IrelandIrish ePrivacy Regulations
Officially S.I. No. 336 of 2011, Confidentiality of Communications
S.I. No. 336 of 2011, reg. 5(1)-(2)
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Consent, Prohibition
What it requires
- Do not listen to, tap, store, or otherwise intercept or monitor the content or related traffic data of a communication without the consent of the users concerned, unless a legally authorised exception for national security, defence, public security, or the investigation and prosecution of crime applies.
- A recording made in the course of lawful business practice to evidence a commercial transaction or other business communication falls outside this consent duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
Regulation 5 creates no offence of its own. Regulation 17(10) makes it an offence to fail to comply with an enforcement notice the Data Protection Commission serves, a class A fine under regulation 27(1); that offence is for ignoring the notice, not for the regulation 5 breach.
Who enforces it
Enforcement body
Data Protection Commission, which may investigate a complaint or act on its own initiative and serve an enforcement notice; regulation 5 is not among the regulations the Commission for Communications Regulation monitors under regulation 30.
Settledness
- As of
- Open questions
- Which conditions must a recording meet to be 'legally authorised' under Regulation 5(2) of S.I. No. 336 of 2011, which places a recording made in the course of lawful business practice outside the consent rule without stating any further condition?
- Does the ban on 'other kind of interception or surveillance' in Regulation 5(1) of S.I. No. 336 of 2011 reach automated scanning of message content by the service provider for its own purposes, such as spam or abuse detection, where the users have not consented and no legal authorisation applies?
What this law does
Regulation 5(1), without prejudice to the separate telecommunications-interception offence in section 98 of the Postal and Telecommunications Services Act 1983 (as amended), prohibits the listening, tapping, storage or other kind of interception or surveillance of a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised for a purpose under Article 15(1) of the ePrivacy Directive.
Regulation 5(2) takes outside that prohibition the technical storage necessary to convey a communication, and any legally authorised recording of a communication carried out in the course of lawful business practice to provide evidence of a commercial transaction or other business communication; the Regulations' own text states no further condition, such as telling the parties in advance, on that business-recording exception.
A breach of regulation 5 is not itself an offence: the Data Protection Commission instead investigates and may serve an enforcement notice, and only a failure to comply with that notice is an offence.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.
Back to the example · Lint your app
Page updated .