The Data Protection Act - Key Points

1. The Data Protection Act – What you need to know
© Eamonn O’Raghallaigh 2010
TABLE OF CONTENTS
INTRODUCTION .......................................................................................................................... 2
THE RIGHT TO PRIVACY ........................................................................................................... 2
THE DATA PROTECTION ACTS, 1998 AND 2003 .................................................................... 3
Key Definitions of the Act.......................................................................................................... 3
Obligations under the Act ......................................................................................................... 5
Principles Relating to Obtaining and Processing Personal Data .............................................. 6
RIGHTS OF DATA SUBJECTS ................................................................................................... 7
Right to Access ......................................................................................................................... 7
Case Study: Failure to comply with an access request ........................................................ 8
Right ot be Informed of Data Being Kept .................................................................................. 9
Right to prevent data being used for the purposes of direct marketing .................................. 10
Right of blocking or erasure .................................................................................................... 10
Right to prevent processing where it might cause damage or distress .................................. 10
DATA PROTECTION AND ELECTRONIC COMMUNICATIONS ............................................. 10
Case Study: Opera Telecom: Forced to delete database ....................................................... 11
DATA PROTECTION AND CCTV.............................................................................................. 12
Case Study: Gresham Hotel breaches DP law in regard to use of covert CCTV footage ...... 13
REMEDIES ................................................................................................................................. 14
REFERENCES ........................................................................................................................... 14

2. INTRODUCTION
The securitisation of personal data and the protection of the rights of individuals whose
personal data is stored has become an important issue in the current knowledge-based
society. The storage of personal data is now ubiquitous, whether it is by service companies,
governmental agencies and departments, telecoms providers, internet service providers or
retail organizations. The potential for abuse and misuse of personal data is significant, hence
the existence of legislation in Ireland to protect this data and the rights of individuals whose
data is stored by third parties. Two acts of the Oireachtas were enacted for the purpose of
protection, namely the Data Protection Act 1988, and the Data Protection (Amendment) Act
2003.
The Data Protection Act 1988 is “an act to give effect to the convention for the protection of
individuals with regard to automatic processing of personal data done at Strasbourg on the
28th day of January, 1981, and for that purpose to regulate in accordance with its provisions
the collection, processing, keeping, use and disclosure of certain information relating to
individuals that is processed automatically.” The 1998 Act was amended in 2003 to bring it
in line with EU Directive 95/46/EC and it is “an act to give effect to directive 95/46/EC of the
European parliament and of the council of 24 October 1995 on the protection of individuals
with regard to the processing of personal data and on the free movement of such data, for
that purpose to amend the data protection act 1988 and to provide for related matters.”
(www.irishstatutebook.ie)
THE RIGHT TO PRIVACY
Data Protection relates to every citizen’s fundamental right to privacy. Although this right
was not set out in the Irish Constitution of 1937, it has been recognized by the courts. The
right to privacy was discovered in an Irish context in McGee v Attorney General [1974] IR
284 and most notably recognized by the High Court in Kennedy & Arnold v Ireland [1987]
IR 587. The former case was argued with the Unenumerated Rights Doctrine, and although
the constitution does not specifically set out a specific right to privacy, it is a right that was

3. established by the Christian and democratic nature of the state. The court stated that “The
right to privacy is one of the fundamental personal rights of the citizen which flow from the
Christian and democratic nature of the State… The nature of the right to privacy is such that
it must ensure the dignity and freedom of the individual in a democratic society. This cannot
be insured if his private communications, whether written or telephonic, are deliberately
and unjustifiably interfered with.”
The right to privacy was enacted into Irish Domestic law in The European Convention on
Human Rights Act 2003 which incorporated the European Convention on Human Rights.
Article 8 of the European Convention on Human Rights provides that: “Everyone has the
right to respect for his private and family life, his home and correspondence.”
THE DATA PROTECTION ACTS, 1998 AND 2003
Key Definitions of the Act
a. Automated Data means information that is processed by means of equipment
operating automatically in response to instructions given for that purpose or is
recorded with the intention that is should be processed by means of such
equipment.
b. Manual data means information that is recorded as part of a relevant filing
system or with the intention that it should form part of a relevant filing
system.
c. Relevant filing system means any set of information relating to individuals to
the extent that, although the information is not processed by means of
equipment operating automatically in response to instructions given for that
purpose, the set is structured, either by reference to individuals or by
reference to criteria relating to individuals, in such a way that specific
information relating to a particular individual is readily accessible;
d. Personal data means data relating to a living individual who is or can be
identified either from the data or from the data in conjunction with other

