by a supervisory authority in accordance with Article 56(4).

(4) Where the Commission adopts a decision under subsection (2)(b) to the effect that an infringement by the controller or processor concerned has occurred or is occurring, it shall, in addition, make a decision—

(a) where an inquiry has been conducted in respect of the complaint—

(i) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(ii) where it decides to so exercise a corrective power, the corrective power that is to be exercised,

or

(b) where an inquiry has not been conducted in respect of the complaint—

(i) as to whether an action specified in subsection (6) should be taken in respect of the controller or processor concerned, and

(ii) where it decides to take such an action, the action that is to be taken.

(5) The Commission, in making its decision under subsection (4), shall have due regard to the decision as to the envisaged action to be taken in relation to the controller or processor included in the Commission’s draft decision under subsection (2)(a) or, as the case may be, its revised draft decision under Article 60.

(6) The actions referred to in subsection (4)(b) include F9[any or all] of the following:

(a) the serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

F10[(aa) the issuing of a reprimand to the controller or processor concerned;]

(b) the taking of such other action in respect of the complaint as the Commission considers appropriate.

(7) The Commission—

(a) where it makes a decision referred to in subsection (4)(a)(ii), shall exercise the corrective power concerned, and

(b) where it makes a decision referred to in subsection (4)(b)(ii), shall take the action concerned.

114. Where—

(a) a complaint is lodged with the Commission, or a complaint is lodged with another supervisory authority and the Commission is the supervisory authority in respect of the complainant concerned,

(b) another supervisory authority is the lead supervisory authority in respect of the complaint, and

(c) a decision is made, in accordance with Article 60, to dismiss or reject the complaint or, where Article 60(9) applies, part of the complaint,

the Commission shall adopt the decision referred to in paragraph (c) in respect of the complaint or, as the case may be, part of the complaint.

115. (1) For the purposes of exercising a corrective power under section 111, 112 or 113, the Commission may do either or both of the following:

(a) subject to Chapter 6, decide to impose an administrative fine on the controller or processor concerned;

(b) exercise any other corrective power specified in Article 58(2).

(2) Without prejudice to the generality of subsection (1)(b), the Commission may, for the purposes of exercising a power referred to in that provision, serve on the controller or processor concerned an enforcement notice requiring it to take such steps as the Commission considers necessary for those purposes.

116. (1) The Commission shall—

(a) as soon as practicable after it makes a decision under section 111 or 112, give the controller or processor concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor,

and

(b) in the case of a decision under section 112, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor.

(2) Subject to subsection (4), the Commission shall—

(a) as soon as practicable after it adopts a decision under section 113(2)(b), give the controller or processor concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor,

and

(b) in the case of a complaint lodged with the Commission, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor.

(3) The Commission shall, as soon as practicable after it adopts a decision under section 114, give—

(a) the complainant concerned, and

(b) the controller or processor concerned,

a notice in writing informing them of the rejection or dismissal of the complaint or, as the case may be, the part of the complaint.

(4) Where the Commission is the lead supervisory authority in relation to a complaint to which Article 60(9) applies, the Commission shall, as soon as practicable after it adopts its decision under Article 60(9)—

(a) give the controller or processor concerned, at its main establishment or single establishment, a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take in respect of the controller or processor,

and

(b) give the complainant concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take in respect of the controller or processor.

117. (1) Subject to subsection (9), and without prejudice to any other remedy available to him or her, including his or her right to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant enactment have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant enactment, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.

(2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.

F11[(3) The District Court shall, subject to subsections 5A and 6A, and the Circuit Court shall, subject to subsections (5) and (6), concurrently with the High Court, have jurisdiction to hear and determine data protection actions.]

(4) The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:

(a) relief by way of injunction or declaration; or

(b) compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment.

(5) The compensation recoverable in a data protection action in the Circuit Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.

F12[(5A) The compensation recoverable in a data protection action in the District Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.]

(6) The jurisdiction conferred on the Circuit Court by this section may be exercised by the judge of any circuit in which—

(a) the controller or processor against whom the data protection action is taken has an establishment, or

(b) the data subject has his or her habitual residence.

F12[(6A) The jurisdiction conferred on the District Court by this section may be exercised by the judge of any district in which—

(a) the controller or processor against whom the data protection action is taken has an establishment, or

(b) the data subject has his or her habitual residence.]

(7) A data protection action may be brought on behalf of a data subject by a not-for-profit body, organisation or association to which Article 80(1) applies that has been mandated by the data subject to do so.

(8) The court hearing a data protection action brought by a not-for-profit body, organisation or association under subsection (7) shall have the power to grant to the data subject on whose behalf the action is being brought one or more of the following reliefs:

(a) relief by way of injunction or declaration; or

(b) compensation for damage suffered by the plaintiff as a result of the infringement of the relevant enactment.

(9) A data subject may not bring a data protection action against a controller or processor that is a public authority of another Member State acting in the exercise of its public powers.

(10) In this section—

“damage” includes material and non-material damage;

“injunction” means—

(a) an interim injunction,

(b) an interlocutory injunction, or

(c) an injunction of indefinite duration.

F14[117A. (1) This section applies to a transfer of personal data by a controller or processor to a third country or an international organisation pursuant to Article 46 where the transfer is subject to appropriate safeguards provided for in the rules or clauses (in this section referred to as "relevant instruments") set out in subsection (5).

(2) Without prejudice to any other remedy available to him or her, including his or her right to bring an action under section 117 or to lodge a complaint, a data subject whose personal data is included in a transfer referred to in subsection (1) may, where the transfer is subject to appropriate safeguards set out in a relevant instrument, enforce—

(a) any rights (whether described as third party beneficiary rights or otherwise) conferred on data subjects by, or any clauses or rules expressed to be for the benefit of data subjects in, the instrument concerned, and

(b) where that transfer is subject to any additional safeguards conferring rights on data subjects, those rights.

(3) An action to enforce any rights conferred on data subjects or any clauses or rules expressed to be for the benefit of data subjects referred to in subsection (2)—

(a) may be taken against—

(i) a party to the transfer referred to in subsection (1), or

(ii) a sub-processor of a party referred to in subparagraph (i) in so far as that sub-processor is processing personal data referred to in that subsection,

and

(b) shall be deemed to be an action founded on contract.

(4) Subsections (3) to (10) of section 117 shall apply to an action taken by a data subject under this section subject to the following modifications:

(a) a reference in those subsections to a data protection action shall be taken to be a reference to an action under this section;

(b) a reference in subsections (5) and (5A) to the limit of that court’s jurisdiction in tort shall be taken to be a reference to the limit of that court’s jurisdiction in contract;

(c) a reference in subsections (4)(b) and (8)(b) to compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment shall be taken to be a reference to compensation for damage suffered by the plaintiff as a result of the infringement of the relevant instrument.

(5) The relevant instruments are:

(a) binding corporate rules approved in accordance with Article 47;

(b) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

(c) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

(d) contractual clauses authorised by a supervisory authority pursuant to Article 46(3)(a);

(e) standard contractual clauses which are the subject of a decision adopted by the Commission in accordance with Article 26(4) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995³ on the protection of individuals with regard to the processing of personal data and on the free movement of such data.]]

