Restrictions
Data Protection Act 2018
CHAPTER 3
Rights, and restriction of rights, of data subject
Right of access to results of examination
50. (1) A request from a data subject under Article 15 in relation to the results of an
examination at which he or she was a candidate shall be deemed for the purposes of
that Article to have been made on the later of—
(a) the date of the first publication of the results of the examination, or
(b) the date of the request.
(2) In this section, “examination” means any process for determining the knowledge, skill
or ability of a person by reference to his or her performance in any test, work or other
activity.
Rights in relation to automated decision making
51. Subject to Article 22(4) and to suitable and specific measures to safeguard the
fundamental rights and freedoms of the data subject, for the purposes of Article 22(2)(b),
the right of a data subject not to be subject to a decision based solely on automated
processing, including profiling, which produces legal effects concerning him or her or
similarly significantly affects him or her shall, in addition to the grounds identified in
Article 22(2)(a) and (c), not apply where—
(a) the decision is authorised or required by or under an enactment, and
(b) either—
(i) the effect of that decision is to grant a request of the data subject, or
(ii) in all other cases (where subparagraph (i) is not applicable), adequate steps
have been taken by the controller to safeguard the legitimate interests of the
data subject which steps shall include the making of arrangements to enable
him or her to make representations to the controller in relation to the
decision.
Direct marketing for purposes of Article 21
52. For the purposes of Article 21, the reference to “direct marketing” includes direct mailing
other than direct mailing carried out in the course of electoral activities by—
(a) a political party or its members,
(b) a body established by or under an enactment (other than the Act of 2014 or a
former enactment relating to companies within the meaning of section 5 of that
Act), or
(c) a candidate for election to, or a holder of, elective political office.
Restriction on the right of data subject to object to processing for electoral activities
53. The right of a data subject to object at any time to the processing of personal data
concerning him or her under Article 21 shall not apply to processing carried out in the
course of electoral activities by—
(a) a political party,
(b) a body established by or under an enactment (other than the Act of 2014 or a
former enactment relating to companies within the meaning of section 5 of that
Act), or
(c) a candidate for election to, or a holder of, elective political office.
Restriction on exercise of data subject rights
54. (1) The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article
5 in so far as any of its provisions correspond to the rights and obligations in Articles
12 to 22—
(a) are restricted to the extent specified in subsection (3), and
(b) may be restricted in regulations made under subsections (5) or (6).
(2) Subsection (1) is without prejudice to any enactment or rule of law which, on the
coming into operation of this section, restricts the rights and obligations referred to in
that subsection.
(3) Subject to subsection (4), the rights and obligations referred to in subsection (1) are
restricted to the extent that—
(a) the restrictions are necessary—
(i) to safeguard cabinet confidentiality, judicial independence and court
proceedings, parliamentary privilege, national security, defence and the
international relations of the State,
(ii) for the prevention, detection, investigation and prosecution of criminal
offences and the execution of criminal penalties,
(iii) for the administration of any tax, duty or other money due or owing to the
State, a local authority or other public authority or body,
(iv) in contemplation of or for the establishment, exercise or defence of, a legal
claim, prospective legal claim, legal proceedings or prospective legal
proceedings whether before a court, statutory tribunal, statutory body or an
administrative or out-of-court procedure,
(v) for the enforcement of civil law claims, including matters relating to any
liability of a controller or processor in respect of damages, compensation or
other liabilities or debts related to the claim, or
(vi) for the purposes of estimating the amount of the liability of a controller on
foot of a claim for the payment of a sum of money, whether in respect of
damages or compensation, in any case in which the application of those
rights or obligations would be likely to prejudice the interests of the
controller in relation to the claim,
(b) the personal data relating to the data subject consist of an expression of opinion
about the data subject by another person given in confidence or on the
understanding that it would be treated as confidential to a person who has a
legitimate interest in receiving the information, or
(c) the personal data concerned are kept by the Commission or the Information
Commissioner for the performance of the functions of the Commission or
Information Commissioner, as the case may be.
(4) The Minister may prescribe requirements to be complied with when the rights and
obligations referred to in subsection (1) are restricted in accordance with subsection
(3).
(5) Subject to subsection (9), regulations may be made by a Minister of the Government
where he or she considers it necessary for the protection of a data subject or the rights
and freedoms of others restricting the rights and obligations referred to in subsection
(1)—
(a) (i) if the application of those rights and obligations would be likely to cause
serious harm to the physical or mental health of the data subject, and
(ii) to the extent to which, and for as long as, such application would be likely to
cause such serious harm,
and
(b) in relation to personal data kept for, or obtained in the course of, the carrying out
of social work by a public authority, public body, a voluntary organisation or
other body.
