Data Protection Commissioner

[text version]

S. I. No. 535 of 2003 as amended by SI 526 of 2008
__________________

EUROPEAN COMMUNITIES (ELECTRONIC COMMUNICATIONS NETWORKS AND SERVICES) (DATA PROTECTION AND PRIVACY) REGULATIONS 2003 AS AMENDED BY EUROPEAN COMMUNITIES (ELECTRONIC COMMUNICATIONSNETWORKS AND SERVICES) (DATA PROTECTION AND PRIVACY)(AMENDMENT) REGULATIONS 2008

INFORMAL CONSOLIDATION

IMPORTANT NOTICE

THIS INFORMAL CONSOLIDATION HAS BEEN PREPARED BY THE OFFICE OF THE DATA PROTECTION COMMISSIONER TO ASSIST ORGANISATIONS AND INDIVIDUALS.  IT HAS NO LEGAL STATUS AND SHOULD ONLY BE USED AS IN INFORMAL GUIDE TO THE LEGISLATION

Made by the Minister for Communications,Marine and Natural Resources.

A pdf version of this document is also available here for download. 

CONTENTS

1. CITATION AND COMMENCEMENT

2. INTERPRETATION/DEFINITIONS

3. SERVICES TO WHICH THESE REGULATIONS APPLY

4. SECURITY

5. CONFIDENTIALITY OF COMMUNICATIONS

6. TRAFFIC DATA

7. ITEMISED BILLING

8. PRESENTATION AND RESTRICTION OF CALLING AND CONNECTED LINE IDENTIFICATION

9. LOCATION DATA OTHER THAN TRAFFIC DATA

10. EXCEPTIONS [REVOKED]

11. AUTOMATIC CALL FORWARDING

12. DIRECTORIES OF SUBSCRIBERS

13. UNSOLICITED COMMUNICATIONS

14. NATIONAL DIRECTORY DATABASE (NDD)

15. TECHNICAL FEATURES AND STANDARDISATION

16. DAMAGES FOR CONTRAVENTION OF REGULATIONS

17. ENFORCEMENT OF REGULATIONS BY COMMISSIONER

17A. POWER TO REQUIRE INFORMATION

17B. POWERS OF AUTHORISED OFFICERS

17C. SERVICE OF NOTICES

17D. APPEALS TO CIRCUIT COURT

17E. CIRCUMSTANCES IN WHICH PERSON NEED NOT COMPLY WITH ENFORCEMENT OR INFORMATION NOTICE

17F. EVIDENCE IN LEGAL PROCEEDINGS

17G. HEARING OF PROCEEDINGS IN PRIVATE

17H. OFFENCES BY OFFICERS OF BODIES CORPORATE

17I. PROSECUTION OF OFFENCES

17J. PENALTIES FOR OFFENCES UNDER THE REGULATIONS

17K. OBTAINING CONSENT TO OBTAINING, RECORDING AND RESCINDING CONSENT OF SUBSCRIBERS

17L. POWER TO INCLUDE REQUIREMENTS UNDER THESE REGULATIONS IN CODES OF PRACTICE UNDER THE DATA PROTECTION ACT 1988

18. DIRECTIONS

19. ENFORCEMENT OF REGULATIONS BY THE REGULATOR

20. APPLICATION TO HIGH COURT

21. APPEALS

22. COOPERATION BETWEEN COMMISSIONER AND REGULATOR

23. AMENDMENTS

24. REPEALS

EXPLANATORY NOTE

STATUTORY INSTRUMENT

S.I. No. 535 of 2003 as amended by S.I. No. 526 of 2008

EUROPEAN COMMUNITIES (ELECTRONIC COMMUNICATIONS NETWORKS AND SERVICES) (DATA PROTECTION AND PRIVACY) REGULATIONS 2003 AS AMENDED BY EUROPEAN COMMUNITIES (ELECTRONIC COMMUNICATIONS NETWORKS AND SERVICES) (DATA PROTECTION AND PRIVACY)(AMENDMENT) REGULATIONS 2008
 