118. In this Chapter—

“competent supervisory authority” shall be construed in accordance with the Directive;

“complainant” means a data subject who or, as the case may be, a body mandated in accordance with section 120 that, lodges a complaint;

“complaint” means a complaint lodged in accordance with section 119;

“controller” and “processor” have the meanings they have in Part 5;

“corrective power” means a power conferred on the Commission by section 127;

“inquiry” means an inquiry referred to in section 123;

“infringement” means an infringement of a relevant provision.

119. (1) Without prejudice to any other remedy available to him or her, and subject to section 120, a data subject who considers that processing of his or her personal data infringes a relevant provision, or provisions adopted by another Member State giving effect to a right to the data subject under the Directive, may lodge a complaint with the Commission.

(2) (a) Without prejudice to the right of a data subject under subsection (1), the Commission may specify the form of a complaint lodged under that subsection.

(b) When specifying a form under paragraph (a), the Commission shall, without excluding other means of communication, ensure that the form is capable of being completed electronically.

(3) The Commission, where it is not the competent supervisory authority in respect of a complaint lodged with it under subsection (1), shall—

(a) without undue delay, transmit the complaint to the competent supervisory authority, and

(b) inform the data subject of the transmission of the complaint.

(4) Where a complaint is transmitted to the Commission in accordance with the law of a Member State giving effect to Article 52(2) of the Directive, the complaint shall, for the purposes of this Part, be deemed to be a complaint lodged, on the date on which the complaint is received by the Commission, with the Commission in accordance with subsection (1).

120. (1) A data subject may mandate a body, organisation or association to which subsection (2) applies to do either or both of the following on his or her behalf:

(a) lodge a complaint under section 119;

(b) exercise the rights referred to in section 128 and section 150.

(2) This subsection applies to a body, organisation or association—

(a) that provides its services on a not-for-profit basis,

(b) that has been properly constituted in accordance with the law of the State or another Member State,

(c) whose objectives, as specified in the documents establishing the body, organisation or association concerned, are in the public interest, and

(d) that is active with regard to the protection of data subject rights and freedoms, including protection of their personal data.

(3) Where the Commission or a court, in performing its functions under this Act, has reasonable doubts as to whether a particular body, organisation or association is one to which subsection (2) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.

121. (1) Where a complaint is lodged, or deemed to be lodged, with the Commission under section 119(1), and section 119(3) does not apply to the complaint, the Commission shall as soon as practicable give the complainant concerned a notice—

(a) acknowledging the lodging of the complaint or, as the case may be, its receipt by the Commission referred to in section 119(4), and

(b) informing the complainant of the complainant’s rights under section 128.

(2) Where subsection (1) applies, the Commission shall—

(a) handle the complaint in accordance with this Part, and

(b) inform the complainant within 3 months from the date on which the complaint is lodged, of the progress or outcome of the complaint.

(3) For the purposes of subsection (2)(b), the Commission shall be taken to have informed a complainant of the outcome of the complaint concerned where it gives the complainant a notice under section 122(5) or, as the case may be, section 126.

122. (1) For the purposes of section 121(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.

(2) The Commission, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.

(3) Where the parties concerned reach an amicable resolution of the subject matter of the complaint, the complaint shall, from the date on which the amicable resolution is reached, be deemed to have been withdrawn by the complainant concerned.

(4) Where the Commission considers that an amicable resolution cannot be reached by the parties within a reasonable time, it shall proceed to take one or more than one of the following actions:

(a) rejection of the complaint;

(b) dismissal of the complaint;

(c) provision to the complainant of advice in relation to the subject matter of the complaint;

(d) serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

(i) comply with the data subject’s request to exercise his or her rights under a relevant provision;

(ii) bring processing into compliance with a relevant provision, in a specified manner and within a specified period;

(iii) where the enforcement notice is given to the controller, communicate a personal data breach to data subjects;

F15[(da) where it considers the processing of personal data the subject of the complaint infringes a relevant enactment, the issuing to the controller or processor concerned of a reprimand;]

(e) causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint;

(f) taking of such other action in respect of the complaint as the Commission considers appropriate.

(5) The Commission shall, as soon as practicable after taking an action referred to in subsection (4) (other than paragraph (e) of that subsection), give the complainant a notice in writing informing the complainant of the action taken.

123. (1) The Commission, whether for the purpose of section 122(4)(e) or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

(2) The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following:

(a) cause any of its powers under Chapter 4 (other than sections 134 and 135) to be exercised;

(b) cause an investigation under Chapter 5 to be carried out.

124. (1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall—

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, or

(b) if not so satisfied, make a decision to that effect.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

125. (1) Where an inquiry has been conducted in respect of a complaint, the Commission, having considered the information obtained in the inquiry, may—

(a) if satisfied that an infringement by the controller or processor to which the complaint relates has occurred or is occurring, make a decision to that effect, or

(b) if not so satisfied, make a decision to dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

126. The Commission shall—

(a) as soon as practicable after the decision under section 124 or 125 is made by it, give the controller or processor concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor,

and

(b) in the case of a decision under section 125, give, as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.

127. (1) The Commission may, for the purposes of sections 124(3) and 125(3), do one or more than one of the following:

(a) issue a warning to the controller or processor that intended data processing is likely to infringe a relevant provision;

(b) issue a reprimand to the controller or processor where data processing by the controller or processor has infringed a relevant provision;

(c) order the controller or processor to comply with a data subject’s request to exercise his or her rights under a relevant provision;

(d) order the controller or processor to bring processing into compliance with a relevant provision, in a specified manner and within a specified period;

(e) order the controller to communicate a personal data breach to data subjects;

(f) impose a temporary or definitive limitation, including a ban on processing;

(g) impose a restriction on processing by the controller or processor;

(h) order the suspension of data transfers to a recipient in a third country or to an international organisation.

(2) Without prejudice to the generality of sections 124(2)(b) and 125(2)(b), the Commission may, for the purposes of exercising a power specified in subsection (1), serve on the controller or processor concerned an enforcement notice requiring it to take such steps as the Commission considers necessary for those purposes.

128. (1) Subject to subsection (8), and without prejudice to any other remedy available to him or her, including his or her right under section 119 to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant provision have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant provision, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.

(2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.

(3) The Circuit Court shall, subject to subsections (5) and (6), concurrently with the High Court, have jurisdiction to hear and determine data protection actions.

(4) The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:

(a) relief by way of injunction or declaration; or

(b) compensation for damage suffered by the plaintiff as a result of the infringement of a relevant provision.

(5) The compensation recoverable in a data protection action in the Circuit Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.

(6) The jurisdiction conferred on the Circuit Court by this section may be exercised by the judge of any circuit in which—

(a) the controller or processor against whom the data protection action is taken has an establishment, or

(b) the data subject has his or her habitual residence.

(7) The court hearing a data protection action that has been brought, in accordance with section 120(1)(b), on behalf of a data subject by a body, organisation or association to which subsection (2) of that section applies shall have the power to grant to the data subject on whose behalf the action is being brought one or more of the following reliefs:

(a) relief by way of injunction or declaration; or

(b) compensation for damage suffered by the plaintiff as a result of the infringement of the relevant enactment.

(8) A data subject may not bring a data protection action against a controller or processor that is a public authority of another Member State acting in the exercise of its public powers.

(9) In this section—

“damage” includes material and non-material damage;

“injunction” means—

(a) an interim injunction,

(b) an interlocutory injunction, or

(c) an injunction of indefinite duration.

129. (1) The Commission may appoint such and so many members of its staff, and such and so many other suitably qualified persons, as it considers appropriate to be authorised officers for the purposes of this Act.

