Data Protected - Ireland
Contributed by Mason Hayes & Curran
Last updated August 2022
General | Data Protection Laws
National Legislation
National Supervisory Authority
Scope of Application
Personal Data
Sensitive Personal Data
Data Protection Officers
Accountability and Privacy Impact Assessments
Rights of Data Subjects
Security
Transfer of Personal Data to Third Countries
Enforcement
ePrivacy | Marketing and cookies
National Legislation
Cookies
Marketing by E-mail
Marketing by Telephone
_____________________________________________________________________
General | Data Protection Laws
____________________________________________________________
National Legislation
General data protection laws
The General Data Protection Regulation (EU) (2016/679) (“GDPR”).
The GDPR is primarily implemented through the Data Protection Act 2018, but the provisions in the Data Protection Acts 1988 and 2003 relating to complaints by individuals or investigations commenced prior to 25 May 2018 also remain in force.
Entry into force
The GDPR has applied since 25 May 2018.
The majority of the provisions of the Data Protection Act 2018 came into force on 25 May 2018.
_____________________________________________________________________ Top
National Supervisory Authority
Details of the competent national supervisory authority
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2 D02 RD28
Ireland
And
Canal House
Station Road
Portarlington
County Laois R32 AP23
Ireland
The DPC represents Ireland on the European Data Protection Board.
Notification or registration scheme and timing
There is no obligation to notify regulators of any processing under the GDPR. However, controllers and processors must keep a record of their processing and make it available to their supervisory authority on request (subject to limited exemptions).
Exemptions to notification
Not applicable.
_____________________________________________________________________Top
Scope of Application
What is the territorial scope of application?
The GDPR applies to the processing of personal data in the context of the establishment of a controller or processor in the EU.
It also contains express extra-territorial provisions and will apply to controllers or processors based outside the EU that: (i) offer goods or services to individuals in the EU; or (ii) monitor individuals within the EU. Controllers and processors caught by these provisions will need to appoint a representative in the EU, subject to certain limited exemptions.
The European Data Protection Board has issued Guidelines on the territorial scope of the GDPR (3/2018).
Is there a concept of a controller and processor?
Yes. The GDPR contains the concept of a controller, who determines the purpose and means of processing, and a processor, who just processes personal data on behalf of the controller.
The European Data Protection Board has issued Guidelines on the concepts of controller and processor in the GDPR (7/2020).
Both controllers and processors are subject to the rules in the GDPR, but the obligations placed on processors are more limited.
Are both manual and electronic records subject to data protection legislation?
Yes. The GDPR applies to both electronic records and structured hard copy records.
Are there any national derogations?
The GDPR does not apply to law enforcement activities which are instead subject to the Law Enforcement Directive. The GDPR also does not apply to areas of law that are outside the scope of Union law, such as national security, and does not apply to purely personal or household activity.
The Data Protection Act 2018 includes certain derogations, such as from specified data subject rights. It also provides broad ministerial powers to restrict organisations’ obligations and individuals’ rights via statutory regulations, in so far as is necessary to safeguard important objectives of general public interest.
Part V of the Data Protection Act 2018 implements the Law Enforcement Directive, though these provisions are outside the scope of this summary. The Data Protection Acts 1988 and 2003 also contain provisions relevant to national security and the international relations of the State, but, again, these are outside the scope of this summary.
_____________________________________________________________________Top
Personal Data
What is personal data?
Personal data is information relating to an identified or identifiable natural person.
This is a broad term and includes a wide range of information. The GDPR expressly states it includes online identifiers such as cookies.
Is information about legal entities personal data?
No. However, information about sole traders and partnerships is likely to be personal data.
What are the rules for processing personal data?
All processing of personal data must comply with all six general data quality principles. Personal data must be: (i) processed fairly, lawfully and transparently; (ii) collected for specific, explicit and legitimate purposes and not processed in a manner incompatible with those purposes; (iii) adequate, relevant and not excessive; (iv) accurate and, where necessary, up to date; (v) kept in an identifiable form for no longer than necessary; and (vi) kept secure.
The processing of personal data must also satisfy at least one condition for processing personal data. These conditions are that the processing is: (a) carried out with the data subject’s consent; (b) necessary for the performance of a contract with the data subject; (c) necessary for compliance with a legal obligation; (d) necessary in order to protect the vital interests of the data subject; (e) necessary for the public interest or in the exercise of official authority; or (f) necessary for the controller’s or a third party's legitimate interests, except where overridden by the interests or fundamental rights and freedoms of the data subject.
