Processes personal data, in Ireland

Statistics Act 1993 (No. 21 of 1993), ss. 32 to 34 and 38 · Read the law's page

• If you hold information furnished under the Statistics Act 1993, use it only for statistical compilation and analysis purposes (Statistics Act 1993 Section 32).
• Do not disseminate, show or communicate information obtained under the Statistics Act 1993 that can be related to an identifiable person or undertaking, unless that person or undertaking (or the personal representative or next-of-kin of a deceased person) consents in writing or one of the cases listed in section 33(1) applies (Section 33(1)).
• If you are the Central Statistics Office, provide information obtained under the Act to others for statistical purposes only, and only in a form that cannot be directly or indirectly related to an identifiable person or undertaking, on the conditions the Director General sets (Section 34).

Disability Act 2005 (No. 14 of 2005), Part 4, ss. 41 and 42 · Read the law's page

• Do not process genetic data in Ireland in relation to a person's employment, a policy of insurance or life assurance, a policy of health insurance or health-related insurance, an occupational pension, a retirement annuity contract or other pension arrangement, or the mortgaging of property.
• Do not carry out genetic testing on a person in Ireland unless the testing is not prohibited by law and you have the person's consent to the processing of the genetic data the testing will produce, obtained in accordance with the GDPR.
• Before you process genetic data in Ireland, take all reasonable steps to give the data subject all appropriate information about the purpose and possible outcomes of the processing and any potential implications for the data subject's health that may become known as a result.

Data Protection Act 2018 (No. 7 of 2018) · Read the law's page

• Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.

Regulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 · Read the law's page

• Where you process special category data, including biometric data, about an employee in Ireland on the ground that employment or social welfare law gives you or the employee a right or obligation, take suitable and specific measures to safeguard the employee's fundamental rights and freedoms, under Data Protection Act 2018 Section 46.
• Treat any biometric identifier your system derives through its own technical processing as GDPR Article 9 special category data, whether or not the source photo or audio was publicly available.

Regulation (EU) 2016/679, Arts. 12-21; Data Protection Act 2018, ss. 60-61 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Ireland within one month of receipt.
• You need not complete an access, rectification, restriction or objection request, or, for archiving in the public interest, also a portability request, where doing so would make that archiving, or scientific or historical research or statistics, impossible or seriously impair it, under Data Protection Act 2018 section 61.
• You may restrict a person's rights under GDPR Articles 12 to 22 to the extent necessary to establish, exercise or defend a legal claim, or where the personal data is an opinion about the person given to you in confidence, under Data Protection Act 2018 section 60(3).

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Ireland outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, where the District Court, the Circuit Court or the High Court awards compensation in a data protection action, under GDPR Article 82 and Data Protection Act 2018 Section 117.

Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 · Read the law's page

• If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
• Where your assessment of the health research indicates a high risk to the rights and freedoms of individuals, carry out a data protection impact assessment.
• Obtain each data subject's explicit consent before the health research begins, record and retain it, and give the data subject a copy, unless Regulation 3A (an approved low-risk retrospective chart review) or a declaration by the Committee under Regulation 5 removes the requirement.

Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. No. 121 of 2022), regs. 4 to 9 · Read the law's page

• You may restrict a person's GDPR Article 15 right of access to their health data in Ireland only to the extent necessary and proportionate, and only for as long as necessary to protect the health of the data subject.
• You must still grant access to so much of the health data sought as can be granted without causing serious harm to the physical or mental health of the data subject.
• If you withhold health data under Regulation 6 or 7, advise the data subject that, if they ask, you will offer access to a health practitioner they specify, and keep the data available for that purpose.