(2) A person appointed under subsection (1) shall, on his or her appointment, be furnished by the Commission with a certificate of his or her appointment and, when exercising a power conferred by this Act shall, on request by any person thereby affected, produce such certificate together with a form of personal identification to that person for inspection.

(3) A person who, immediately before the commencement of this section, was an authorised officer under section 24 of the Act of 1988 shall—

(a) for the unexpired period of his or her term of appointment under that section, and

(b) subject to the same terms and conditions as applied to that appointment,

be deemed to be an authorised officer appointed under subsection (1), and accordingly paragraph (a) of subsection (4) shall apply in respect of that authorised officer.

(4) An appointment shall cease—

(a) if the Commission revokes, in writing, the appointment,

(b) in the case of a person who at the time of his or her appointment was a member of staff of the Commission, upon the person ceasing to be such a member of staff, or

(c) in the case of an appointment for a fixed period, upon the expiry of that period.

(5) In this section, “suitably qualified person” means a person other than a member of staff of the Commission who, in the opinion of the Commission, has the expertise and experience necessary to perform the functions conferred on an authorised officer by this Act.

130. (1) For the purposes of this Act, a relevant enactment or a relevant provision, an authorised officer may—

(a) subject to subsection (6), enter, at any reasonable time, any place—

(i) where any activity connected with the processing of personal data takes place,

(ii) where the authorised officer has reasonable grounds for believing any activity connected with the processing of personal data takes place, or

(iii) at which the authorised officer has reasonable grounds for believing documents, records, statements or other information relating to the processing of personal data is being kept,

(b) search and inspect the place and any documents, records, statements or other information found there,

(c) require any person at the place, being a controller or processor, or an employee or agent of either of them, to produce to him or her any documents or records relating to the processing of personal data which are in that person’s power or control and, in the case of information in a non-legible form, to reproduce it in a legible form, and to give to the authorised officer such information as he or she may reasonably require in relation to any entries in such documents or records,

(d) secure for later inspection—

(i) any documents or records so provided or found and any data equipment, including any computer, in which those records may be held, or

(ii) any such place, or part thereof, in which—

(I) documents, records, statements or data equipment are kept, or

(II) there are reasonable grounds for believing that such documents, records, statements or data equipment are kept,

for such period as the authorised officer may reasonably consider necessary for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision,

(e) inspect and take extracts from or make copies of any such documents or records (including, in the case of information in a non-legible form, a copy of or extract from such information in a permanent legible form),

(f) remove and retain such documents or records for such period as the authorised officer reasonably considers necessary for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision, or require any person referred to in paragraph (c) to retain and maintain such documents or records for such period of time, as the authorised officer reasonably considers necessary for those purposes,

(g) if a person who is required under paragraph (c) to provide a particular record is unable to provide it, require the person to state, to the best of that person’s knowledge and belief, where the record is located or from whom it may be obtained, and

(h) require any person referred to in paragraph (c) to give to the authorised officer any information relating to the processing of personal data that the officer may reasonably require for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision and to afford the officer all reasonable assistance in relation thereto.

(2) An authorised officer may, in the performance of his or her functions under this Act, a relevant enactment or a relevant provision—

(a) operate any data equipment, including any computer, or cause any such data equipment or computer to be operated by a person accompanying the authorised officer, and

(b) require any person who appears to the authorised officer to be in a position to facilitate access to the documents or records stored in any data equipment or computer or which can be accessed by the use of that data equipment or computer to give the authorised officer all reasonable assistance in relation to the operation of the data equipment or computer or access to the records stored in it, including by—

(i) providing the documents or records to the authorised officer in a form in which they can be taken and in which they are, or can be made, legible and comprehensible,

(ii) giving to the authorised officer any password necessary to make the documents or records concerned legible and comprehensible, or

(iii) otherwise enabling the authorised officer to examine the documents or records in a form in which they are legible and comprehensible.

(3) When performing a function under this Act, a relevant enactment or a relevant provision, an authorised officer may, subject to any warrant under section 131, be accompanied by such and so many other authorised officers or members of the Garda Síochána as he or she considers appropriate.

(4) An authorised officer may require a person to provide him or her with his or her name and address where the authorised officer has reasonable grounds for requiring such information for the purpose of applying for a warrant under section 131.

(5) Where an authorised officer in the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision is prevented from entering any place, he or she may make an application under section 131 for a warrant to authorise such entry.

(6) An authorised officer shall not enter a dwelling, other than—

(a) with the consent of the occupier, or

(b) in accordance with a warrant under section 131.

(7) A person shall be guilty of an offence if he or she—

(a) obstructs, impedes or assaults an authorised officer in the performance of his or her functions under this Act, a relevant enactment or a relevant provision,

(b) fails or refuses to comply with a requirement of an authorised officer under this section,

(c) alters, suppresses or destroys any documents, records, statements or other information which the person concerned has been required by an authorised officer to produce, or may reasonably expect to be so required to produce,

(d) in purported compliance with a requirement under this section, gives to an authorised officer information, documents or records which the person knows to be false or misleading in a material respect,

(e) falsely represents himself or herself to be an authorised officer, or

(f) procures or attempts to procure any action referred to in paragraphs (a) to (e).

(8) A person guilty of an offence under subsection (7) shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

(9) A statement or admission made by a person pursuant to a requirement under subsection (1) or (2) shall not be admissible in evidence in proceedings for an offence (other than an offence under paragraph (b) of subsection (7)) brought against the person.

(10) In this section and section 131, “place” includes—

(a) a dwelling or a part thereof,

(b) a building or a part thereof,

(c) any other premises or part thereof, and

(d) a vehicle, vessel, aircraft or any other means of transport.

131. (1) If a judge of the District Court is satisfied on the sworn information of an authorised officer that there are reasonable grounds for suspecting that information required by an authorised officer for the purpose of performing his or her functions under this Part is held at any place, the judge may issue a warrant authorising him or her, accompanied if the officer considers it necessary by such other person or a member of the Garda Síochána, at any time or times from the date of issue of the warrant, on production, if so required, of the warrant, to enter, if need be by reasonable force, the place and exercise all or any of the powers conferred on an authorised officer under section 130.

(2) The period of validity of a warrant shall be 28 days from its date of issue, but that period of validity may be extended in accordance with subsections (3) and (4).

(3) The authorised officer may, during the period of validity of a warrant (including such period as previously extended under subsection (4)), apply to a judge of the District Court for an order extending the period of validity of the warrant and such an application shall be grounded upon information on oath laid by the authorised officer stating, by reference to the purpose or purposes for which the warrant was issued, the reasons why the authorised officer considers the extension to be necessary.

(4) If, on the making of an application under subsection (3), the judge of the District Court is satisfied that there are reasonable grounds for believing, having regard to that information so laid, that further time is needed so that the purpose or purposes for which the warrant was issued can be fulfilled, the judge may make an order extending the period of validity of the warrant by such period as, in the opinion of the judge, is appropriate and just; and where such an order is made, the judge shall cause the warrant to be suitably endorsed to indicate its extended period of validity.

(5) Nothing in subsections (1) to (4) prevents a judge of the District Court from issuing, on the making of a new application under subsection (1), a further search warrant under this section in relation to the same place.

132. (1) The Commission or an authorised officer may, by notice in writing (referred to in this Act as an “information notice”) served on a controller or processor, require the controller or processor to furnish, in writing, within such period as may be specified in the notice and, if applicable, in the format or manner specified in the notice, such information in relation to matters specified in the notice as is necessary or expedient for the performance by the Commission of its, or by the authorised officer of his or her, functions under this Part.

