Individuals have a strong right of access to see their personal data. However, section 5 of the Data Protection Acts provides that individuals do not have a right to see information relating to them where any of the following circumstances apply.

1. If the information is kept for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders, or assessing / collecting any taxes or duties: but only in cases where allowing the right of access would be likely to impede any such activities
   Comment: It would obviously be unacceptable to allow a criminal suspect to see all of the information kept about him by An Garda Síochána, where this would be likely to impede the effectiveness of the criminal investigation. On the other hand, however, if allowing an individual access to personal information about him or her would not be likely to impede an investigation, then the access request would have to be complied with. (see case study 2/04)
   
2. If granting the right of access would be likely to impair the security or the maintenance of good order in a prison or other place of detention
   
   
3. If the information is kept for certain anti-fraud functions: but only in cases where allowing the right of access would be likely to impede any such functions
   
   
4. If granting the right of access would be likely to harm the international relations of the State
   
   
5. If the information concerns an estimate of damages or compensation in respect of a claim against the organisation, where granting the right of access would be likely to harm the interests of the organisation
   
   
6. If the information would be subject to legal professional privilege in court
   
   
7. If the information is kept only for the purpose of statistics or carrying out research, but only where the information is not disclosed to anyone else, and where the results of the statistical work or research are not made available in a form that identifies any of the individuals involved
   
   
8. If the information is back-up data.
   Comment: It would be unreasonable to expect an organisation to retrieve back-up copies of its personal information in responding to an access request. However, it should be noted that back-up data is not necessarily the same as old or archived data. Such archive data is subject to an individual’s right of access in the normal way.
   

Restrictions on access to medical data and social work data.

The Data Protection (Access Modification) (Health) Regulations, 1989 (S.I. No. 82 of 1989) provide that health data relating to an individual should not be made available to the individual, in response to an access request, if that would be likely to cause serious harm to the physical or mental health of the data subject. A person who is not a health professional should not disclose health data to an individual without first consulting the individual’s own doctor, or some other suitably qualified health professional.

Similar provisions apply in respect of social work data. The Data Protection (Access Modification) (Social Work) Regulations, 1989 (S.I. No. 83 of 1989) provide that social work data relating to an individual should not be made available to the individual in response to an access request, if that would be likely to cause serious harm to the physical or mental health or emotional condition of the data subject. The regulations apply to social work carried on by Ministers, local authorities, health boards, or any voluntary or other body that receives public funding for this work.

Information about Other Individuals

Section 4(4) of the Data Protection Act makes special provision for dealing with the personal data of another individual. A data controller is not obliged to comply with an access request if that would result in disclosing data about another individual, unless that other individual has consented to the disclosure. However, the data controller is obliged to disclose so much of the information as can be supplied without identifying the other individual, e.g. by omitting names or other identifying particulars.

Expressions of opinion

Where personal data consists of an expression of opinion about the data subject by another person, the data subject has a right to access that opinion except if that opinion was given in confidence. If the opinion was not given in confidence then the possible identification of the individual who gave it does not exempt it from access.

Examinations Data

Section 4(6) of the Data Protection Act makes special provision for responding to an access request about the results of an examination. "Examination" in this context means any test of knowledge, skill, ability etc., and is therefore not confined to official State examinations. Medical examinations are not covered, though. These special rules

(a) increase the time limit for responding to an access request from 40 days to 60 days, and

(b) deem an access request to be made at the date of the first publication of the examination results or at the date of the request, whichever is the later.

Disproportionate effort

Section 4(9) provides that the obligation on a data controller to comply with an access request applies unless it is impossible for the data controller to supply the data or it would involve disproportionate effort.

Repeated Access Requests

If a data controller has complied with an access request he does not have to comply with an identical or similar request unless a reasonable interval has elapsed