These rules are almost identical to the core requirements for processing personal data in the old Data Protection Directive. The European Data Protection Board has issued Guidelines on the performance of a contract processing condition for online services (2/2019).
Are there any formalities to obtain consent to process personal data?
The requirements for consent under the GDPR are strict.
To be valid, consent must be in clear and plain language and, where sought in writing, separate from other matters. Consent must be based on affirmative action so pre-ticked boxes are not acceptable. Consent might not be valid if: (i) there is any detriment to the data subject for refusing; (ii) there is an imbalance of power; (iii) consent for multiple purposes is bundled together; or (iv) the consent is a condition of entering into a contract. Finally, consent can be withdrawn at any time.
In practice, other processing conditions should be relied on where possible. Consent will only be an appropriate processing condition if the individual has a genuine choice over the matter, for example, whether to be sent marketing materials.
The European Data Protection Board has issued Guidelines on consent (5/2020).
Are there any special rules when processing personal data about children?
Consent from a child in relation to online services will only be valid if authorised by a parent. A child is someone under 16 years old, though Member States may reduce this age to 13.
Ireland has left the age of digital consent under the GDPR at 16.
However, the Data Protection Act 2018 contains other provisions protecting children and, in that context, a child is a person under 18. In particular: (i) there is a specific right to be forgotten for children with respect to personal data collected in relation to the offer to the child of information society services; and (ii) it is an offence for any company or corporate body to process the personal data of a child for the purposes of direct marketing, profiling or micro-targeting. However, this provision has not been commenced and is unlikely to ever be commenced due to perceived issues regarding its compatibility with the GDPR.
The DPC has published child-specific data protection interpretative principles and recommended measures with the purpose of enhancing the level of protection afforded to children against the data processing risks posed to them by their use of, and access to, services in both an online and offline world (DPC Fundamentals).
Are there any special rules when processing personal data about employees?
The GDPR allows Member States to implement more specific national rules governing the processing of personal data about employees. It may also be possible to process special category personal data where it is necessary for a legal obligation in the field of employment law.
The Data Protection Act 2018 provides that the processing of special categories of personal data is lawful where the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the controller or the data subject in connection with employment, provided “suitable and specific measures” are taken to safeguard the fundamental rights and freedoms of data subjects.
The Data Protection Act 2018 contains a “toolbox” of suitable and specific measures that organisations may employ when processing special categories of personal data. These measures are not mandatory but are examples of safeguarding measures to be implemented.
The Data Protection Act 2018 also provides that the processing of special categories of personal data shall be lawful where it is necessary for the assessment of the working capacity of an employee. This is provided again that “suitable and specific measures” are taken and that the processing is undertaken by or under the responsibility of a health practitioner (as defined in the Health Identifiers Act 2014) or a person who owes an equivalent duty of confidentiality to the data subject. It also includes a prohibition on enforced access requests in the connection with employment, though this provision has not yet been commenced.
_____________________________________________________________________ Top
Sensitive Personal Data
What is sensitive personal data?
Special category data is personal data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation. The decision in OT (C-184/20) might suggest this should be interpreted broadly to include publication of information that indirectly discloses these characteristics.
The inclusion of genetic and biometric data is new and an extension to the types of sensitive personal data in the Data Protection Directive.
Information about criminal offences is dealt with separately and is subject to even tighter controls.
Are there additional rules for processing sensitive personal data?
Special category data may only be processed if a condition for processing special category data is satisfied. A condition arises where the processing: (a) is carried out with the data subject’s explicit consent; (b) is necessary for a legal obligation in the fields of employment, social security and social protection law; (c) is necessary to protect the vital interests of the data subject or another person where the data subject is unable to give consent; (d) is carried out by a non-profit-seeking body and relates to members of that body or persons who have regular contact; (e) relates to data made public by the data subject; (f) is necessary for legal claims; (g) is for reasons of substantial public interest under EU or Member State law; (h) is necessary for healthcare reasons; (i) is necessary for public health reasons; or (j) is necessary for archiving, scientific or historical research purposes or statistical purposes and is based on EU or Member State law.