(2) Subject to subsection (3)—

(a) an information notice shall include a statement informing the controller or processor concerned of his entitlement under section 150(1) to appeal against the requirement specified in the notice,

(b) the period, referred to in subsection (1), specified in an information notice shall not be less than 28 days from the date on which the notice is served, and

(c) if an appeal is brought under section 150(1) against a requirement specified in an information notice, the requirement need not be complied with and subsection (6) shall not apply in relation to the requirement, pending the determination or withdrawal of the appeal.

(3) Where the Commission or authorised officer—

(a) by reason of special circumstances, is of the opinion that a requirement specified in an information notice should be complied with urgently, and

(b) includes a statement to that effect in the information notice,

subsection (2) shall not apply in relation to the notice, but the notice—

(i) shall include a statement of the effect of subsections (3) and (4) of section 150, and

(ii) shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.

(4) (a) Nothing in this section shall be taken to compel a controller or processor, in complying with an information notice, to furnish information that would be exempt from production in proceedings in a court on the ground of legal professional privilege.

(b) A document furnished in compliance with an information notice shall not be admissible in evidence in proceedings for an offence (other than an offence under this section) brought against any person who furnishes or concurs in the furnishing of the document.

(5) The controller or processor concerned shall inform the Commission of any documents, records, statements or other information withheld by it under subsection (4)(a).

(6) A controller or processor that without reasonable excuse fails to comply with a requirement specified in an information notice or that, in purported compliance with such a requirement, gives to the Commission or an authorised officer information which the controller or processor knows to be false or misleading in a material respect, shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

(7) (a) An information notice may be cancelled—

(i) where it has been issued by the Commission, by the Commission, and

(ii) where it has been issued by an authorised officer, by the Commission or that authorised officer.

(b) A person who cancels an information notice under paragraph (a) shall notify in writing the controller or processor on which the notice was served.

133. (1) In this Part, “enforcement notice” means a notice in writing served in accordance with subsection (2), subsection (3) or section 109(5)(d), 115(2), 122(4)(d) or 127(2), on a controller or processor, requiring the controller or processor to take such steps as are specified in the notice, within such time as may be so specified.

(2) Notwithstanding anything contained in Chapter 2, the Commission or an authorised officer, where of the opinion that a controller or processor has contravened or is contravening a relevant enactment, may serve on the controller or processor an enforcement notice requiring the controller or processor to take one or more than one of the steps specified in section 109(5)(d).

(3) Notwithstanding anything contained in Chapter 3, the Commission or an authorised officer, where of the opinion that a controller or processor has contravened or is contravening a relevant provision, may serve on the controller or processor an enforcement notice requiring the controller or processor to take one or more than one of the steps specified in section 122(4)(d).

(4) An enforcement notice shall include a statement informing the controller or processor concerned of its entitlement under section 150(1) to appeal against a requirement specified in the notice.

(5) Where an enforcement notice is served under section 109(5)(d), 122(4)(d), subsection (2) or subsection (3)—

(a) the notice shall specify the relevant enactment or relevant provision, as applicable, that in the opinion of the Commission or, where applicable, authorised officer, has been or is being contravened and the reasons for having formed that opinion, and

(b) subject to subsection (6)—

(i) the period, referred to in subsection (1), specified in an enforcement notice shall be not less than 28 days from the date on which the notice is served, and

(ii) if an appeal is brought under section 150(1) against a requirement specified in the notice, the requirement need not be complied with and, pending the determination or withdrawal of the appeal, subsections (9) and (10) shall not apply in relation to the requirement.

(6) Where the Commission or authorised officer—

(a) by reason of special circumstances, is of the opinion that a requirement specified in an enforcement notice referred to in subsection (5) should be complied with urgently, and

(b) includes a statement to that effect in the enforcement notice,

subsection (5)(b) shall not apply in relation to the notice, but the notice—

(i) shall include a statement of the effect of subsections (3) and (4) of section 150, and

(ii) shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.

(7) (a) Subject to paragraph (b), a controller or processor, having complied with an enforcement notice, shall, as soon as may be and in any event not more than 28 days after such compliance, notify the following of the steps taken to comply with the enforcement notice:

(i) the Commission or the authorised officer concerned;

(ii) any data subject concerned.

(b) Where the compliance with an enforcement notice has involved the rectification or erasure of personal data or the restriction of processing, the controller and processor shall, in complying with paragraph (a), in addition—

(i) notify any recipient to whom the data have been disclosed, or

(ii) where compliance with subparagraph (i) proves impossible or involves a disproportionate effort, and where the data subject so requests, notify the data subject of the recipients or the categories of recipients.

(8) (a) An enforcement notice may be cancelled—

(i) where it has been issued by the Commission, by the Commission, and

(ii) where it has been issued by an authorised officer, by the Commission or that authorised officer.

(b) A person who cancels an enforcement notice under paragraph (a) shall notify in writing the controller or processor on which the notice was served.

(9) (a) The Commission may, subject to Chapter 6, decide to impose an administrative fine on a controller or processor that, without reasonable excuse, fails to comply with a requirement specified in an enforcement notice served on the controller or processor under section 109(5)(d), 115(2) or subsection (2).

(b) The Commission, as soon as practicable after making its decision under paragraph (a), shall give the controller or processor concerned a notice in writing informing it of the decision.

(10) A controller or processor that, without reasonable excuse, fails to comply with—

(a) a requirement specified in an enforcement notice, or

(b) subsection (7),

shall be guilty of an offence and shall be liable—

(i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

134. (1) Without prejudice to Articles 58(2) and 66 of the Data Protection Regulation and subsection (4), the Commission, where it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects under a relevant enactment, until steps or further steps are taken under the relevant enactment, may, on notice to the controller or processor concerned, make an application in a summary manner to the High Court for an order under subsection (2).

(2) The High Court may determine an application under subsection (1) by—

(a) making any order that it considers appropriate, including an order suspending, restricting or prohibiting—

(i) the processing by the controller or processor of the personal data concerned, or

(ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation,

for such period, or until the occurrence of such event, as is specified in the order, and

(b) giving to the Commission any other direction that the High Court considers appropriate.

(3) The Commission shall, on complying with a direction of the High Court under subsection (2)(b), give notice in writing to the controller or processor concerned of the Commission’s compliance with the direction.

(4) Where the Commission considers that the immediate suspension, restriction or prohibition of the processing of personal data or the transfer of such data to a recipient in a third country or to an international organisation is necessary in order to protect the rights and freedoms of data subjects under a relevant enactment, it may apply in a summary manner exparte to the High Court for an interim order under subsection (6).

(5) An application under subsection (4) shall be grounded on an affidavit sworn by or on behalf of the Commission.

(6) (a) The High Court may, on an application under subsection (4), where, having regard to the circumstances of the case, the Court considers it necessary to do so for the protection of the rights and freedoms of data subjects, make an interim order suspending, restricting or prohibiting—

(i) the processing by the controller or processor of the personal data concerned, or

(ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation.

(b) Without prejudice to subsection (7), where an interim order is made under this subsection, the Commission shall, as soon as is practicable, serve a copy of the order and of the affidavit referred to in subsection (5) on the controller or processor concerned.

(c) An interim order under this subsection shall have effect for such period, not exceeding 7 working days, as is specified in the order, and shall cease to have effect on the determination by the High Court of an application under subsection (1).