I, Dermot Ahern, Minister for Communications, Marine and Natural Resources, in exercise of the powers referred on me by Section 3 of the European Communities Act, 1972 (No. 27 of 1972) for the purposes of giving effect to Directive No. 2002/58/EC  of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and protection of privacy in the electronic communications sector, hereby make the following Regulations:

I, EAMON RYAN, Minister for Communications, Energy and Natural Resources, in exercise of the powers conferred on me by section 46A of the Communications Regulation Act 2002 (No. 20 of 2002) (as inserted by section14 of the Communications Regulation (Amendment) Act 2007 (No. 22 of 2007))and for the purpose of amending regulations made under section 3 of the European Communities Act 1972 (No. 27 of 1972) giving effect to Directive 2002/58/EC1 of the European Parliament and of the Council of 12 July 2002, hereby make the following Regulations:


1. Citation and commencement

1.(1) These Regulations may be cited as the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003.

(2) These Regulations shall come into operation on 6 November 2003. 


1. (1) These Regulations may be cited as the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) (Amendment) Regulations 2008.
(2) These Regulations come into operation on the day after the date on which notice of their  making is published in the Iris Oifigiúil.

Back to top

2. Interpretation/definitions
[2. In these Regulations, "the Principal Regulations" means the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003 (S.I. No. 535 of 2003).]

2. (1) In these Regulations (except where the context otherwise requires)

"Access Regulations" mean the European Communities (Electronic Communications Networks and Services)(Access) Regulations 2003 (S.I. No. 305 of 2003);

 "Act of 1983" means the Postal and Telecommunication Services Act, 1983 (No. 24 of 1983);

"Act of 2002" means the Communications Regulation Act 2002 (No. 20 of 2002);

"Authorisation Regulations" mean the European Communities (Electronic Communications Networks and Services) (Authorisation) Regulations 2003 (S. I. No. 306 of 2003);

"automatic calling machine" means an automatic calling machine or system which, when activated, operates to make calls without human intervention;

"blocking" in relation to data, means so marking the data that it is not possible to process it for purposes in relation to which it is marked;

"call" means a connection established by means of a publicly available telephone service allowing two-way communication in real time;

"Commissioner" means the Data Protection Commissioner;

"communication" means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service, but does not include any information conveyed as part of a broadcasting service to the public over the electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information; 

"consent" by a user or subscriber means a data subject's consent in accordance with the Data Protection Act 1988 and these Regulations;

"data" means automated data and manual data;

"data controller" means a person who either alone or with others controls the contents and use of personal data;

"Data Protection Directive" means the Directive 95/46/EC  of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

"Data Protection Regulations" mean the European Communities (Data Protection and Privacy in Telecommunications) Regulations 2002 (SI 192 of 2002);

"directory" means a directory of subscribers in printed or electronic form –

(a) that is available to members of the public, or,
(b) information from which is available to members of the public by way of a directory enquiry service;

"Directive" means Directive 2002/58/EC  of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector;

"EEA Agreement" means the Agreement on the European Economic Area signed at Oporto on 2 May 1992 as adjusted by the Protocol signed at Brussels on 17 March 1993;

"electronic mail" means any text, voice, sound or image message including an SMS message sent over a public communications network, which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient;

"enactment" means a statute or an instrument made under or power conferred by statute;

'enforcement notice' means a notice served under Regulation 17(4);


"European Economic Area" has the meaning assigned to it by the EEA Agreement;

"Framework Regulations" mean the European Communities (Electronic Communications Networks and Services) (Framework) Regulations 2003, (S.I. No. 307 of 2003);

'information notice' means a notice served under section 12 of the
Data Protection Act 1988;

