Data Protection Act, 2013

Section 5 requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, unless the processing is necessary for a listed alternative ground such as performing a contract, complying with a legal obligation, protecting the data subject's vital interests, the administration of justice, or exercising a function conferred by law, and requires every such processing to be for a lawful purpose directly related to the data user's activity, necessary for that purpose, and adequate but not excessive.

Section 7 bars disclosing personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, subject to the exceptions in section 17.

Section 17 lets a data user disclose personal data for a different purpose where the data subject consents, the disclosure prevents or detects crime or is required or authorized by law or a court order, the data user reasonably believed it had the right to disclose or would have had the data subject's consent, or the Minister determines the disclosure is justified in the public interest.

Section 8 requires a data user to take practical security steps against loss, misuse, unauthorized or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, the security measures built into that storage, and the reliability of personnel with access, and requires the same guarantees from a data processor engaged on the data user's behalf.

Section 9 bars keeping personal data longer than necessary for the purpose it was processed for. Section 10 requires a data user to keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.

Section 19 exempts personal data processed for an individual's personal, family or household affairs entirely, and exempts data processed for crime prevention or investigation, apprehension or prosecution of offenders, or tax assessment and collection, for preparing statistics or conducting research, for a court order or judgment, or for discharging regulatory functions, from the General, Notice and Choice, Disclosure and Access Principles, and exempts data processed only for journalistic, literary or artistic purposes from those principles plus the Retention and Data Integrity Principles, where publication would be in the public interest.

Section 20 lets the Minister, on the Information Commissioner's recommendation, exempt a data user or class of data users from any or all of the Act's principles by Order published in the Gazette.