(7) (a) An interim order under subsection (6) shall take effect on notification of its making being given to the controller or processor.

(b) Oral communication to the controller or processor by or on behalf of the Commission of the fact that an interim order has been made, together with production of a copy of such order, shall, without prejudice to any other form of notification, be taken to be sufficient notification to the controller or processor concerned of the making of the order.

(8) The Commission shall communicate the details of an order made by the High Court under this section to the—

(a) European Commission,

(b) European Data Protection Board, and

(c) other supervisory authorities concerned.

135. (1) The Commission may, for the purposes of proper and effective monitoring of the application of a relevant enactment, and having regard to the matters set out in subsection (3), by notice in writing given to a controller or processor, require the controller or processor to provide to the Commission, in accordance with such notice, a report on any matter specified in the notice about which the Commission has required or could require the provision of information, or the production of any statement, record or document under any provision of a relevant enactment.

(2) A notice under subsection (1) shall be in writing and shall state—

(a) the date on which the notice is given,

(b) the period within which the controller or processor shall nominate a person to the Commission for approval under subsection (4),

(c) the purpose, scope and form of the report,

(d) the matters required to be reported on,

(e) the timetable for completion of the report,

(f) whether the report is to include recommendations in relation to the improved compliance by the controller or processor with a relevant enactment,

(g) where appropriate, the methodology to be used in preparation of the report, and

(h) such other matters relating to the report as the Commission considers appropriate.

(3) Before giving a notice under this section, the Commission, taking account of the purpose for which the report is required, shall have regard to at least the following matters—

(a) whether any other powers that may be exercised by the Commission may be more appropriate in the circumstances concerned,

(b) the relevant knowledge and expertise available to the controller or processor, and

(c) the level of resources available to the controller or processor and the likely benefit to the controller or processor of providing the report.

(4) A report required to be provided to the Commission under this section shall be prepared by a person (referred to as the “reviewer”)—

(a) nominated by the controller or processor, within such period as is specified in the notice given under subsection (1), and approved by the Commission, or

(b) nominated by the Commission, where—

(i) no person is nominated by the controller or processor within the period specified in the notice under subsection (1), or

(ii) the Commission is not satisfied with the person so nominated.

(5) When considering whether to approve a nomination under subsection (4)(a) or make a nomination under subsection (4)(b), the Commission shall have regard to the circumstances giving rise to the requirement for a report and whether the person it proposes to so approve or nominate as reviewer appears to have—

(a) the competence and expertise necessary to prepare the report,

(b) the ability to complete the report within the period specified by the Commission in the notice given under subsection (1),

(c) any relevant specialised knowledge, including specialised knowledge of the data processing activities carried on by the controller or processor and the matters to be reported on,

(d) any potential conflict of interest in reviewing the matters to be reported on,

(e) sufficient detachment, having regard to any existing professional or commercial relationship, to give an objective opinion, and

(f) any previous experience in preparing reports under this section or reports of a similar nature.

(6) Where the Commission approves a nomination under subsection (4)(a) or makes a nomination under subsection (4)(b), it shall notify the controller or processor, in writing, accordingly.

(7) Where the nomination of a reviewer is approved or made by the Commission under subsection (4), the controller or processor shall enter into a contract with the reviewer.

(8) It shall be a term of the contract referred to in subsection (7)—

(a) that the reviewer is required to prepare for the controller or processor a report in accordance with the notice given under subsection (1),

(b) that the reviewer is required and permitted to provide to the Commission the following where the Commission so requests:

(i) periodic updates on progress and issues arising;

(ii) interim reports; and

(iii) copies of any draft reports given to the controller or processor,

and

(c) that the contract is governed by the law of the State.

(9) If the Commission considers it appropriate, it may request the controller or processor to provide the Commission with a copy of the draft contract before it is made and the Commission may require such modifications to the draft contract as it considers appropriate.

(10) The costs of and incidental to the preparation of a report under this section shall be borne by the controller or processor.

(11) A controller or processor shall give all such assistance to a reviewer as he or she may reasonably require for the purposes of the preparation of a report under this section.

(12) A reviewer shall, where requested by the Commission, in such form and within such period as the Commission may specify, provide an explanation of all or any part of a report under this section or the recommendations, if any, made in the report, or of such other matters relating to the report as the Commission considers appropriate.

(13) The Commission shall not be bound by the content of a report under this section and such a report shall not be taken to be a decision or opinion of the Commission for any purpose.

(14) The Commission shall not be liable for any acts or omissions of a reviewer or controller or processor relating to a report under this section.

(15) A person who—

(a) obstructs or impedes a reviewer in the preparation of a report under this section,

(b) in relation to the preparation of a report under this section, gives information to a reviewer that the person knows to be false or misleading in a material respect, or

(c) is a reviewer and in relation to the preparation of a report under this section gives information to the Commission which the reviewer knows to be false or misleading in a material respect,

shall be guilty of an offence and shall be liable—

(i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

136. (1) Where Part 5 applies to a controller or processor, the Commission may carry out or cause to be carried out such examination in the form of an audit as it considers appropriate in order to determine whether the practices and procedures of the controller or processor are in compliance with that Part and regulations made under it.

(2) The Commission may, for the purposes of an audit under subsection (1) or a data protection audit, require the controller or processor concerned to produce any documents, records, statements or other information within that person’s possession or control, or within that person’s procurement, that are relevant to or required for the conduct of the audit.

(3) Before commencing an audit under subsection (1), or a data protection audit, the Commission shall give the controller or processor concerned notice of its proposal to conduct such an audit, which notice shall—

(a) specify the matters to which the proposed audit will relate, and

(b) specify the date, which shall be not earlier than 7 days from the date on which the notice is given on which the audit will be commenced.

(4) In this section, “data protection audit” means a data protection audit conducted for the purpose of Article 58(1)(b) of the Data Protection Regulation.

137. (1) The Commission may, for the purposes of an inquiry referred to in section 110(1) or 123(1), cause such investigation as it thinks fit to be carried out.

(2) The Commission may, for the purposes of subsection (1), direct one or more authorised officers—

(a) to carry out the investigation, and

(b) to submit to the Commission an investigation report following the completion of the investigation.

(3) The Commission may define the scope and terms of the investigation to be carried out, whether as respects the matters or the period to which it is to extend or otherwise, and may, in particular, limit the investigation to matters connected with particular circumstances.

(4) Where more than one authorised officer has been directed to carry out an investigation, the investigation report shall be prepared jointly by the authorised officers so directed and this section and sections 138 to 140 shall, with all necessary modifications, be construed accordingly.

(5) As soon as is practicable after being appointed to carry out an investigation, the authorised officer shall—

(a) give the controller or processor concerned notice in writing—

(i) where the examination concerned is being carried out in respect of a complaint within the meaning of Chapter 2 or 3, setting out the particulars of the complaint concerned, or

(ii) where the examination is being carried out of the Commission’s own volition, setting out the matters to which the investigation relates,

and

(b) afford to the controller or processor an opportunity to respond to the notice under paragraph (a) within 7 days from the date on which the notice was given (or such further period not exceeding 28 days as the authorised officer allows).

