Irish Data Protection Act of 2018
The Irish Data Protection Act, 2018 (Irish DPA) implements the General Data Protection Regulation (GDPR) and transposes the European Union Law Enforcement Directive in Ireland. Since it incorporates most of the provisions from the GDPR and the Law Enforcement Directive with limited additions and deletions as per the national law, it is considered to be the principal data protection legislation in Ireland.
Rights of Data Subjects
The Irish DPA provides the same rights to data subjects with respect to their personal data as that of the GDPR. These rights give data subjects control over their data and may be processed under particular conditions and limitations.
- The right to be informed
Data subjects have the right to be informed of when and how their data is being used and collected. This refers to the obligation of the data controller to inform and notify any relevant details to the data subjects for any important action taken on their data.
- The right of access
On a request of the data subject, an organization must provide data subject access to his/her personal data and information about the ways personal data has been or may have been used, disclosed, or processed by the organization. - The right to erasure
Data subjects have the right to request the organization to delete their personal data if they object to its processing or withdraw their consent or the personal data has served the data processing purpose for which it was collected, or personal data was collected unlawfully. The Irish DPA allows a specific right of erasure for children in respect of their personal data. - The right to restriction of processing
This right applies when the accuracy of data is contested by the data subject and when processing is unlawful and the data subject opposes the deletion of the data. Data subjects need to be informed before any such restriction is lifted.
- The right to data portability
The right to data portability allows data subjects to receive their personal data for their own purposes across different services in a structured and commonly used format. It allows data subjects to copy, move, and/or transfer their personal data easily from one IT environment to another. The right to data portability may be declined where it is not technically feasible to support.
- The right to rectification
Data subjects have a right to rectify and correct inaccurate personal data held by the organization. - The right to object
There exists an absolute right for data subjects to object to their personal data being processed for direct marketing purposes. As per the Irish DPA, this right shall not apply to processing carried out in the course of electoral activities in the state by a political party, or a candidate for election to, or a holder of, elective political office in the state and by the Referendum Commission in the performance of its functions. - Rights in relation to automated decision making and profiling
Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning data subjects or similarly significantly affects them. The Irish DPA allows the restriction of this right where the decision is authorised by law and the data subject has the possibility to make representations to the competent authority regarding the decision or where the data controller has taken adequate steps to safeguard the legitimate interests of the data subject.Where the personal data is processed for archiving purposes in the public interest, or processed for scientific or historical research purposes or statistical purposes, the Irish DPA allows the restriction of data subjects’ rights, if the exercise of the right would likely render impossible, or seriously impair the achievement of those purposes and such restriction is necessary for the fulfillment of those purposes.
Responsibilities of data controllers
The Irish DPA reaffirms the obligations of organizations as outlined in the GDPR. Some of the key obligations for Irish organizations are as follows:
- Ensure appropriate security controls to uphold data protection principles of lawfulness, transparency and fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability,
- Maintain records of each category of a data processing activity in writing to demonstrate compliance to the Data Protection Commission (DPC),
- Notify personal data breaches to DPC without undue delay and within 72 hours of becoming aware of the breach,
- Notify personal data breaches to data subjects without undue delay where a breach is likely to cause high risk to the rights and freedoms of data subjects,
- Notify personal data breaches to the data controller if the organization is a data processor,
- Implement data protection by design and by default approaches to ensure the security and confidentiality of personal data.
Irish DPC Cookie Consent Guidelines
In Ireland, the European Union’s e-Privacy Directive was implemented into the e-Privacy Regulations of 2011. These regulations require organizations to obtain data subject’s valid consent prior to the installation of cookies and provide the data subject clear and comprehensive information in accordance with the Irish DPA.
Between August and December 2019, the Irish DPC carried out a cookie sweep survey, sending questionnaires to 40 Irish organizations to examine the use of cookies and similar technologies. Based on the results of the survey, the DPC released a substantive Guidance Note on Cookies and Other Tracking Technologies later in April 2020, containing the following key requirements for organizations:
- Organizations must obtain valid user’s consent prior to the use of cookies, development kits, pixel trackers, or any other form of tracking technology.
- Users must have the ability to change their cookie preferences easily, at any given time, and without facing any detriment.
- The DPC requires organizations to reaffirm user’s consent no longer than six months after they have stored their consent status.
- Any record of consent must be backed up by the organization through demonstrable organizational measures to ensure a user’s expression of consent (or withdrawal).
- Organizations must assess the role of third parties using cookies on their website as data controllers or data processors.
- Organizations are not required to obtain prior user’s consent for the use of strictly necessary cookies (strictly necessary exemption) and cookies that are solely used for carrying out the transmission of a communication over a network (communication exemption). To ensure cookies fall under the strictly necessary cookie exemption, organizations must ensure that such cookies are necessary to provide specific functionality to the user, that has been explicitly requested by the user as part of an information society service.
- If an organization uses a cookie consent banner, the banner must be placed in a position to not obscure the text of the privacy policy or the cookie policy. The cookie banner must allow users to accept as well as reject the use of cookies and provide clear and comprehensive information about the types and purposes of cookies including third-party cookies.
Automating privacy operations across your organization
The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.
Get the Book“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”
- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc
Automation Towards Compliance
SECURITI.ai’s privacy regulations compliance solution is based on the PrivacyOps methodology, which recruits robotic automation and artificial intelligence. It provides organizations with a system that can help automate the majority of their compliance tasks and in turn, freeing up resources for other areas of business.
SECURITI.ai assists businesses in discovering data over a web of internal and external systems, links personal data with its correct owners, conducts an automated internal assessment of policies as well as third-party vendors, manages consent, and much more!
While organizations may hesitate to take the leap towards automation from their current manual methods for fear of the costs and change in infrastructure, it is clear that automation is truly the way forward. Automation increases ROI as well as productivity, lowers cost and improves accuracy. It pays for itself and brings organizations a number of benefits along with it.
Automation helps you with swift and efficient compliance with GDPR as well as other data privacy regulations. Watch it in action today!
Ask for a DEMO today to understand how SECURITI.ai can help you comply with Irish Data Protection Act, GDPR, e-Privacy Directive, and a whole host of other global privacy laws and regulations, with ease and automation.
Products
Resources
Get in touch
[email protected]
PO Box 13039,
Coyote CA 95013