The Data Protection Act 2018 provides that special categories of personal data may be processed in various specific circumstances provided, in most cases, that “suitable and specific measures” are in place to safeguard the fundamental rights and freedoms of the data subject.
These include processing: (i) by elected representatives to perform their functions; (ii) on the basis of a legal obligation on the controller or the data subject in connection with employment or social welfare law; (iii) for the purposes of legal advice, legal proceedings or establishing, exercising or defending legal rights; (iv) in the course of electoral activities by political parties, candidates and holders of public office; (v) for the administration of justice or the performance of a function conferred on a person by enactment or the Constitution; (vi) that is necessary and proportionate for insurance and life assurance policies, pensions or mortgages; (vii) for health or social care purposes; (vii) for public health, including ensuring high standards of quality and safety of health care and of medicinal products and medical devices; and (viii) for archiving, scientific, historical or statistical purposes.
The Data Protection Act 2018 contains a “toolbox” of suitable and specific measures that organisations may employ when processing special categories of personal data. These measures are not mandatory but are examples of safeguarding measures to be implemented.
Provision is also made for the introduction of regulations permitting the processing of special categories of personal data for reasons of substantial public interest.
Are there additional rules for processing information about criminal offences?
It is only possible to process personal data relating to criminal convictions or offences if: (a) it is carried out under the control of official authority; or (b) when the processing is authorised by EU or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.
The Data Protection Act 2018 provides that, subject to “suitable and specific measures” being taken to safeguard the fundamental rights and freedoms of the data subject (and without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016), personal data relating to criminal convictions or offences may be processed where: (i) the data subject has given explicit consent (unless such processing is prohibited by law); (ii) the processing is necessary and proportionate for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; (iii) the processing is necessary for the purposes of legal advice, legal proceedings or establishing, exercising or defending legal rights; (iv) the processing is necessary to prevent injury or other damage to the data subject or another person or loss in respect of, or damage to, property or otherwise to protect the vital interests of the data subject or another person; or (v) processing is otherwise authorised by the law of the State.
Processing is also permitted under the control of official authorities, including processing required for: (i) the administration of justice; (ii) the exercise of a regulatory, authorising or licensing function or determination of eligibility for benefits or services; (iii) protection of the public against harm arising from dishonesty, malpractice, breaches of ethics or other improper conduct by, or the unfitness or incompetence of, persons who are or were authorised to carry on a profession or other activity; (iv) enforcement actions aimed at preventing, detecting or investigating breaches of the law of the European Union or the law of the State that are subject to civil or administrative sanctions; or (v) archiving in the public interest, scientific or historical research purposes or statistical purposes in certain cases.
Provision is also made for the introduction of regulations permitting the processing of personal data relating to criminal convictions or offences for reasons of substantial public interest or in certain cases such as to: (i) assess the risk of, or prevent, fraud; (ii) assess the risk of, or prevent, bribery or corruption; or (iii) ensure network and information system security, and prevent attacks on and damage to computer and electronic communications systems.
The Data Protection Act 2018 contains a “toolbox” of suitable and specific measures that organisations may employ when processing personal data relating to criminal convictions or offences. These measures are not mandatory but are examples of safeguarding measures to be implemented.
Personal data relating to criminal convictions or offences includes, for these purposes, personal data relating to the alleged commission of an offence and any proceedings in relation to such an offence.
Are there any formalities to obtain consent to process sensitive personal data?
Consent to process sensitive personal data must be explicit. The general restrictions on consent, set out above, will also apply. This suggests a degree of formality, such as ticking a box containing the express words “I consent”. It is unlikely explicit consent could be obtained through a course of conduct.
_____________________________________________________________________ Top
Data Protection Officers
When must a data protection officer be appointed?
Both controllers and processors must appoint a data protection officer if: (i) they are a public authority; (ii) their core activities consist of regular and systematic monitoring of data subjects on a large scale; or (iii) their core activities consist of processing special category personal data on a large scale (including processing information about criminal offences).
There are currently no additional circumstances where a data protection officer must be appointed (except with respect to ‘competent authorities’ under the implementation of the Law Enforcement Directive), though provision is made to introduce regulations requiring appointment in additional cases in the future.
The designation of a DPO in cases where it is not mandatory will be taken into account as a “suitable and specific measure” to safeguard the fundamental rights and freedoms of data subjects in processing their personal data.