4. information that is in, or is likely to come into, the possession of the data
controller.
e. Sensitive personal data means personal data as to –
i. the racial or ethnic origin, the political opinions or the religious or
philosophical beliefs of the data subject,
ii. whether the data subject is a member of a trade union,
iii. the physical or mental health or condition or sexual life of the data
subject,
iv. the commission or alleged commission of any offence by the data
subject, or
v. any proceedings for an offence committed or alleged to have been
committed by the data subject, the disposal of such proceedings or the
sentence of any court in such proceedings.
f. Data subject is an individual who is the subject of personal data.
g. Data controller is a person who (either alone or with others) controls the
contents and use of personal data.
h. Data processor is a person who processes personal data on behalf of a data
controller but does not include an employee of a data controller who processes
such data in the course of his employment.
i. Disclosure – in relation to personal data, includes the disclosure of information
extracted from such data and the transfer of such data but does not include a
disclosure made directly or indirectly by a data controller or a data processor
to an employee or agent of his for the purpose of enabling the employee or
agent to carry out his duties; and, where the identification of a data subject
depends partly on the data and partly on other information in the possession
of the data controller, the data shall not be regarded as disclosed unless the
other information is also disclosed.
j. Processing, of or in relation to information or data, means performing any
operation or set of operations on the information or data, whether or not by
automatic means, including –
i. obtaining, recording or keeping the information or data

5. ii. collecting, organizing, storing, altering or adapting the information or
data,
iii. retrieving, consulting or using the information or data,
iv. disclosing the information or data by transmitting, disseminating or
otherwise making it available, or,
v. aligning, combining, blocking, erasing or destroying the information
or data, and, cognate words shall be construed accordingly;
(www.irishstatutebook.ie)
Obligations under the Act
The purpose of the Data Protection Act (DPA) is to protect against the invasion of privacy of
personal information. The Data Controller (i.e. the person who controls the content and use
of personal data) holds the responsibilities under the Act. A data processor is distinct; they
are a person who possesses data on behalf of a data controller, but does not include an
employee of the data controller.
The DPA does not apply to data:
a. Which in the opinion of the Minister is kept for safeguarding the security of the
State
b. Information which must legally be made public
c. Information which is kept only for the purpose of managing personal or household
affairs
d. Information kept for recreational purposes
e. Information kept solely for historical research, e.g. archives
Jurisdiction: A data controller will be subject to this legislation only if the data controller is
established in the State and the data is processed in the context of that establishment. There
are special provisions for the telecommunication of data within the European Union and the
European Economic Area. However, the Act will apply outside of that area if the
establishment uses equipment in the state for processing other than for the purpose of transit

6. through the territory of the state. Establishments deemed to be established in the State
include:
a. individuals normally resident in the State
b. a body incorporated under the law of the State
c. a partnership or other unincorporated association formed under the law of the State,
and
d. a person who does not fall within subparagraphs a, b and c of this paragraph, but
maintains in the State –
i. an office, branch or agency through which he or she carries on any
activity, or
ii. a regular practice (www.irishstatutebook.ie)
Principles Relating to Obtaining and Processing Personal Data
The DPA represents a code of practice and ethics which relates to the collection, processing
and storage of personal data in a fair and just manner. The main principles are as follows:
a. Data must be obtained and processed fairly – A certain degree of transparency is
required with relation the data’s collection and processing. Where the data is
obtained from the subject directly then the data controller must make his identity
known, as far as is practicable.
b. Data must not be disclosed or processed in a manner for which the data is not
intended for – There is an onus on the Data Controller to ensure that no unlawful
processing occurs
c. Data must be only kept for one or more specified lawful purpose - the data obtained
should be relevant but must also be adequate although not excessive for the purpose
for which it was obtained
d. Data must be kept safe and secure – This is an onus on the data controller to prevent
unauthorised access to subject’s personal data.
e. Data must be kept up to date and accurate – There is a clear duty to ensure the data is
complete, accurate and up-to-date; this is intended to prevent misleading information
being held or misrepresentation of the data subject.