138. (1) An authorised officer who has been directed under section 137(2) to carry out an investigation may, for the purposes of the investigation—

(a) require a person, being a controller or processor, or an employee or agent of such controller or processor, who, in the authorised officer’s opinion—

(i) possesses information that is relevant to the investigation, or

(ii) has any record or document within the person’s possession or control or within the person’s procurement that are relevant to the investigation,

to provide that record or document, as the case may be, to the authorised officer, and

(b) where the authorised officer thinks fit, require that person to attend before him or her for the purpose of so providing that information, record or document, as the case may be,

and the person shall comply with the requirement.

(2) A requirement under subsection (1) shall specify—

(a) a period within which, or a date and time on which, the person the subject of the requirement is to comply with the requirement, and

(b) as the authorised officer concerned thinks fit—

(i) the place at which the person shall attend to give the information concerned or to which the person shall deliver the record or document concerned, or

(ii) the place to which the person shall send the information, record or document concerned.

(3) A person required to attend before an authorised officer under subsection (2)—

(a) is also required to answer fully and truthfully any question put by the authorised officer, and

(b) if so required by the authorised officer, shall answer any such question under oath.

(4) Where it appears to an authorised officer that a person has failed or is failing to comply or fully comply with a requirement under subsection (2) or (3), the authorised officer may, on notice to the person and with the consent of the Commission, apply in a summary manner to the Circuit Court for an order under subsection (5).

(5) The Circuit Court, on hearing an application under subsection (4), where satisfied that the person concerned has failed or is failing to comply or fully comply with the requirement concerned, may—

(a) make an order requiring the person, within such period as the Court may specify, to comply or fully comply, as the case may be, with the requirement, or

(b) substitute a different requirement for the requirement concerned.

(6) The administration of an oath referred to in subsection (3)(b) by an authorised officer is hereby authorised.

(7) A person the subject of a requirement under subsection (1) or (3) shall be entitled to the same immunities and privileges in respect of compliance with such requirement as if the person were a witness before the High Court.

(8) Any statement or admission made by a person pursuant to a requirement under subsection (1) or (3) shall not be admissible in evidence in proceedings for an offence (other than an offence under subsection (12)) brought against the person, and this shall be explained to the person in ordinary language by the authorised officer concerned.

(9) Nothing in this section shall be taken to compel the production by any person of statements, records or other documents or other information which would be exempt from production in proceedings in a court on the ground of legal professional privilege.

(10) For the purposes of an investigation, an authorised officer may, if he or she thinks it proper to do so, of his or her own volition conduct an oral hearing.

(11) Schedule 3 shall have effect for the purposes of an oral hearing referred to in subsection (10).

(12) Subject to subsection (9), a person who—

(a) withholds, destroys, conceals or refuses to provide any information or statements, records or other documents required for the purposes of an investigation,

(b) fails or refuses to comply with any requirement of an authorised officer under this section,

(c) in purported compliance with a requirement under this section, gives to an authorised officer information, documents or records which the person knows to be false or misleading in a material respect, or

(d) otherwise obstructs or hinders an authorised officer in the performance of functions under this Act,

shall be guilty of an offence and shall be liable—

(i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

(13) In this section, a reference to a document or record includes a reference to copies of such document or record.

(14) The powers conferred under this section on an authorised officer to whom subsection (1) applies are in addition to the powers conferred on such an authorised officer under Chapter 4.

139. (1) Where an authorised officer has completed an investigation, he or she shall, as soon as is practicable after having considered, in so far as they are relevant to the investigation—

(a) any information, records or other documents provided to him or her,

(b) any statement or admission made by any person,

(c) any submissions made, and

(d) any evidence presented (whether at an oral hearing or otherwise),

prepare a draft, in writing, of the investigation report (“draft investigation report”) and give, or cause to be given, to the controller or processor to which the investigation relates—

(i) a copy of the draft investigation report, and

(ii) a notice in writing stating that the controller or processor concerned may, not later than 28 days from the date on which the notice was served on it (or such further period not exceeding 28 days as the authorised officer allows), make submissions in writing to the authorised officer on the content of the draft investigation report.

(2) An authorised officer shall—

(a) as soon as is practicable after the expiration of the period referred to in subsection (1)(ii), and

(b) having—

(i) considered the submissions (if any) made in accordance with subsection (1)(ii), and

(ii) made any revisions to the draft investigation report which, in the opinion of the authorised officer, are warranted following such consideration,

prepare the investigation report and submit it to the Commission with any such submissions annexed to it.

(3) An investigation report and a draft investigation report under this section shall be in writing and shall state—

(a) whether the authorised officer—

(i) is satisfied that an infringement of a relevant provision or, as the case may be, a relevant enactment by the controller or processor to which the investigation relates has occurred or is occurring, or

(ii) is not so satisfied,

(b) where paragraph (a)(i) applies, the grounds on which the authorised officer is so satisfied, and

(c) where paragraph (a)(ii) applies—

(i) the basis on which the authorised officer is not so satisfied, and

(ii) the authorised officer’s opinion, in view of such basis, on whether or not a further investigation of the controller or processor is warranted and, if warranted, the authorised officer’s opinion on the principal matters to which the further investigation should relate.

(4) Where an investigation report or a draft investigation report contains a statement referred to in subsection (3)(a)(i), the authorised officer shall not make any recommendation, or express any opinion, in such report as to the corrective power under Chapter 2 or 3, as applicable, that he or she considers ought to be exercised in respect of the controller or processor in respect of such infringement in the event that the Commission is also satisfied that an infringement has occurred or is occurring.

140. (1) The Commission, on receipt under section 139(2) of an investigation report, shall, for the purposes of the inquiry concerned, consider the report and any submissions annexed to it.

(2) Where the Commission, in considering the documents referred to in subsection (1), forms the view that further information is required for the purpose of enabling it to make a decision under section 111, 112, 124 or 125, or a draft decision under section 113, as the case may be, it may, as it considers appropriate, do one or more than one of the following:

(a) conduct an oral hearing;

(b) give the controller or processor to which the investigation concerned relates—

(i) a copy of the investigation report, and

(ii) a notice in writing stating that the controller or processor concerned may, within 21 days from the date on which the notice was served on it (or such further period not exceeding 21 days as the Commission allows), make submissions in writing to the Commission in relation to such matters as the Commission may specify in the notice;

or

(c) direct an authorised officer to conduct such further investigation into such matters as the Commission considers necessary having regard to the investigation report and submissions (if any) annexed to it.

(3) Schedule 3 shall, with any necessary modification, have effect for the purposes of an oral hearing referred to in subsection (2)(a).

(4) Sections 138 and 139 and this section shall apply to a further investigation conducted in compliance with a direction under subsection (2)(c), as if the reference to an authorised officer in those sections was a reference to an authorised officer directed under subsection (2)(c) to conduct the further investigation.

141. (1) The Commission, in considering—

(a) whether to make a decision to impose an administrative fine, and

(b) where applicable, the amount of such a fine,

shall act in accordance with this section and Article 83.

(2) Where a controller to whom section 111(2)(b), 112(2)(b) or 133(9) applies is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3, a decision by the Commission to impose an administrative fine in respect of the infringement or failure concerned shall be a decision to impose an administrative fine on the appropriate authority that, or, as the case may be, the Minister who, made the designation, and not on the controller.

(3) Where subsection (2) applies, a reference in sections 115(1)(a), 133(9)(b) and this Chapter to a controller shall be construed as a reference to the appropriate authority or Minister concerned.

(4) Where the Commission decides to impose an administrative fine on a controller or processor that—

(a) is a public authority or a public body, but

(b) is not a public authority or a public body that acts as an undertaking within the meaning of the Competition Act 2002,

the amount of the administrative fine concerned shall not exceed €1,000,000.