"interconnection" means the physical and logical linking of public communications networks used by the same or a different undertaking in order to allow the users of one undertaking to communicate with users of the same or another undertaking, or to access services provided by another undertaking. Services may be provided by the parties involved or other parties who have access to the network. Interconnection is a specific type of access implemented between the public network operators;

"location data" means any data processed in an electronic communications network, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service;

"National Directory Database" means the record of all subscribers of publicly available telephone services in the State, including those with fixed, personal and mobile numbers, who have not refused to be included in that record, kept in accordance with Regulation 4(3) of the Universal Service Regulations and these Regulations;

"operator" means a person designated by the Regulator under Regulation 7(1) of the Universal Service Regulations to provide a universal service (within the meaning of those Regulations) in respect of the directory services referred to in Regulation 4 of those Regulations;

"personal data" means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;

"processing", of or in relation to information or data, means performing any operation or set of operations on the information or data, whether or not by automatic means, including-
(a)  obtaining, recording or keeping the information or data,
(b) collecting organising, storing, altering or adapting the information or data,
(c) retrieving, consulting or using the information or data,
(d) disclosing the information or data by transmitting, disseminating or otherwise making it available, or,
(e) aligning, combining, blocking, erasing or destroying the information or data,
and, cognate words shall be construed accordingly;

"Regulator" means the Commission for Communications Regulation;

"subscriber" means any natural person or legal entity who or which is party to a contract with the provider of publicly available electronic communications services for the supply of such services;

"traffic data" means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof;

"undertaking" means a person engaged or intending to engage in the provision of electronic communications networks or services or associated facilities;

"Universal Service Regulations" mean the European Communities (Electronic Communications Networks and Services) (Universal Service and Users' Rights) Regulations 2003(S.I. No. 308 of 2003);

"unsolicited call" means a call that is not requested by the called party;

"unsolicited communication" means a communication that is not requested by the contacted party;

"user" means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;

"value added service" means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof.

 (2) A word or expression that is used in these Regulations and is also used in the Directive has, unless the context otherwise requires the same meaning that it has in the Directive in these Regulations.

(3)  A word or expression that is used in these Regulations and is also used in the Data Protection Directive, the Data Protection Act 1988 and the Framework Regulations has, unless the context otherwise requires the same meaning that it has in the Data Protection Directive, the Data Protection Act 1988 and the Framework Regulations in these Regulations.

 (4) In these Regulations unless the contrary intention appears:

(a) a reference to a Regulation is a reference to a Regulation in these Regulations, and,

(b) a reference to a paragraph or sub-paragraph is a reference to a paragraph or sub-paragraph of the provision in which the reference occurs.

  (5) In these Regulations a reference to any enactment is to be construed as a reference to the enactment as amended by any subsequent enactment, including these Regulations.

 (6) 

(a) A reference in any enactment to Directive 97/66/EC  of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector is to be construed as a reference to Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and protection of privacy in the electronic communications sector.

(b) A reference in any enactment to the European Communities (Data Protection and Privacy in Telecommunications) Regulation 2002 (S.I. No. 192 of 2002) is to be construed as a reference to these Regulations.

Back to top

3. Services to which these Regulations apply

3. (1) These Regulations apply to the processing of personal data in connection with the provision of publicly available electronic communication services in public communications networks in the State and where relevant the European Community.

 (2) Regulations 8, 10 and 11 apply to subscriber lines connected to digital exchanges, and where technically possible and if they do not require a disproportionate economic effort, to subscriber lines connected to analogue exchanges.

(3) For the purposes of paragraph (2), the Regulator may issue a notice to an undertaking determining whether and what subscriber lines connected to analogue exchanges, operated by that undertaking, are governed by these Regulations.

(4) The Regulator shall notify the European Commission of cases where it would be technically impossible or require a disproportionate economic effort to fulfil the requirements of Regulations 8, 10 and 11.