What are the duties of the data protection officer?
The data protection officer must be involved in all data protection issues and cannot be dismissed or penalised for performing their role. The data protection officer must report directly to the highest level of management. Details of the data protection officer must be communicated to the relevant supervisory authority.
The Article 29 Working Party has issued Guidelines on Data Protection Officers (WP243).
The Irish DPC has issued Guidance on Appropriate Qualifications for a Data Protection Officer (GDPR).
_____________________________________________________________________ Top
Accountability and Privacy Impact Assessments
Is there a general accountability obligation?
The GDPR adds a new general accountability obligation under which you must not only comply with these new rules, but also be able to demonstrate you comply with them. This means ensuring suitable policies are in place supported by audit and training.
Are privacy impact assessments mandatory?
A privacy impact assessment must be conducted where “high risk” processing is carried out. This includes: (a) systematic and extensive profiling that produces legal effects or significantly affects individuals; (b) processing on a large scale either special categories of personal data or personal data relating to criminal convictions and offences; and (c) systematic monitoring of a publicly accessible area on a large scale (e.g. CCTV). Where the assessment indicates the risk cannot be mitigated, the controller must consult the relevant supervisory authority.
The Article 29 Working Party has subsequently issued Guidelines on Data Protection Impact Assessments (WP 248). It suggests there are nine criteria to consider to determine whether to conduct a privacy impact assessment, and that an assessment should be made if two or more of those criteria are met. This is arguably wider than the criteria set out in the paragraph above.
The DPC has the power under the GDPR to draw up a list of processing operations which are, or are not, subject to a data protection impact assessment. The DPC has specified in its Guide to Data Protection Impact Assessments (DPIAs) (2019) that a DPIA is mandatory in the following situations (in addition to the situations outlined above): (i) use of personal data on a large-scale for a purpose(s) other than that for which it was initially collected; (ii) profiling vulnerable persons including children to target marketing or online services at such persons; (iii) use of profiling or algorithmic means or special category data as an element to determine access to services or that results in legal or similarly significant effects; (iv) systematically monitoring, tracking or observing individuals’ location or behaviour; (v) profiling individuals on a large-scale; (vi) processing biometric data to uniquely identify an individual or individuals or enable or allow the identification or authentication of an individual or individuals in combination with any of the other criteria set out in WP29 DPIA Guidelines; (vii) processing genetic data in combination with any of the other criteria set out in WP29 DPIA Guidelines; (viii) indirectly sourcing personal data where GDPR transparency requirements are not being met, including when relying on exemptions based on impossibility or disproportionate effort; (ix) combining, linking or cross-referencing separate datasets where such linking significantly contributes to or is used for profiling or behavioural analysis of individuals, particularly where the data sets are combined from different sources where processing was/is carried out for different purposes or by different controllers; and (x) large scale processing of personal data where the Data Protection Act 2018 requires “suitable and specific measures” to be taken in order to safeguard the fundamental rights and freedoms of individuals.
The DPC states that a DPIA is not required where in some cases, including where: (i) the processing operations do not result in a high risk to the rights and freedoms of individuals; (ii) the nature, scope, context and purposes of the processing are very similar to the processing for which DPIAs have been carried out - in such cases, results of a DPIA for similar processing can be used; (iii) the processing is included on the optional list (established by the supervisory authority) of processing operations for which no DPIA is required; and (iv) a processing operation has a legal basis in EU or Member State law, where the law regulates the specific processing operation and where a general impact assessment, according to the standards of the GDPR, has already been carried out in the context of the adoption of that legal basis.
_____________________________________________________________________ Top
Rights of Data Subjects
Privacy notices
A controller must provide data subjects with a privacy notice setting out how the individual’s personal data will be processed. The privacy notice must contain the enhanced transparency information.
The Article 29 Working Party has issued Guidelines on Transparency (WP260).
In Ireland, there is no express obligation to provide this information in English, though it may be difficult to show that the information has been fairly provided if it is not in a language that the data subject is familiar with.
Rights to access information
Data subjects will have a right to access copies of their personal data by making a written request to the controller. The initial request is free, though a charge can be made for subsequent requests. Controllers can refuse the request if it is manifestly unfounded or excessive. The right to obtain a copy of personal data should not adversely affect the rights and freedoms of others. The response must be provided within a month, though this can be extended by two months if the request is complex.
