What is Irish Data Protection Act of 2018

The Irish Data Protection Act, 2018 (Irish DPA) implements the General Data Protection Regulation (GDPR) and transposes the European Union Law Enforcement Directive in Ireland. Since it incorporates most of the provisions from the GDPR and the Law Enforcement Directive with limited additions and deletions as per the national law, it is considered to be the principal data protection legislation in Ireland.

Where the personal data is processed for archiving purposes in the public interest, or processed for scientific or historical research purposes or statistical purposes, the Irish DPA allows the restriction of data subjects’ rights, if the exercise of the right would likely render impossible, or seriously impair the achievement of those purposes and such restriction is necessary for the fulfillment of those purposes.

Responsibilities of data controllers

The Irish DPA reaffirms the obligations of organizations as outlined in the GDPR. Some of the key obligations for Irish organizations are as follows:

• Ensure appropriate security controls to uphold data protection principles of lawfulness, transparency and fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability,
• Maintain records of each category of a data processing activity in writing to demonstrate compliance to the Data Protection Commission (DPC),
• Notify personal data breaches to DPC without undue delay and within 72 hours of becoming aware of the breach,
• Notify personal data breaches to data subjects without undue delay where a breach is likely to cause high risk to the rights and freedoms of data subjects,
• Notify personal data breaches to the data controller if the organization is a data processor,
• Implement data protection by design and by default approaches to ensure the security and confidentiality of personal data.

Irish DPC Cookie Consent Guidelines

In Ireland, the European Union’s e-Privacy Directive was implemented into the e-Privacy Regulations of 2011. These regulations require organizations to obtain data subject’s valid consent prior to the installation of cookies and provide the data subject clear and comprehensive information in accordance with the Irish DPA.

Between August and December 2019, the Irish DPC carried out a cookie sweep survey, sending questionnaires to 40 Irish organizations to examine the use of cookies and similar technologies. Based on the results of the survey, the DPC released a substantive Guidance Note on Cookies and Other Tracking Technologies later in April 2020, containing the following key requirements for organizations:

• Organizations must obtain valid user’s consent prior to the use of cookies, development kits, pixel trackers, or any other form of tracking technology.
• Users must have the ability to change their cookie preferences easily, at any given time, and without facing any detriment.
• The DPC requires organizations to reaffirm user’s consent no longer than six months after they have stored their consent status.
• Any record of consent must be backed up by the organization through demonstrable organizational measures to ensure a user’s expression of consent (or withdrawal).
• Organizations must assess the role of third parties using cookies on their website as data controllers or data processors.
• Organizations are not required to obtain prior user’s consent for the use of strictly necessary cookies (strictly necessary exemption) and cookies that are solely used for carrying out the transmission of a communication over a network (communication exemption). To ensure cookies fall under the strictly necessary cookie exemption, organizations must ensure that such cookies are necessary to provide specific functionality to the user, that has been explicitly requested by the user as part of an information society service.
• If an organization uses a cookie consent banner, the banner must be placed in a position to not obscure the text of the privacy policy or the cookie policy. The cookie banner must allow users to accept as well as reject the use of cookies and provide clear and comprehensive information about the types and purposes of cookies including third-party cookies.

Learn further about Irish Guidance on Consent and Cookies