(6) Subject to subsection (9), regulations may be made restricting the rights and
obligations referred to in subsection (1) where such restrictions are necessary for the
purposes of safeguarding important objectives of general public interest and such
regulations shall include, where appropriate, specific provisions required by Article
23(2).
(7) Important objectives of general public interest referred to in subsection (6) include:
(a) preventing threats to public security and public safety;
(b) avoiding obstructions to any official or legal inquiry, investigation or process,
including any out-of-court redress procedure, proceedings pending or due before
a court, tribunal of inquiry or commission of investigation;
(c) preventing, detecting, investigating and prosecuting breaches of discipline by, or
the unfitness or incompetence of, persons authorised by law to carry on a
profession or any other regulated activity and the imposition of sanctions for
same;
(d) preventing, detecting, investigating or prosecuting breaches of ethics for
regulated professions;
(e) taking any action for the purposes of considering and investigating a complaint
made to a regulatory body in respect of a person carrying out a profession or
other regulated activity where the profession or activity is regulated by that body
and the imposition of sanctions on foot of such a complaint;
(f) preventing, detecting, investigating or prosecuting, whether in the State or
elsewhere, breaches of the law which are subject to civil or administrative
sanctions and enforcing such sanctions;
(g) the identification of assets which are derived from, or are suspected to derive
from, criminal conduct and the taking of appropriate action to deprive or deny
persons of those assets or the benefits of those assets and any investigation or
preparatory work in relation to any related proceedings;
(h) matters relating to international protection and immigration;
(i) safeguarding the economic or financial interests of the European Union or the
State, including on monetary, budgetary and taxation matters;
(j) safeguarding monetary policy, the smooth operation of payment systems, the
resolution of regulated financial service providers (within the meaning of the
Central Bank Act 1942), the operation of deposit-guarantee schemes, the
protection of consumers and the effective regulation of financial service
providers (within the meaning of the Central Bank Act 1942);
(k) protecting members of the public against—
(i) financial loss or detriment due to the dishonesty, malpractice or other
improper conduct of, or the unfitness or incompetence of, persons concerned
in the provision of banking, insurance, investment or other financial services
or in the management of bodies corporate or other entities,
(ii) financial loss or detriment due to the conduct of individuals who have been
adjudicated bankrupt, or
(iii) financial loss or detriment due to the conduct of individuals who have been
involved in the management of a body corporate which has been the subject
of a receivership, examinership or liquidation under the Act of 2014.
(l) protecting—
(i) the health, safety, dignity, well-being of individuals at work against risks
arising out of or in connection with their employment, and
(ii) members of the public against discrimination or unfair treatment in the
provision of goods or services to them;
(m) the keeping of public registers for reasons of general public interest, whether the
registers are accessible to the public on a general or restricted basis;
(n) safeguarding public health, social security, social protection and humanitarian
activities.
(8) Where the rights and obligations referred to in subsection (1) are restricted in
regulations made under subsection (6) on the basis of important objectives of general
public interest of the State, other than the objectives referred to in subsection (7), the
important objective or objectives of general public interest shall be identified in those
regulations.
(9) Regulations may be made under subsections (5) or (6) by—
(a) the Minister, following consultation with such other Minister of the Government
as he or she considers appropriate and the Commission, or
(b) any other Minister of the Government following consultation with the Minister,
such other Minister of the Government as he or she considers appropriate and the
Commission.
(10) Regulations made under this section shall—
(a) respect the essence of the right to data protection and protect the interests of the
data subject, and
(b) restrict the exercise of data subjects’ rights only in so far as is necessary and
proportionate to the aim sought to be achieved.
Restriction in the public interest, scientific or historical, research or statistical purposes
55. (1) Subject to subsection (3), where processing of data is for archiving purposes in the
public interest, the rights of a data subject set out in Articles 15, 16, 18, 19, 20 and 21
are restricted to the extent that—
(a) the exercise of any of those rights would be likely to render impossible, or
seriously impair, the achievement of those purposes, and
(b) such restriction is necessary for the fulfilment of those purposes.
(2) Subject to subsection (4), where processing of data is for scientific or historical
research purposes or statistical purposes, the rights of a data subject set out in Articles
15, 16, 18 and 21 are restricted to the extent that—
(a) the exercise of any of those rights would be likely to render impossible, or
seriously impair, the achievement of those purposes, and
(b) such restriction is necessary for the fulfilment of those purposes.
(3) Where data is being processed for purposes referred to in subsection (1) and the
processing serves another purpose at the same time, that subsection applies only to the
extent that the processing relates to the purposes referred to in that subsection.
(4) Where data is being processed for purposes referred to in subsection (2) and the
processing serves another purpose at the same time, that subsection applies only to the
extent that the processing relates to the purposes referred to in that subsection.