7. f. Data must be only kept for as long as is necessary
g. A copy of the personal data must be given to the individual it pertains to on request
There are special provisions made under the Act with regard to the processing of Sensitive
Personal Data; this data is subject to tighter control and all Data Controllers of such data
must be registered with the data commissioner. This is a particularly high duty to maintain
the privacy and security of data relating to:
a. the racial or ethnic origin, the political opinions or the religious or philosophical
beliefs of the data subject
b. whether the data subject is a member of a trade union,
c. the physical or mental health or condition or sexual life of the data subject,
d. the commission or alleged commission of any offence by the data subject, or
e. any proceedings for an offence committed or alleged to have been committed by
the data subject, the disposal of such proceedings or the sentence of any court in
such proceedings (www.irishstatutebook.ie)
RIGHTS OF DATA SUBJECTS
Right to Access
One of the most practicable implications of the DPA is the right to access of personal data by
data subjects which is held by data controllers. The time limit for compliance with the access
request by the data subject is 40 days, after which the subject can lodge a complaint with the
Data Commissioner, who may or may not investigate the case, based upon the facts of the
matter. With appropriate notice in writing, and the payment of a nominal fee of €6 to cover
costs associate with complying with the access request the data subject can:
i. Description of the categories of data which are being processed
ii. Be informed of the purpose of the processing

8. iii. Be informed of the recipients or categories of recipients to whom the data is or
may be disclosed to
iv. Be provided with an intelligible copy or explanation of the information held by
the controller
Exceptions to the Right of Access do exist as follows:
a. An employer is not obliged to disclose information kept for the purpose of
preventing, detecting or investigating offences or apprehending or
prosecuting purported offenders
b. Information may be kept undisclosed if this is for the purpose of assessing
or collecting taxes or duties or for the calculation of damages or
compensation in a claim against the data controller
c. Data relating to an individual should not be made available to an
individual in response to a DPA access request if it would be likely to
cause serious harm to the physical or mental health of the data subject
(www.irishstatutebook.ie)
Case Study: Failure to comply with an access request
The Data Commissioner received a complaint from the parents of a child that Caredoc (a
medical facility in Carlow) had failed to comply with an access request under Section 4 of the
Acts for access to the child's personal data. The Commissioner commenced an investigation
and established that the child had attended Caredoc in May 2004 and that the access request
was made by the solicitor for the child's family in August 2005. Prior to the complaint being
submitted to the Commissioner, Caredoc's solicitors informed the legal representative for the
child's family that the access request raised matters of serious importance to their clients and
that they wished to be absolutely sure of their position prior to making a formal reply.
In correspondence, the Commissioner was told that the access request had raised a
fundamental problem for Caredoc concerning the information gathered by them both
physically and electronically and that the opinion of Senior Counsel was required. This was
accepted in good faith on the basis that such advice would be forthcoming promptly. In a

9. further letter, Caredoc's solicitors informed my Office that genuine difficulties had arisen as
a result of the circumstances thrown up by the access request and that Caredoc was anxious
not to have any adverse precedents set in relation to the confidentiality issue as between
doctor and patient. After lengthy correspondence back and forth the Data Commissioner
gave Caredoc's solicitors a final opportunity to respond to the key questions raised with
them. They failed to respond and the Data Commissioner subsequently served an
Enforcement Notice on Caredoc in July 2006 pursuant to Section 10 of the Acts.
The Enforcement Notice required Caredoc, within a period of twenty one days, to provide
the solicitor of the child's family with the personal data relating to the attendance of the
child at Caredoc's facility in Carlow in May 2004. In line with their legal entitlements,
pursuant to Section 26 of the Acts, Caredoc appealed to the Circuit Court against the
requirement specified in the Enforcement Notice. The appeal was listed for hearing in
Carlow Circuit Court in December 2006. At the Court hearing, Caredoc withdrew the appeal
and agreed to supply the personal data sought.
This case is a perfect example of the effectiveness of Data Protection legislation as it allows for
members of the public, regardless of their status or access to legal advice, to request personal
information for a maximum of €6.35 and to receive it. If they do not receive the information they
have sought, they can complain to the Data Commissioner at no cost and they will pursue the matter
on their behalf (www.dataprotection.ie).
Right ot be Informed of Data Being Kept
The DPA also make provision for the right to be informed of data being kept. If a person
suspects that another is keeping personal data, he or she may write to that person requesting
that he or she be informed as to whether any such data is being kept. If it is, then the
individual must be given a description of the data and of the purpose for which it is kept,
within 21 days of the request being made.