 (5) (a) These Regulations apply to an undertaking or a person who publishes a directory in respect of the processing of personal data only if -

(i) the undertaking or person is established in the State and the data are processed in the context of that establishment, or

(ii) the undertaking or person is established neither in the State nor in any other state that is a contracting party to the EEA Agreement but makes use of equipment in the State for processing the data otherwise than for the purpose of transit through the territory of the State.

(b) For the purposes of subparagraph (a), each of the following are to be treated as established in the State:

(i) an individual who is normally resident in the State,

(ii) a body incorporated under the law of the State,

(iii) a partnership or other unincorporated association formed under the law of the State, and

(iv) a person who does not fall within sub-paragraph (i), (ii) or (iii) but maintains in the State -

(I) an office, branch or agency through which the person carries on any activity, or

(II) a regular practice,

and the reference to establishment in any other state that is a contracting party to the EEA Agreement is to be construed accordingly.

(c) An undertaking or a person who publishes a directory to whom sub-paragraph (a)(ii) applies shall, without prejudice to any legal proceedings that could be commenced against the provider or person, designate a representative established in the State.

Back to top


4. Security

4.  (1) An undertaking providing a publicly available electronic communications service shall take appropriate technical and organisational measures to safeguard the security of its services, if necessary in conjunction with undertakings upon whose networks such services are transmitted with respect to network security. These measures shall ensure the level of security appropriate to the risk presented, having regard to the state of the art and the cost of their implementation.

(2) In the case of a particular risk of a breach of the security of the public communications network, the undertaking providing the publicly available electronic communications service shall inform its subscribers concerning such risk without delay and where the risk lies outside the scope of the measures to be taken by the relevant service provider, any possible remedies including an indication of the likely costs involved. 

(3) An undertaking whose public communications network is used by another undertaking for the supply of a publicly available electronic communications service shall comply with any reasonable request made by the second undertaking for the purpose of complying with the provisions of this Regulation.

(4) The Regulator subject to Regulation 31 of the Framework Regulations and following consultation with the Commissioner may make such determination of the appropriateness of measures under paragraph (1), as may be required in the event of a dispute.

Back to top


5. Confidentiality of communications

5. (1) A person shall not use an electronic communications network to store information, or to gain access to information stored in the terminal equipment of a subscriber or user, unless-
  
 (a)   the subscriber or user is provided with clear and comprehensive information in accordance with the Data Protection Act 1988, which-

(i) is both prominently displayed and easily accessible, and
(ii) includes, without limitation, the purpose of the processing, and

(b) the subscriber or user is offered by the data controller the right to refuse to consent to that use.

(2) Paragraph 1 does not prevent any technical storage of or access to information for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network or which is strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

(3)   Section 98 of the Act of 1983 does not apply to:

technical storage of communications and the related traffic data which is necessary for the conveyance of a communication without prejudice to the principle of confidentiality.

Back to top


6. Traffic data 

6. (1) Subject to paragraphs (2), (3) and (4), an undertaking shall ensure that traffic data relating to subscribers and users processed and stored for the purpose of the transmission of a communication shall be erased or made anonymous when it is no longer needed for that purpose.

(2) (a) An undertaking may process traffic data necessary for the purpose of subscriber billing and interconnection payments only up to the end of the period in which the bill may be lawfully challenged and payment pursued, or where such proceedings are brought during that period, until those proceedings are finally determined. An undertaking that has not already done so shall within a period of no more than three months after the making of these Regulations inform its subscribers, of the types of traffic data that are processed and of the duration of such processing.

(b) Legal proceedings shall be deemed, for the purposes of this paragraph, to be finally determined -

(i) if no appeal is brought within the ordinary time for an appeal by either party to the proceedings, upon the expiry of that time,

(ii) if an appeal is brought within that time or such extended time as the court to which the appeal is brought may allow, upon the date of the determination of the appeal or any further appeal therefrom or the ordinary time for instituting any further appeal has expired or such other date as may be determined by the court hearing any such appeal, whichever is the latest, or

(iii) if an appeal has been brought and is withdrawn, upon the date of the withdrawal of the appeal.

