New provisions in the Data Protection Acts

New provisions in the Data Protection Acts

As of 18 July 2014, the following sections of the Data Protection Acts, 1988 and 2003 are now in force;

Under Section 6, a data subject may request a data controller to rectify or erase any personal data that has been obtained or processed in breach of the data protection principles.  Where such a request is received, a data controller has 40 days within which to take corrective action.  The data controller is then obliged to confirm to the data subject that it has complied with the request.  If compliance with the request results in the data being materially modified, Section 6(2)(b) now requires the data controller to also issue a notification to any third party to whom the data might have been disclosed during the preceding 12 months  (unless such notification proves impossible or involves a disproportionate effort).

Section 10 has been similarly amended to provide that, where a data controller has complied with an Enforcement Notice, and, in having done so, materially modifies the data in issue, the data controller is now obliged to contact any third party to whom the data might have been disclosed during the 12 month period immediately preceding the service of the Enforcement Notice to notify the third party of the corrective action taken (unless such notification proves impossible or involves a disproportionate effort).

Perhaps the most significant development is the amendment of Section 4; section 4(13) now makes it unlawful for employers to require employees or job applicants to make a data access request with a view to gaining access to the employee's/job applicant's personal data.  This means that, while an employer is entitled to carry out background checks before confirming an offer of employment, those background checks cannot require a candidate to make a data access request to a former employer(s) pursuant to Section 4 for the purpose of gaining access to the candidate's personnel file from previous employment(s).  It is worth bearing in mind that Section 4(13) applies equally to any person who engages another person to provide a service. 

For further information please contact  Michael Kennedy or Fleur O'Shea.