10. Right to prevent data being used for the purposes of direct marketing
The DPA also makes provisions regarding the use of personal data for direct marketing
purposes. It provides that where personal data is kept for the purpose of direct marketing
and the relevant data subject requests in writing that the relevant data controller cease
processing the data for that purpose, the data controller has 40 days to accede to such
request. The DPA also makes the provision that the data controller informs data subjects
who are being targeted for direct marketing purposes of their rights to object to such use of
their personal data.
Right of blocking or erasure
The DPA also gives the data subject a right to have his or her personal data in the data
controller’s possession rectified, erased or blocked if the data controller fails to comply with
its duties under the Acts and the data controller has 40 days to accede to such request.
Right to prevent processing where it might cause damage or distress
The DPA also entitles an individual, by notice in writing served on a data controller to
request the data controller to cease or not to commence processing of that individuals’
personal data where such processing is likely to cause substantial damage or distress which is
or would be unwarranted.
DATA PROTECTION AND ELECTRONIC COMMUNICATIONS
The Electronic Communications Regulations 2003, enacted by the Oireachtas to fulfill
obligations under EU Directive 2002/58/EC, makes provisions regarding direct marketing and
unsolicited email (spam). Other issues provisioned for under the Act include the retention of
telephone records and the storage access to information held on personal computers and
terminals, for example ‘cookies’. The regulations also restricts the ability of entities to use
publicily available electronic communications services to send unsolicited communications
or to make unsolicited calls for the purpose of direct marketing.

11. These regulations should prove particularly useful in desisting entities from sending
unsolicitated marketing communications via SMS or email. The regulations prohibit:
(a) the use of automatic dialling machines, fax, email or SMS text messaging
for direct marketing to individuals is prohibited, unless the subscriber’s
consent has been obtained in advance; and
(b) the use of email, SMS text messaging, automatic dialling machines or fax
for direct marketing to non-natural persons or businesses is prohibited, if
the subscriber has recorded its objection in the National Directory
Database or has informed the sender that it does not consent to such
messages; and
(c) the making of telephone calls for direct marketing to the line of a
subscriber is prohibited if the subscriber has recorded its objection in the
National Directory Database or has informed the sender that it does not
consent to such messages.
Case Study: Opera Telecom: Forced to delete database
The Data Commissioner received a complaint from an individual regarding the receipt of an
unsolicited SMS message in November 2005. The message, sent by Opera Telecom, was a
promotional message for a subscription service. When the Commissioner investigated the
matter it was discovered that the complainant had attended a major music concert in Croke
Park in June 2005. During the concert, those attending were encouraged to text support for
the Global Call Against Poverty Campaign. The complainant did so. The information
collected from these texts was stored in a database held by Opera Telecom and was
subsequently used by the company for the purpose of sending unsolicited direct marketing
SMS messages. During the investigation, the Commissioner discovered that 16,000 concert
goers had used their mobile phones to text support for the Global Call Against Poverty
Campaign. Conscious of the potential risk of misuse for direct marketing, the Commissioner
initially requested in a letter to Opera Telecom that they delete the related Database. When
it did not comply with this request, the Commissioner used powers under Section 10 of the
Data Protection Act and issued an Enforcement Notice. Opera Telecom complied with the

