CCTV in Public Place A person must not install or operate CCTV for the sole or primary purpose of recording in a public place for the purposes set out, without an authorisation issued under the Garda Síochána (Recording Devices) Act. It provides that an authorisation can only be given to a member of Garda personnel, or to a local authority […]
Data Protection Legislation and Reform Data protection law restricts the collection, storage and use of personal data. Personal data is that which concerns a living person. The objective is to protect privacy and to restrict the use of information to legitimate purposes. Personal data must be collected for specified explicit and legitimate purposes and must not be processed in a […]
Personal Data Data Protection legislation controls the use to which personal information can be put. The legislation refers to the “processing” of personal data. Processing means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means. It includes collection, recording, organisation, structuring, storage, adaptation or alteration, […]
Lawful Use (processing) of Personal Data (General Provisions) The (EU Wide) GDPR provides that the processing (use) of personal data is permitted, provided that the processor complies with one or more of the following conditions; the data subject (the person whose personal information it is) has unambiguously given his consent; to the processing for one or more specific purposes; the […]
Pre-GDPR Regime I Higher standards have always applied under Data Protection legislation to the processing of certain categories of data. The processing of sensitive data was permissible in more limited circumstances under the pre-GDPR regime than applied in relation to personal data generally. Explicit consent was and is usually required for the processing of sensitive personal data. Sensitive personal data […]
Lawful Use (processing) of Personal Data (General Provisions) The (EU Wide) GDPR provides that processing (use) of personal data is permitted, provided that the processor complies with one or more of the following conditions; the data subject (the person whose personal information it is) has unambiguously given his consent; to the processing for one or more specific purposes the processing […]
Law Enforcement Purposes Part 5 of the Data Protection Act 2018 applies to the automatic processing of personal data by or on behalf of a controller carried out for prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security, or the execution of criminal penalties. It also covers data in […]
Processing sensitive data; Pre-GDPR Rules Higher standards applied under the original Data Protection legislation to the processing of certain categories of data. “Sensitive data” include those relating to the data subject’s health. The processing of sensitive data was permissible in more limited circumstances under the pre GDPR regime, than applied in relation to personal data generally. Under the GDPR […]
Application of GDPR / Data Protection Law Irish Data protection law (including the GDPR) applies to the processing of personal data where that data controller or processor is established in the State (Ireland) and data is processed in the context of the activities of that establishment. This is the case regardless of whether the processing takes place in the European […]
Data Protection Commissioner Office The Data Protection Commissioner was the independent body established under and which enforced the Data Protection Act 1988 -2003. The earlier EU Directives on Data Protection (also) required that there must be an independent body with the necessary means to perform its duties. The Commissioner was appointed for a five-year term and could be re-appointed. He […]
Cross Border Matters The GDPR seeks to provide for the uniform interpretation and application of data protection standards across the EU, thereby providing a level playing field for those doing business in the EU digital market. The European Data Protection Board comprising representatives of the data protection authorities of all Member States plays an important role in this regard. The […]
GDPR Requirements for Supervisory Authority Under the GDPR, the supervisory authority is to have the following investigative powers: to order a controller, processor, or their representative to provide any information it requires for the performance of its tasks; to carry out investigations in the form of data protection audits; to carry out a review of certifications issued; to notify a […]
Offences I Breach of various parts of the legislation is a criminal offence. This includes failing to comply with an enforcement notice; failing to comply with a prohibition notice; failing to comply with an information notice; processing in breach of the legislation; keeping personal data where there is no entry in the register in respect of the data controller where […]
Data Protection Regulation and Freedom of Information The General Data Protection Regulation gives significant rights to individuals in relation to data (information) held by third parties about them. These rights may be enforced directly against the person or entity who holds or controls the data. The GDPR (and Data Protection Act) compliment the Freedom of Information Act, which relates to […]
General Limitations on Rights Data is not personal data, simply because the person’s name is mentioned. For example, data in an employment or agency context may be that of the employer. Trade secrets and intellectual property need not be disclosed. However, this must not involve the individual being refused all information. The obligation to provide data may require that the […]
Right to information Law Enforcement Context I A law enforcement data controller must ensure that the data subject is provided with, or, as appropriate, has made available to him or her, the information specified below in relation to personal data relating to him or her within a reasonable period after the date on which the controller obtains the personal data […]
Duty to Keep Data Secure Data controllers must keep the data which they hold secure. The security must be appropriate. What is appropriate will depend on the circumstances. Regard may be had to the state of the art and the cost of implementation of measures. The security must be appropriate to the risk represented by the processing and the nature […]
Data Protection Impact Assessment Where a type of processing, in particular, one using new technologies, taking account of its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of persons, the data controller must, prior to the processing, carry out an impact assessment of the envisaged processing operations on the protection […]
Domain Names Every Internet site has an IP address. This is represented in characters and numbers. In the early days of the Internet, search engines focused mainly on domain names. Domain names are visible Internet addresses, for example, Ireland.com. In the early days of the internet and in the mid to late 1990s cybersquatting became a notorious practice. Persons registered […]
Information to be Provided I Under the Companies Act, companies must identify their company registration number, place of business, registered office and address on all of their websites. An information society service is any service normally provided for remuneration, at a distance, by means of electronic equipment for the processing (including digital compression) and storage of data, and at the […]