The European Data Protection Board has issued Guidelines on rights of access (1/2022).
The Data Protection Act 2018 includes a number of exceptions to the right of access pursuant to Article 23 GDPR. The DPC has also published a guidance note on Data Subject Access Requests - FAQs.
Rights to data portability
Data subjects will also have a right to data portability where the condition for processing personal data is consent or the performance of a contract. It entitles individuals to obtain any personal data they have “provided” to the controller in a machine-readable format. Individuals can also ask for the data to be transferred directly from one controller to another. There is no right to charge fees for this service.
The Article 29 Working Party has issued Guidelines on data portability (WP242).
Right to be forgotten
A data subject can ask that their data be deleted in certain circumstances. However, those circumstances are relatively limited, for example where the processing is based on consent, that consent is withdrawn and there are no other grounds for processing. Even where the right does arise, there are a range of exemptions, for example where there is a legal obligation to retain the data.
The European Data Protection Board has issued Guidelines on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) (5/2019).
The Data Protection Act 2018 includes a specific right to be forgotten for children with respect to personal data collected in relation to the offer to the child of information society services.
Objection to direct marketing
A data subject can object to their personal data being processed for direct marketing purposes at any time. This includes profiling to the extent related to direct marketing.
Other rights
The GDPR contains a range of other rights, including a right to have inaccurate data corrected. There is also a right to object to processing being carried out in the performance of a public task or under the legitimate interests condition.
Finally, there are controls on taking decisions based solely on automated decision making that produce legal effects or similarly significantly affects the data subject. The Article 29 Working Party has issued Guidelines on Automated Decision Making and Profiling (WP251).
_____________________________________________________________________ Top
Security
Security requirements in order to protect personal data
The GDPR contains a general obligation to implement appropriate technical and organisational measures to protect personal data.
In addition, controllers and processors must ensure, where appropriate: (i) the pseudonymisation and encryption of personal data; (ii) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of its information technology systems; (iii) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (iv) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Specific rules governing processing by third party agents (processors)
A controller must ensure that any processor it instructs will ensure adequate security for personal data and otherwise meet the requirements of the GDPR.
The controller must have written contracts with its processor containing the enhanced processor clauses.
Notice of breach laws
A personal data breach must be notified to the relevant supervisory authority unless it is unlikely to result in a risk to data subjects. The notification must, where feasible, be made within 72 hours. If the personal data breach is a high risk for data subjects, those data subjects must also be notified.
Specific notice of breach laws apply to the electronic communications sector under national laws implementing the Privacy and Electronic Communications Directive and to operators of essential services and digital service providers under national laws implementing the Network and Information Systems Directive.
The European Data Protection Board has issued Guidelines on Personal Data Breach Notification (9/2022) and Examples regarding Personal Data Breach Notification (1/2021).
The DPC has also published A Practical Guide to Personal Data Breach Notifications under the GDPR (2019).
Controllers in certain sectors may be required to inform sectoral regulators of any breach. For example, financial services firms may be required to inform the Central Bank of Ireland in certain cases. The DPC has specific forms, and risk rating requirements, for personal data breach notifications.
_____________________________________________________________________ Top
Transfer of Personal Data to Third Countries
Restrictions on transfers to third countries
The GDPR contains a restriction on transborder dataflows. This restriction does not apply if the transfer is to a whitelisted country.
Transfers can be made: (i) pursuant to a set of Standard Contractual Clauses; (ii) pursuant to binding corporate rules; (iii) to an importer who has signed up to an approved code or obtained an approved certification; or (iv) where otherwise approved by the relevant supervisory authority. However, following the decision in Schrems II (C-311/18) any transfer made on this basis must be subject to a transfer impact assessment of the laws of the relevant third country and supplemented by supplementary protections where necessary.
The European Data Protection Board has issued Recommendation on European Essential Guarantees for surveillance measures (2/2020) and a Recommendation on measures that supplement transfer tools (1/2020) to help conduct this transfer impact assessment. The European Commission has also issued an FAQ on the new Standard Contractual Clauses.