(5) The Commission, as soon as practicable after—

(a) a decision to impose an administrative fine is confirmed under section 142(3)(a) or 143(2), or

(b) the court decides, under section 142(3)(b), to impose a different fine,

shall give the controller or processor concerned a notice in writing, requiring the controller or processor to pay the amount of the fine concerned to the Commission within the period of 28 days commencing on the date of the notice.

(6) A controller or processor shall comply with a requirement referred to in subsection (5).

(7) All payments received by the Commission under this section shall be paid into or disposed of for the benefit of the Exchequer in such manner as the Minister for Finance may direct.

(8) In this section and section 142, a reference to a decision to impose an administrative fine shall be construed as a reference to a decision by the Commission, under section 111, 112, 113 or 133 (9), to impose such a fine.

142. (1) Without prejudice to section 150, a controller or processor that is the subject of a decision under section 111, 112, 113 or 133(9) to impose an administrative fine may, within 28 days from the date on which notice of the decision concerned was given to it under section 116 or, as the case may be, section 133(9)(b) appeal to the court against the decision.

(2) The court, on hearing an appeal under subsection (1), may consider any evidence adduced or argument made by the controller or processor concerned, whether or not already adduced or made to an authorised officer or the Commission.

(3) Subject to subsections (4) and (5), the court may, on the hearing of an appeal under subsection (1)—

(a) confirm the decision the subject of the appeal,

(b) replace the decision with such other decision as the court considers just and appropriate, including a decision to impose a different fine or no fine, or

(c) annul the decision.

(4) The court shall, for the purposes of subsection (3), act in accordance with Article 83.

(5) Where the decision the subject of the appeal is one to which section 141(4) applies, and the court decides under subsection (3)(b) to impose a different fine, the amount of the fine imposed by the court shall not exceed €1,000,000.

(6) In this section, “court” means—

(a) the Circuit Court, where the amount of the administrative fine the subject of the appeal does not exceed €75,000, or

(b) in any other case, the High Court.

143. (1) Where a controller or processor does not appeal in accordance with section 142(1) against a decision by the Commission to impose an administrative fine on the controller or processor, the Commission shall, as soon as is practicable after the expiration of the period referred to in that subsection, and on notice to the controller or processor concerned, make an application in a summary manner to the Circuit Court for confirmation of the decision.

(2) The Circuit Court shall, on the hearing of an application under subsection (1), confirm the decision the subject of the application unless the Court sees good reason not to do so.

144. (1) Personal data processed by a processor shall not be disclosed by the processor or by an employee or agent of the processor, without the prior authority of the controller on behalf of whom the data are processed.

(2) A person who knowingly or recklessly contravenes subsection (1) shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

(3) Subsection (1) does not apply to a person who shows that the disclosing concerned was required or authorised by or under any enactment, rule of law or order of a court.

145. (1) A person who, without the prior authority of the controller or processor—

(a) obtains personal data, and

(b) discloses the data or information to another person,

shall be guilty of an offence and shall be liable—

(i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(ii) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

(2) Subsection (1) does not apply to a person who shows that the disclosing was required or authorised by or under any enactment, rule of law or order of a court.

(3) A person who sells personal data that were disclosed to the person in contravention of subsection (1) shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

(4) A person who offers to sell personal data obtained without the prior authority of the controller or processor shall be guilty of an offence and shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.

146. Where an offence under this Act is committed by a body corporate and is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of, a person being a director, manager, secretary or other officer of the body corporate or a person who was purporting to act in any such capacity, that person, as well as the body corporate, shall be guilty of that offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first-mentioned offence.

147. (1) Summary proceedings for an offence under this Act may be brought and prosecuted by the Commission.

(2) Notwithstanding section 10(4) of the Petty Sessions (Ireland) Act 1851, summary proceedings for an offence under this Act may be brought—

(a) at any time within 3 years from the date on which the offence was alleged to have been committed, or

(b) if, at the expiry of that period, the person against whom the proceedings are to be brought is outside the State, within 6 months of the date on which he or she next enters the State,

whichever is the later, provided that no such proceedings shall be commenced later than 5 years from the date on which the offence concerned was alleged to have been committed.

(3) Where a person is convicted of an offence under this Act, the court may, where it is satisfied that there are good reasons for so doing, order the person to pay the costs and expenses, measured by the court, incurred by the Commission in relation to the investigation, detection and prosecution of the offence, including the expenses of and incidental to an examination of any information provided to the Commission or an authorised officer.

(4) An order for costs and expenses under subsection (3) is in addition to and not instead of any fine or other penalty the court may impose.

148. (1) Subject to subsection (2), sections 108 and 121 shall cease to apply where the complaint concerned is withdrawn, or deemed to have been withdrawn, by the data subject concerned, or on behalf of the data subject by a body mandated by the data subject in accordance with Article 80(1) of the Data Protection Regulation or section 120, as the case may be.

(2) Where subsection (1) applies, nothing in that subsection shall be construed as preventing the Commission, where it is satisfied that there is good and sufficient reason for so doing, from proceeding or, as the case may be, continuing to examine, in accordance with Chapter 2 or 3, as applicable, the subject matter of the complaint.

(3) Where it has reasonable doubts concerning the identity of a complainant, the Commission may request from the complainant or, where applicable, the supervisory authority with which the complaint was lodged, such additional information as is necessary to confirm such identity.

149. (1) The Commission shall publish particulars of any—

(a) conviction of a person for a contravention of this Act,

(b) exercise by it of its power—

(i) to impose an administrative fine, or

(ii) to order the suspension of data transfers to a recipient in a third country or to an international organisation, under Article 58(2)(j),

or

(c) order of the Court under section 134.

(2) The publication under subsection (1) of the particulars referred to in that subsection shall be in such form and manner and in respect of such period as the Commission thinks fit.

(3) The Commission may publish particulars, in such form and manner and in respect of such period as it thinks fit, of the exercise by it of its corrective powers under Article 58(2) (other than those referred to in subsection (1)) or section 127.

(4) Subject to subsection (5), the Commission may, if it considers it in the public interest to do so, publish particulars of any report under section 135, report by the Commission of any investigation or audit carried out, or other function performed, by it under the Data Protection Regulation or this Act, or any matter relating to or arising in the course of such an investigation, audit or performance.

(5) The Commission shall ensure that the publication under subsection (4) of information referred to in that subsection is done in such a manner that commercially sensitive information relating to a person is not disclosed.

(6) The publication by the Commission of particulars of any report or matters referred to in subsection (3) or (4) and any other report of the Commission shall, for the purposes of the law of defamation, be absolutely privileged.

(7) In this section, “commercially sensitive information” means—

(a) financial, commercial, scientific, technical or other information the disclosure of which could reasonably be expected to result in a material financial loss or gain to the person to whom it relates, or could prejudice the competitive position of that person in the conduct of his or her business or otherwise in his or her occupation, or

(b) information the disclosure of which could prejudice the conduct or outcome of contractual or other negotiations of the person to whom it relates.

150. (1) A controller or processor on which an information notice or enforcement notice or a notice under section 135(1) is served may, within 28 days from the date on which the notice is served, appeal against a requirement specified in the notice.

(2) The court, on hearing an appeal under subsection (1), shall—

(a) annul the requirement concerned,

(b) substitute a different requirement for the requirement concerned, or

(c) dismiss the appeal.

