|
What
Needs to be Done Prior to Collection
Contact the data subject
Contact the
Data Protection Commissioner
Data Protection (Amendment) Act 2003
4 2D
(1)
Personal data shall not be treated, personal data for the purposes
of section 2(1)(a) of this Act, as processed fairly unless
(a) in the
case of data obtained from the data subject, the data controller
ensures, so far as practicable, that the data subject has, is
provided with, or has made readily available to him or her, at least
the information specified in subsection (2) of this section,
(b) in any
other case, the data controller ensures, so far as practicable, that
the data subject has, is provided with, or has made readily
available to him or her, at least the information specified in
subsection (3) of this section—
(i) not later than
the time when the data controller first processes the data, or
(ii) if disclosure
of the data to a third party is envisaged, not later than the time
of such disclosure.
(2) The
information referred to in subsection
(1)(a) of
this section is:
(a) the
identity of the data controller,
(b) if he
or she has nominated a representative for the purposes of this Act,
the identity of the representative,
(c) the
purpose or purposes for which the data
is intended to be processed, and
(d) any
other information which is necessary, having regard to the specific
circumstances in which the data
is or
is to be processed, to enable processing in respect of
the data to be fair to the data subject such as information as to
the recipients or categories of recipients of the data, as to
whether replies to questions asked for the purpose of the collection
of the data are obligatory, as to the possible consequences of
failure to give such replies and as to the existence of the right of
access to and the right to rectify the data concerning him or her.
(3) The
information referred to in subsection
(1)(b) of
this section is:
(a) the
information specified in subsection
(2) of this
section,
(b) the
categories of data concerned, and
(c) the
name of the original data controller.
(4) The said
subsection (1) (b) does not apply—
(a) where,
in particular for processing for statistical purposes or for the
purposes of historical or scientific research, the provision of the
information specified therein proves impossible or would involve a
disproportionate effort, or
(b) in any
case where the processing of the information contained or to be
contained in the data by the data controller is necessary for
compliance with a legal obligation to which the data controller is
subject other than an obligation imposed by contract, if such
conditions as may be specified in regulations made by the Minister
after consultation with the Commissioner are complied with.
Contact the Data Protection Commissioner
The register
16
(1)This section applies to the following persons, that is to say:
(a)
data controllers, being public authorities and other bodies and
persons referred to in the Third Schedule to this Act,
(b)
data controllers, being financial institutions, persons holding
authorizations
under the European Communities (Non-Life) Insurance Regulations,
1976 (S.I. No. 115 of 1976), or the European Communities (Life
Assurance) Regulations, 1984 (S.I. No. 57 of 1984), or persons whose
business consists wholly or mainly in direct marketing, providing
credit references or collecting debts,
(c)
any other data controllers who keep personal data relating to-
(i)
racial origin
(ii)
political opinions or religious or other beliefs,
(iii) physical or mental health (other than any such data reasonably
kept by them in relation to the physical or mental health or their
employees in the ordinary course of personnel administration and not
used or disclosed for any other purpose),
(iv)
sexual life; or
(v)
criminal convictions,
(d)
data processors whose business consists wholly or partly in
processing personal data on behalf of data controllers, and
(e)
such categories of data controllers and data processors as may stand
prescribed for the time being (which categories may include data
controllers and data processors to whom this section would not
otherwise apply and on whom enforcement notices, prohibition notices
or information notices have been served if the notices are in force
and either the time for bringing an appeal against them under
section 26 of this Act has expired without such an appeal having
been brought or any such appeal has been withdrawn).
(2)
The Commissioner shall establish and maintain a register (referred
to in this Act as the register) of persons to whom this section
applies and shall make, as appropriate, an entry or entries in the
register in respect of each person whose application for
registration therein is accepted by the Commissioner.
(3)
(a) Members of the public may inspect the register free of charge at
all reasonable times and may take copies of, or of extracts from,
entries in the register.
(b)
A member of the public may, on payment to the Commissioner of such
fee (if any) as may be prescribed, obtain from the Commissioner a
copy (certified by him or by a member of his staff to be a true
copy) of, or of an extract from, any entry in the register.