12. Enforcement Notice and deleted the database. This case demonstrates clearly that
information collected for one purpose must not be used for another purpose unless the data
subject was informed at the time of collection of such an intended use and given an
opportunity to object (www.dataprotection.ie).
DATA PROTECTION AND CCTV
CCTV has become ubiquitous in society and it is difficult, especially in urban areas to go
anywhere without being captured on CCTV. To satisfy the right to access and disclosure of
purpose, it is necessary for data controllers who use CCTV to inform those individuals
captured on CCTV the purpose for the collection of the data and the identity of the Data
controller. In practice, a sign detailing the presence of CCTV cameras for security, together
with a contact number for the data controller will satisfy the requirements of the Act.
In relation to the use of CCTV to identify disciplinary or other issues pertaining to
employees, the Data Controller must inform the data subjects that the cameras are being used
for these purposes. Cameras must be positioned only in public or sensitive areas, the
placement of cameras in private staff areas may be seen as an excessive invasion of privacy.
In general, data from CCTV is stored for no longer than 28 days, after which it is recorded
over or deleted. This is in line with the provisions of the DPA which states that data "shall
not be kept for longer than is necessary for the purposes for which it was obtained.” Data
should be stored in a secure environment and access to the data should only be by authorized
individuals.
Any individual whose image has been captured and recorded has a right to be given a copy of
the information recorded. To access a copy of the information held by the data controller in
such an instance an application in writing must be made to the data controller, and in a
practicable sense, with the location, date and time of the recording specified. The data
controller may charge a nominal fee up to €6.35 for responding to such a request and within

13. 40 days of application. It is important to note that the data controller is obliged to obscure
any identifiable data of other subject who may be in the same recording.
Case Study: Gresham Hotel breaches DP law in regard to use of covert CCTV footage
The Data Commissioner received a complaint in October 2006 from a data subject regarding
the unfair obtaining by her employer of her personal information and its subsequent use as
evidence to terminate her employment. The data subject had been employed in a supervisory
capacity at the Gresham Hotel in Dublin for a number of years. In January 2005 she was
called to a meeting by hotel management, at which she was informed that covert cameras
had been installed some time previously in the hotel for the purposes of an investigation. The
investigation was initiated on foot of a complaint received by the hotel regarding cash
handling at the bar. The data subject was not the subject of the investigation, she was not
made aware of the investigation nor was she informed of the covert CCTV recordings. At the
meeting, the data subject was confronted with a series of questions and was asked to explain
some of her actions which had been recorded by the covert cameras. Later in 2005, she was
dismissed from her employment with the hotel. Evidence taken from the covert CCTV
recordings was used in the decision to terminate the data subject’s employment. No criminal
prosecution took place following the hotel’s investigation nor was the data subject
interviewed by An Garda Síochána.
Covert CCTV cameras had been installed to investigate specific incidents. The data subject
was not the subject matter of this investigation. The personal data of the persons captured on
the footage was obtained for one purpose - the investigation of specific incidents in the hotel.
In the case of this data subject, her personal data was further processed in a manner
incompatible with the original purpose. Furthermore, the data subject’s personal data was
not processed in accordance with the requirements of ‘fair processing’ as she had not been
informed by the data controller, at the time when the data controller first processed her data,
of the purpose for which it intended to process her personal data. This constituted a breach
of the Act. The Data Commissioner asked both parties concerned to consider an amicable
resolution to the matter. Within a few weeks, a settlement was agreed between the parties.
(www.dataprotection.ie)

14. REMEDIES
Remedies for data subjects under the DPA are limited – there is no legal remedy for the data
subject if a data controller infringes section 2(1) of the Act, which pertains to the collection,
processing and storage of the act in a fair manner. If the Data Commissioner upholds that an
infringement occurs, the Commissioner may require the data controller to take remedial
action. In theory, there is the possibility of criminal sanction – if the data controller fails to
take remedial action a fine of €100,000 may be imposed. However in a practicable sense this
is unlikely as no notable prosecutions have occurred under the Act to date and the Act is
more an instrument of threat rather than action.
REFERENCES
The Data Protection Act 1988, 2003 | Retrieved online: 6.4.2010 | www.irishstatutebook.ie |
http://www.irishstatutebook.ie/1988/en/act/pub/0025/index.html
The Office of the Data Commissioner | www.dataprotection.ie | Retrieved online 6.4.2010 |
http://www.dataprotection.ie/docs/Home/4.htm
McGee v Attorney General [1974] IR 284 | Supreme Court of Ireland Decisions (1974) | www.bailii.org
Retrieved online: 6.4.2010 | http://www.bailii.org/ie/cases/IESC/1973/2.html