(3) (a) An undertaking may process traffic data referred to in paragraph (1) for the purposes of marketing electronic communications services or for the provision of value added services to the extent and for the duration necessary for such service or marketing, provided the subscriber or user to whom the data relates has given his or her consent. Prior to obtaining consent, the undertaking shall inform the subscriber or user of the types of traffic data which are processed and of the duration of such processing.

 (b) An undertaking that has not already done so shall within a period of no more than three months after the making of these Regulations inform their subscribers or users of processing already under way on the making of these Regulations of any data relating to the subscriber or user and of the provisions of sub-paragraph (c).

 (c) If the subscriber or user concerned does not object to such processing within a period of 2 months of being informed thereof, the subscriber is deemed to have consented to such processing.

(4) An undertaking shall ensure that the processing of traffic data in accordance with paragraphs (1), (2) and (3) is restricted to persons acting under its authority handling billing or traffic management, customer enquiries, fraud detection, the marketing of electronic communication services or providing a value added service and such processing is restricted to what is necessary for the purpose of such activities.

(5) An undertaking shall ensure that users or subscribers are given the possibility to withdraw their consent for processing of traffic data for the purposes of paragraph (3) at any time.

(6) Nothing in these Regulations precludes a court or any other body involved in the settlement of disputes (whether by way of legal proceedings or otherwise) pursuant to any enactment from being informed of traffic data for the purpose of settling such disputes, in particular, disputes relating to billing or interconnection.

Back to top


7. Itemised billing

7. (1) An undertaking shall comply with a request of a subscriber to that undertaking to give him or her bills that are not itemised in respect of the electronic communications service supplied by the undertaking to the subscriber.

 (2) The Regulator and the Commissioner shall, in the performance of their functions, have regard to the need to reconcile the rights of subscribers to receive itemised bills with the right to privacy of calling users and called subscribers.

Back to top


8. Presentation and restriction of calling and connected line identification

8. (1) Where presentation of calling line identification is offered by an undertaking,

(a) the undertaking shall offer the calling user the possibility, using a simple means and free of charge, of preventing the presentation of the calling line identification on a per call basis. The undertaking shall offer the calling subscriber this option on a per-line basis.

(b) the undertaking shall offer the called subscriber the possibility, using a simple means, free of charge for reasonable use of this function, of preventing the presentation of the calling line identification of incoming calls.

(c)  the undertaking shall where the calling line identification is presented prior to the call being established, offer the called subscriber the possibility, using simple means, of rejecting incoming calls where the presentation of the calling line identification has been prevented by the calling user or subscriber.

(2) Where presentation of connected line identification is offered, the undertaking shall offer the called subscriber the possibility, using a simple means and free of charge of preventing the presentation of the connected line identification to the calling user.

(3) Subparagraph (1)(a) also applies with regard to calls to third countries originating in the State or transiting through the State having originated in another Member State of the EEA.

(4) Paragraphs (1)(b) and (c) and paragraph (2) apply also to incoming calls originating in third countries.

(5) An undertaking that offers the presentation of calling line or connected line identification and that has not already done so shall inform the public thereof and of the possibilities contained in paragraphs (1) and (2) by publishing a notice stating how that information may be obtained.

(6) An undertaking to whom paragraph (1) or (2) applies shall display the information referred to in paragraph (5) in any of his, her or its offices that are normally accessed by members of the public for the purpose of transacting business with the provider, on any appropriate website maintained by the provider and where appropriate, in a directory.

Back to top


9. Location data other than traffic data

9. (1) No person shall process location data other than traffic data relating to users or subscribers of undertakings unless,

(a) such data are made anonymous or,

(b) they have obtained the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service.