Transfers are also possible if an individual derogation applies. These derogations allow a transfer if it: (i) is made with the data subject’s explicit consent; (ii) is necessary for the performance of a contract with, or in the interests of, the data subject; (iii) is necessary or legally required on important public interest grounds, or for legal claims; (iv) is necessary to protect the vital interests of the data subject; (v) is made from a public register; or (vi) is made under the so-called minor transfer exemption.
The European Data Protection Board has issued Guidelines on derogations applicable to international transfers (2/2018). Finally, the European Data Protection Board has issued draft Guidelines on the interplay between Article 3 and international transfers (2/2018) to help identify when a transfer takes place.
Notification and approval of national regulator (including notification of use of Standard Contractual Clauses)
In general, there is no need for prior approval from a supervisory authority. However, this depends on the justification for the transfer.
For example, there will be no obligation to get approval for the use of Standard Contractual Clauses (though it is possible some supervisory authorities may want to be notified of their use). In contrast, it will be necessary to get approval to rely on binding corporate rules, and the supervisory authority must be informed of transfers made using the minor transfers exemption.
Use of binding corporate rules
The GDPR places binding corporate rules on a statutory footing. It will be possible to obtain authorisation from one supervisory authority (subject to approval through the consistency mechanism) that will cover transfers from anywhere in the EU.
The DPC has published a List of approved BCRs for which the DPC is Lead Supervisory Authority.
_____________________________________________________________________ Top
Enforcement
Fines
The GDPR is intended to make data protection a boardroom issue. It introduces an antitrust-type sanction regime with fines of up to 4% of annual worldwide turnover or €20m, whichever is the greater. These fines apply to breaches of many of the provisions of the GDPR, including failure to comply with the six general data quality principles or carrying out processing without satisfying a condition for processing personal data.
A limited number of breaches fall into a lower tier and so are subject to fines of up to 2% of annual worldwide turnover or €10m, whichever is the greater. Failing to notify a personal data breach or failing to put an adequate contract in place with a processor fall into this lower tier.
Fines can only be imposed where there is an intentional or negligent infringement of the GDPR, see Deutsche Wohnen (C-807/21).
The EDPB has published Guidelines on the calculation of administrative fines (04/2022).
Imprisonment
It is an offence under the Data Protection Act 2018 for a processor or an employee or agent of the processor to knowingly or recklessly disclose personal data without the prior authority of the controller. It is also an offence for a person to obtain, disclose, sell or offer to sell personal data without the authority of the controller or processor. Both of the above offences do not apply if the disclosure was made pursuant to any enactment, rule of law or order of a court. Breach can result in a range of sanctions, including imprisonment for up to five years.
It is also an offence to: (i) knowingly or recklessly process personal data relating to criminal offences contrary to certain provisions in the Data Protection Act 2018; (ii) fail to comply with investigations by the DPC; and (iii) obstruct or impede the provision of, or provide false or misleading information in connection with, reports required to be submitted to the DPC.
It is also an offence to process the personal data of a child for the purposes of direct marketing, profiling or micro-targeting. However, this provision has not been commenced and is unlikely to ever be commenced due to perceived issues regarding its compatibility with the GDPR.
Where such a criminal offence is the result of the consent, connivance or neglect of a director, manager, secretary or other officer of the company, that person is also guilty of the offence.
Where a person is convicted of an offence under the Data Protection Act 2018, the court may order any personal data that appears to the court to be connected with the commission of the offence to be destroyed or erased.
Where a person is convicted of an offence under the Data Protection Act 2018, the court may order the person to pay the costs and expenses incurred by the DPC in relation to the investigation, detection and prosecution of the offence.
Compensation
Data subjects have a right to compensation in respect of material and non-material damage. This requires more than a mere infringement of the GDPR and there must be actual material or non-material damage, however there is no minimum threshold of seriousness before compensation is available, see Österreichische Post (C-300/21).
Other powers
Regulators will have a range of other powers and sanctions at their disposal. This includes investigative powers, such as the ability to demand information from controllers and processors, and to carry out audits. They will also have corrective powers enabling them to issue warnings or reprimands, to enforce an individual’s rights and to issue a temporary or permanent ban on processing.
Practice
Fines: The most significant fines issued by the DPC are set out below:
- WhatsApp Ireland Limited was fined €225m in total in September 2021 in relation to the principle of transparency. This fine is currently under appeal.
- Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) was fined €17m in March 2022 in relation to a number of security incidents.