(3) This subsection applies to an appeal brought under subsection (1)—

(a) against a requirement specified in an information notice to which section 132(3) applies, or an enforcement notice to which section 133(6) applies, and

(b) that is brought within the period specified in the notice concerned.

(4) Notwithstanding any provision of this Act, the court, on hearing an appeal to which subsection (3) applies, may on application to it in that behalf, determine that non-compliance by the controller or processor concerned with a requirement specified in the notice, during the period ending with the determination or withdrawal of the appeal or during such other period as the court may determine, shall not constitute an offence.

(5) A data subject or other person affected by a legally binding decision of the Commission under Chapter 2 or 3 may, within 28 days from the date on which notice of the decision is received by him or her, appeal against the decision.

(6) The court, on hearing an appeal under subsection (5), shall—

(a) annul the decision concerned,

(b) substitute its own determination for the decision, or

(c) dismiss the appeal.

(7) Where the Commission, being the competent supervisory authority in respect of a complaint within the meaning of Chapter 2 or 3, does not comply with section 108(2) or, as the case may be, section 121(2), the complainant concerned may apply to the court for an order under subsection (8)(a).

(8) The court, on hearing an application under subsection (7), shall—

(a) order the Commission to comply with the provision concerned, or

(b) dismiss the application.

(9) The Circuit Court shall, concurrently with the High Court, have jurisdiction to hear and determine proceedings under this section.

(10) The jurisdiction conferred on the Circuit Court by this section shall be exercised by the judge for the time being assigned to the circuit where—

(a) in the case of an appeal under subsection (1), the controller or processor is established,

(b) in the case of an appeal under subsection (5), the data subject or other person resides or is established, or

(c) in the case of an application under subsection (7), the data subject resides,

or, at the option of the controller, processor, data subject or person concerned, by a judge of the Circuit Court for the time being assigned to the Dublin circuit.

(11) A decision of the Circuit Court or High Court, as the case may be, under this section shall be final save that an appeal shall lie to the High Court or Court of Appeal, as the case may be, on a point of law.

(12) For the purposes of this section, a “legally binding decision” means a decision—

F16[(a) under paragraph (a), (b) or (da) of section 109(5) or paragraph (a), (b) or (da) of section 122(4),]

F16[(b) under section 111(1)(a), 112(1), 113(2)(b) or (6)(aa), 114, 124(1)(a) or 125(1), or]

(c) to exercise a corrective power under Chapter 2 or 3.

151. (1) Where a controller or processor, when requested under this Part to produce information, or provide access to it, refuses to do so on the grounds that the information contains privileged legal material, the Commission or an authorised officer may, at any time within 28 days or such longer period as the High Court may allow of the date of such refusal, apply to the High Court for a determination as to whether the information, or any part of the information, is privileged legal material where—

(a) in relation to the information concerned—

(i) the Commission or authorised officer has reasonable grounds for believing that it is not privileged legal material, or

(ii) due to the manner or extent to which such information is presented together with any other information, it is impossible or impractical to extract only such information,

and

(b) the Commission or authorised officer has reasonable grounds to suspect that the information contains evidence relating to an infringement of a relevant enactment or a relevant provision.

(2) A controller or processor referred to in subsection (1) who refuses to produce information or provide access to it on the grounds that the information contains privileged legal material shall preserve the information and keep it in a safe and secure place and manner pending the determination of an application under subsection (1) and shall, if the information is so determined not to be privileged legal material, produce it in accordance with such order as the High Court considers appropriate.

(3) A person shall be considered to have complied with the requirement under subsection (2) to preserve information where the person has complied with such requirements as may be imposed by an authorised officer under paragraph (d) of section 130(1).

(4) Where an application is made by the Commission or an authorised officer under subsection (1), the High Court may give such interim or interlocutory directions as it considers appropriate including, without prejudice to the generality of the foregoing, directions as to the appointment of a person with suitable legal qualifications possessing the level of experience and independence from any interest falling to be determined between the parties concerned, that the Court considers to be appropriate for the purpose of—

(a) examining the information, and

(b) preparing a report for the Court with a view to assisting or facilitating the Court in the making of its determination as to whether the information is privileged legal material.

(5) An application under subsection (1) shall be by motion and may, if so directed, be heard otherwise than in public.

152. (1) The presumptions specified in this section shall apply in any proceedings under the Data Protection Regulation or this Act.

(2) Where a document purports to have been created by a person it shall be presumed, unless the contrary is shown, that the document was created by that person and that any statement or record contained in it, unless the document expressly attributes its making to some other person, was made by that person.

(3) Where a document purports to have been created by a person and addressed and sent to a second person, it shall be presumed, unless the contrary is shown, that the document or record was created and sent by the first person and received by the second person, and that any statement or record contained in it—

(a) unless the document or record expressly attributes its making to some other person, was made by the first person, and

(b) came to the notice of the second person.

(4) Where a document or record is retrieved from an electronic storage and retrieval system, it shall be presumed, unless the contrary is shown, that the author of the document is the person who ordinarily uses that electronic storage and retrieval system in the course of his or her business.

(5) Where an authorised officer who, in the exercise of his or her powers, has removed one or more documents or records from any premises or place, gives evidence in any proceedings that, to the best of his or her knowledge and belief, the material is the property of any person, then the material shall be presumed, unless the contrary is shown, to be the property of that person.

(6) Where, in accordance with subsection (5), material is presumed in proceedings to be the property of a person and the authorised officer concerned gives evidence that, to the best of his or her knowledge and belief, the material is material which relates to any trade, profession, or, as the case may be, other activity, carried on by that person, the material shall be presumed, unless the contrary is proved, to be material which relates to that trade, profession, or, as the case may be, other activity, carried on by that person.

(7) References in this section to a document or record are references to a document or record in written or electronic form and, for this purpose “written” includes any form of notation or code whether by hand or otherwise and regardless of the method by which, or medium in or on which, the document or record concerned is recorded.

153. (1) In any proceedings under the Data Protection Regulation or this Act, the opinion of any witness who appears to possess the appropriate qualifications or experience as respects the matter to which his or her evidence relates shall, subject to subsection (2), be admissible in evidence as regards any matter calling for expertise or special knowledge that is relevant to the proceedings and, in particular and without prejudice to the generality of the foregoing, the following matters, namely—

(a) the effects that types of data processing such as profiling may have, or have had, on the protection of personal data, and

(b) an explanation of any relevant practices or the application of such practice, where such an explanation would assist the proceedings.

(2) Notwithstanding subsection (1), a court may, where in its opinion the interests of justice require it to so direct in the proceedings concerned, direct that evidence of a general or specific kind referred to in that subsection shall not be admissible in proceedings or shall be admissible in such proceedings for specified purposes only.

154. Civil or criminal proceedings shall not lie in any court against the Commission, a Commissioner, an authorised officer or a member of the staff of the Commission in respect of anything said or done in good faith by the Commission, Commissioner, authorised officer or member of staff in the course of the performance or purported performance of a function of the Commission, Commissioner, authorised officer or member of staff.

155. An application under section 138(4), 142(1), 143(1) or paragraph 5 of Schedule 3 shall be made to a judge of that Court for the circuit in which the person to whom the application relates ordinarily resides or, if a controller or processor, has an establishment or, at the option of the person, by a judge of the Circuit Court for the time being assigned to the Dublin circuit.

156. The whole or any part of any proceedings under this Part may, at the discretion of the court, be heard otherwise than in public.