(2) An undertaking that has not already done so shall inform its users or subscribers, prior to obtaining their consent, of the type of location data other than traffic data which will be processed, of the purposes and duration of the processing and whether the data will be transmitted to a third party for the purpose of providing the value added service.

(3) An undertaking shall give users or subscribers the possibility to withdraw their consent for the processing of location data other than traffic data at any time by making a request that such processing be stopped.

(4) Where the consent of users or subscribers has been obtained for the processing of location data other than traffic data an undertaking shall give the user or subscriber the possibility, using a simple means and free of charge, of temporarily refusing the processing of such data for each connection to the public communications network or for each transmission of a communication. 

(5) An undertaking shall ensure that the processing of location data other than traffic data in accordance with paragraphs (1), (2) and (4) is restricted to persons acting under the authority of the undertaking or of the third party providing the value added service based on data provided by that undertaking and shall be restricted to what is necessary for the purposes of providing the value added service.

Back to top


10. Exceptions [revoked]

Back to top


11. Automatic call forwarding

11. (1) (a) An undertaking shall ensure that calls automatically forwarded to a subscriber's terminal as a result of action by a third party shall, without charge, upon a request being made to the undertaking by the subscriber to do so, cease to be so forwarded as soon as practicable after receipt of such a request.

  (b) An undertaking that has not already done so shall inform its subscribers of the requirements of paragraph (a).

(2) An undertaking whose network is interconnected with the network to which the line of the subscriber concerned is connected shall within 48 hours, comply with any reasonable request made by another undertaking for the purpose of complying with paragraph (1).

Back to top


12. Directories of subscribers

12. (1) An undertaking referred to in Regulation 21(1) or 21(2) of the Universal Service Regulations shall ensure that all its subscribers are, without charge -

  (a) informed before they are included in any directory in which their personal data can be included, for which it provides relevant information in accordance with that Regulation, about the purposes of such a directory and any further usage possibilities based on search functions embedded in electronic versions of that directory.

 (b) given the opportunity to determine whether their personal data are included in that directory.

 (c) given the opportunity to determine which of their personal data are included in a directory to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory and to verify, correct or withdraw such data.

 (2) Any other person responsible for the collection and making available of subscriber's data for inclusion in any other directory of subscribers, shall ensure that the subscribers are, without charge -

 (a) informed before they are included in any such directory in which their personal data can be included, about the purposes of such a directory and any further usage possibilities based on search functions embedded in electronic versions of the directory.

   (b) given the opportunity to determine whether their personal data are included in that directory.

   (c) given the opportunity to determine which of their personal data are included in a directory to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory and to verify, correct or withdraw such data.

 (3) (a) An undertaking referred to in Regulation 21(1) or 21(2) of the Universal Service Regulations shall ensure that its subscribers other than natural subscribers are, without charge, provided with the information referred to in paragraph (1)(a) and the opportunities referred to in paragraphs (1)(b) and (1)(c) notwithstanding the fact that the data may not be personal data.

  (b) Any other person responsible for the collection and making available of data for inclusion in any other directory of subscribers, shall ensure that subscribers other than natural subscribers are, without charge, provided with the information referred to in paragraph (2)(a) and the opportunities referred to in paragraphs (2)(b) and (2)(c) notwithstanding the fact that the data may not be personal data.

(4) Without prejudice to the rights of subscribers in respect of subsequent editions, paragraphs (1), (2) and (3) do not apply to editions of directories already produced or placed on the market in printed or off-line electronic form before the commencement of these Regulations.

(5) (a) The personal data of subscribers to fixed or mobile public voice telephony services which have been included in a directory, in conformity with the Data Protection Act 1988 and Regulation 8 of the Data Protection Regulations, before the commencement of these Regulations, may remain included in such directory in its printed or electronic versions, including versions with reverse search functions, unless subscribers indicate otherwise after having received complete information about the purpose of the directory and the options available in accordance with this Regulation.