- Bank of Ireland was fined €463,000 in April 2022. The bank self-reported 22 data breaches to the DPC. The DPC’s investigation found that the bank had supplied false information to the Central Credit Register due to errors in managing bank customers’ account data and that Bank of Ireland did not have adequate technical and organisational measures, and did not immediately report the breach to the DPC.
Other enforcement action:
The DPC received 10,888 queries and complaints from individuals in 2021 (an increase of 7% on 2020 figures) of which 8,017 had been concluded to by year-end. In total 10,645 cases - 7,081 queries and 3,564 complaints - were concluded by the DPC in 2021. As with previous years, the largest category remained complaints concerning subject access rights.
While the majority of complaints were amicably resolved, the DPC issued a total of 31 formal decisions under the Data Protection Acts 1988 & 2003. Of these, 16 upheld the complaint and 9 rejected the complaint. In 2021, The DPC issued five decisions on foot of statutory inquiries under the Data Protection Act 2018. On 31 December 2021, the DPC had 81 statutory inquiries on hand, including 30 cross-border inquiries.
In 2021, 1,150 valid cross-border processing complaints were received by the DPC through the One-Stop-Shop mechanism that were lodged by individuals with other EU data protection authorities.
6,549 valid data breaches were recorded, representing a 2% decrease (114) on the numbers reported in 2020, with the largest single category being “Unauthorised Disclosures”.
The DPC frequently issues guidance notes which seek to confer clarity on a number of different data protection issues. The guidance notes are available at www.dataprotection.ie.
_____________________________________________________________________ Top
ePrivacy | Marketing and cookies
_____________________________________________________________
National Legislation
ePrivacy laws
The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (the “2011 Regulations”) implemented Article 13 (Unsolicited Communications) of the Privacy and Electronic Communications Directive. These regulations came into effect on 1 July 2011. One can be indicted under the 2011 Regulations for sending unsolicited electronic direct marketing communications. The penalty for a body corporate on conviction on indictment can be up to EUR 250,000. Where the person tried on indictment is a natural person, the fine imposed may not exceed EUR 50,000.
_____________________________________________________________________ Top
Cookies
Conditions for use of cookies
Consent is needed for the use of cookies unless the cookie is strictly necessary for the provision of a service to that subscriber or user. The 2011 Regulations expressly refer to the use of browser settings as a means to obtain consent. There is no express requirement for consent to be “prior” to the use of a cookie, though the legislation probably requires this.
Regulatory guidance on the use of cookies
The DPC has provided a guidance note on cookies and other tracking technologies which was updated in April 2020.
_____________________________________________________________________ Top
Marketing by E-mail
Conditions for direct marketing by e-mail to individual subscribers
The prior consent of subscribers is required before marketing to those individuals by e-mail.
Conditions for direct marketing by e-mail to corporate subscribers
The sending of unsolicited e-mail to corporate subscribers that are not customers for the purpose of direct marketing is permitted unless the subscriber has informed the sender that it does not consent to the receipt of such messages.
Exemptions and other issues
It is permitted to use a customer’s e-mail contact details if the similar products and services exemption applies. The 2011 Regulations also prohibit direct marketing e-mails from being sent if: (i) the identity of the sender is disguised or concealed; or (ii) an opt-out address is not provided.
The sender must also include the eCommerce information.
_____________________________________________________________________ Top
Marketing by Telephone
Conditions for direct marketing by telephone to individual subscribers (excludes automated calls)
Direct marketing calls to landline telephones may be made to an individual subscriber provided the subscriber has not previously objected to receiving such calls or noted his preference not to receive direct marketing calls in the National Directory Database.
Direct marketing calls to a mobile telephone may only be made where the subscriber: (i) has consented to the receipt of such calls on his or her mobile telephone; or (ii) has consented generally to marketing calls and that such consent is recorded in the National Directory Database in respect of his or her mobile telephone number.
Conditions for direct marketing by telephone to corporate subscribers (excludes automated calls)
Direct marketing calls may be made to a corporate subscriber provided the corporate subscriber has not previously objected to receiving such calls. It is not permitted to make direct marketing calls to a corporate subscriber if that corporate subscriber has noted a preference not to receive direct marketing calls in the National Directory Database.
Exemptions and other issues
No exemptions apply.
_____________________________________________________________________ Top