(c)
In any proceedings-
(i)
a copy of, or of an extract from, an entry in the register certified
by the Commissioner or by a member of his staff to be a true copy
shall be evidence of the entry or extract, and
(ii)
a document purporting to be such a copy, and to be certified, as
aforesaid shall be deemed to be such a copy and to be so certified
unless the contrary is proved.
(d)
In any proceedings-
(i)
a certificate signed by the Commissioner or by a member of his staff
and stating that there is not an entry in the register in respect of
a specified person as a data controller or as a data processor shall
be evidence of that fact, and
(ii)
a document purporting to be such a certificate, and to be signed, as
aforesaid shall be deemed to be such a certificate and to be so
signed unless the contrary is proved.
Applications for
registration
17
(1) (a)
A person wishing to be registered in the register or to have a
registration continued under section 18 of this Act or to have the
particulars in an entry in the register altered shall make an
application in writing in that behalf to the Commissioner and shall
furnish to him such information as may be prescribed and any other
information that he may require.
(b)
Where a data controller intends to keep personal data for two or
more purposes, he may make an application for separate registration
in respect of any of those purposes and, subject to the provisions
of this Act, entries shall be made in the register in accordance
with any such applications.
(2)
Subject to subsection (3) of this section, the Commissioner shall
accept an application for registration, made in the prescribed
manner an in respect of which such fee as may be prescribed has been
paid, from a person to whom section 16 of this Act applies unless he
is of opinion that-
(a)
the particulars proposed for inclusion in an entry in the register
are insufficient or any other information required by the
Commissioner either has not been furnished or is insufficient, or
(b)
the person applying for registration is likely to contravene any of
the provisions of this Act.
(3)
The Commissioner shall not accept such an application for
registration as aforesaid from a data controller who keeps personal
data specified in section 16(1)(c) of this Act unless he is of the
opinion that appropriate safeguards for the protection of the
privacy of the data subjects concerned are being, and will continue
to be, provided by him.
(4)
Where the Commissioner refuses an application for registration, he
shall, as soon as may be, notify in writing the person applying for
registration of the refusal and the notification shall-
(a)
specify the reasons for the refusal, and
(b)
state that the person may appeal to the Court under section 26 of
this Act against the refusal within 21 days from the receipt by him
of the notification.
(5)
If-
(a)
the Commissioner, by reason of special circumstances, is of opinion
that a refusal of an application for registration should take effect
urgently, and
(b)
the notification of the refusal includes a statement to that effect
and a statement of the effect of the provisions of section 26 (other
than subsection (3)) of this Act.
paragraph (b) of subsection (4) of this section shall not apply in
relation to the notification and paragraph (b) of subsection (6) of
this section shall be construed and have effect as if for the words
from and including "21 days" to the end of the paragraph there were
substituted "7 days beginning on the date on which the notification
was received,".
(6)
Subject to subsection (5) of this section, a person who has made an
application for registration shall-
(a)
until he is notified that it has been accepted or it is withdrawn,
or
(b)
if he is notified that the application has been refused, until the
end of the period of 21 days within which an appeal may be brought
under section 26 of this Act against the refusal and, if such an
appeal is brought, until the determination or withdrawal of the
appeal,
be
treated for the purposes of section 19 of this Act as if the
application had been accepted and the particulars contained in it
had been included in an entry in the register on the date on which
the application was made.
(7)
Subsection (2) to (6) of this section apply, with any necessary
modifications, to an application for continuance of registration and
an application for alteration of the particulars in an entry in the
register as they apply to an application for registration.
Duration and
continuance of registration
18
(1)
A registration (whether it is the first registration or a
registration continued under this section) shall be for the
prescribed period and on the expiry thereof the relevant entry shall
be removed from the register unless the registration is continued as
aforesaid.
(2)
The prescribed period (which shall not be less than one year) shall
be calculated-
(a)
in the case of a first registration, from the date on which the
relevant entry was made in the register, and
(b)
in the case of a registration which has been continued under this
section, from the date from which it was so continued.
(3)
The Commissioner shall, subject to the provisions of this Act,
continue a registration, whether it has previously been continued
under this section or not.
(4)
Notwithstanding the foregoing provisions of this section, the
Commissioner may at any time, at the request of the person to whom
an entry relates, remove it from the register.
|
