Data Protection Enforcement

Article 22 of the data protective directive 95/46 provided for judicial remedies for data rights / privacy rights. A person who suffered damage due to unlawful data processing can received compensation from the data controller.

There are also different mechanisms in place for enforcement which can be enforcement by the courts, enforcement by the data subject themselves, or enforcement by the data protection commission.

The data protection commissioner can investigate if the data protection legislation has been breached, can deal with individuals complaints regarding data protection matters.

If the data subject does not agree with a decision of a data protection commissioner there is a 21 day right of appeal go court.

The commissioner has the power to issue enforcement notices.

A recipient of an enforcement notice also has a right of appeal within a 21 day timeframe.

By not complying with an enforcement notice the recipient party can be guilty of an offence.

The commissioner has the power to send a notice in writing for information to a person. 

The commissioner can service notice on a data controller

A commissioner can service notice on a person to take such steps that are specified in the notice to comply with a provision of the legislation.

The commissioner can also service notice if there is non compliance with the ePrivacy Regulations.

Any enforcement notice should specify the rule in the DPACT the commissioner is referring to, set out the reasons for the commissioners opinion, note the steps to be taken by the data controller, provide the data controller with an option of appeal to the circuit court with a 21 day period.

The data protecton legislation carries criminal offences provisions for certain failures under the legislation.

This will include a failure to comply with an enforcement notice, failing to comply with an information notice etc. Penalties can include a fine, summary conviction, a conviction on indictment.

The ePrivacy Regulations also include a number of offences which include failing to secure data, failing to comply with an enforcement notice or information notice, giving false information etc.

If a decision of the commissioner is appealed to court, the court won’t substitute their own decision for the decision of the data protection commissioner. They will instead review has the commissioner come to the decision correctly.