The Office of the Data Protection Commissioner is responsible for upholding the privacy rights of individuals in relation to the processing of their personal data.
These rights are contained in the Data Protection Acts 1988 and 2003 (pdf). The Acts state that information about you must be accurate, only made available to those that should have it and only used for specified purposes. You have the right to access personal information relating to you and have any errors corrected or, in some cases, have the information erased.
If your information is being held for the purposes of direct marketing, you can have your details removed.
Data protection rights apply to information held on computer or in manual or paper files.
The Commissioner is appointed by the Government and is independent in the exercise of her functions. Individuals who feel their rights are being infringed can complain to the Commissioner. She has powers to enforce the provisions of the Act.
If you suffer damage as a result of a breach of your data protection rights, you may sue for damages through the courts.
The Commissioner also maintains a register, available for public inspection, giving general details about the data handling practices of many important data controllers, such as government departments and State-sector bodies, financial institutions, and any person or organisation who keeps sensitive types of personal data.
How to apply
To access information relating to you, send a letter or email to the organisation or person holding your personal details and ask them for a copy of this information. You should receive them within 40 calendar days of your request. You may have to pay a small fee of €6.35.
If you find that an organisation or person has details about you that are not factually correct, you can ask them to change or, in some cases, remove these details. If you feel that they do not have a valid reason for holding your personal details or that they have taken these details in an unfair way, you can ask them to change or remove these details. You can also ask them not to use your personal details for purposes other than their main purpose.
Write to the organisation or person, explaining your concerns or outlining which details are incorrect. Within 40 days, they must do as you ask or explain why they will not do so.
Further information on your rights and how to obtain them is available on the Commissioner’s website
To make a complaint to the Data Protection Commissioner, simply write to or email the Commissioner explaining your case. You should include the following details:
- The name of the organisation or person you are complaining about
- The steps you have taken to have your concerns dealt with
- The details of any response you have received
You should provide copies of any letters or emails exchanged between you and the organisation or person.
If the Commissioner agrees with your complaint, she will try to make sure that the organisation or person obeys the law and puts matters right. If the Data Protection Commissioner does not accept your complaint, you may appeal to the Circuit Court against her decision within 21 days.
Read more about complaining to the Data Protection Commissioner on the Commissioner’s website.