How can I see what information a body or company holds about me?

Under Section 3 of the Data Protection Acts, you have a right to find out, free of charge, if a person (an individual or an organisation) holds information about you.  You also have a right to be given a description of the information and to be told the purpose(s) for holding your information.

You must make the request in writing.  The person must send you the information within 21 days.

Under Section 4 of the Data Protection Acts, you also have a right to get a copy of your personal information.  This  applies to all types of information -for example, written details about you  held electronically or on paper, photographs and CCTV images.   You are also entitled to know where the information was obtained, how it has  been  used and if it has been passed on to anyone else.  All you need do is write to the person or organisation holding the information.  You need not quote the Data Protection Acts, but it is a good idea to do so.  Your letter might read something like:

Dear ...
I wish to make an access request under the Data Protection Acts 1988 and 2003 for a copy of any information you keep about me, on computer or in manual form.  I am making this request under section 4 of the Data Protection Acts.

You should also include any additional details that  would help to locate your information - for example, a customer account number or  staff number. You may be asked for evidence of your identity. This is to make sure that personal information is not given to the wrong person. When requesting some types of record, such as credit history or Garda records, it may also be useful to provide a list of previous addresses, previous names and your date of birth. You may be asked to pay a fee, but this cannot exceed €6.35.

Once you have made your request, and paid any appropriate fee, you must be given the information within 40 days (most organisations manage to reply much sooner).

Are there any exceptions to the right of access?

Yes. Sections 4 & 5 of the Data Protection Acts set out a small number of circumstances in which your right to see your personal records can be limited. This is necessary in order to strike a balance between the rights of the individual, on the one hand, and some important needs of civil society, on the other hand. For example, a criminal suspect does not have a right to see the information held about him by An Garda Síochána, where that would impede a criminal investigation.  Similarly, you do not have a right to see communications between a lawyer and his or her client, where that communication would be subject to legal privilege in court.  The right of access to medical data and social workers’ data is also restricted in some very limited circumstances, where the health and mental well-being of the individual might be affected by obtaining access to the data. Your right to obtain access to examination results and to see information relating to other people is also curtailed. Further details on all of these points can be obtained by clicking on the link below.

Exceptions to the right of access

What if an organisation refuses to respond to my access request?

If an organisation does not comply with a valid access request that you have made, it is open to you to make a complaint to the Data Protection Commissioner.  Before doing so it is recommended that you contact the organisation in question to establish the circumstances and to indicate your intention to complain to this Office. They may be in a position to apologise and correct the problem there and then.  We find that this can work well as an organisation once contacted by ourselves will often go through a formal process and actually slow down the resolution of your complaint.  If you are not satisfied with their response, or if you do not receive a response, at that point you should make a formal complaint to this office.  The Commissioner will investigate the matter for you and ensure that your rights are fully upheld. The Commissioner has wide powers to investigate complaints made to him and will take appropriate action against any persons or organisations that are not complying with the provisions of the Acts.