 (b) An undertaking referred to in paragraph (1) or (3)(a) and a person referred to in paragraph (2) or (3)(b) that has not already done so shall, prior to publication of the next issue of that Directory, provide to the subscribers concerned complete information about the purpose of such a directory and any further usage possibilities based on search functions embedded in electronic versions of the directory and of the provisions of paragraphs (1), (2), and (3) and sub-paragraph (c).

 (c) If the subscriber concerned having received complete information in accordance with subparagraph (b) does not indicate within a period of two months of being informed thereof, that they have determined that they do not want their personal data to remain included in the directory the subscriber is deemed to have consented to such processing.

(6) A subscriber may request the relevant undertaking or person to disregard or reverse the effect of a determination previously made by the subscriber to the undertaking under paragraph (2), (3) or (5).

(7)  The relevant undertaking or person shall comply with any notification of a determination made, or deemed to have been made, to that undertaking or that person under paragraph (1), (2), (3), (5) or (6).

(8) A reference in the Universal Service Regulations to Regulation 8 of the Data Protection Regulations shall be read as a reference to this Regulation.

Back to top

13. Unsolicited communications
 
13.  (1) (a) A person shall not use or cause to be used any publicly available electronic communications service to send an unsolicited communication for the purpose of direct marketing by means of an automated calling machine or facsimile machine (fax), to the line of a subscriber, who is a natural person, unless the person has been notified by that subscriber that for the time being he or she consents to the receipt of such a communication.

(b) A person shall not use or cause to be used any publicly available electronic communications service to send an unsolicited communication for the purpose of direct marketing by means of electronic mail, to a subscriber, who is a natural person, unless the person has been notified by that subscriber that for the time being he or she consents to the receipt of such a communication. 

(2) A person shall not use, or cause to be used, any publicly available electronic communications service to make an unsolicited call for the purpose of direct marketing by means of an automated calling machine or a facsimile machine to the line of a subscriber, other than a natural person, where -

(a) the subscriber has notified the person that the subscriber does not consent to the receipt of such a call on the line, or

(b) subject to paragraph (5), the relevant information referred to in Regulation 14(3) is recorded in respect of the line in the National Directory Database.

(3) A person shall not use, or cause to be used, any publicly available electronic communications services to send an unsolicited communication for the purpose of direct marketing by means of electronic mail, to a subscriber, other than an individual, where the subscriber has notified the person that the subscriber does not consent to the receipt of such a communication on the line. 

(4) A person shall not use, or cause to be used, any publicly available electronic communications service to make an unsolicited telephone call for the purpose of direct marketing to the line of a subscriber, where -

(a)  the subscriber has notified the person that the subscriber does not consent to the receipt of such a call on his, her or its line, or

(b) subject to paragraph (5), the relevant information referred to in Regulation 14(3) is recorded in respect of the line in the National Directory Database.

(5) A person will not contravene paragraph (2)(b) or (4)(b) if the unsolicited call concerned is made during the period of 28 days after a request under Regulation 14 is received and recorded in the National Directory Database by the operator in relation to the subscriber concerned in respect of the line on which the call is made.

(6) (a) A person who uses, or causes to be used, any publicly available electronic communications service to make an unsolicited call for the purpose of direct marketing shall include in such a call the name of the person and, in addition, in the case of a call by means of an automatic calling machine or a facsimile machine or if a person who receives the call so requests, either the address of the first-mentioned person or a telephone number for a line on which that person may be contacted.

 (b) A person who uses, or causes to be used, any publicly available electronic communications service to send an unsolicited communication for the purpose of direct marketing shall include in such a communication the name of the person and, in addition, in the case of a communication by email, a valid address at which that person may be contacted.

(7) A person who, in accordance with the Data Protection Act 1988, the Data Protection Regulations or these Regulations, obtains from a customer the customer's contact details for electronic mail, in the context of the sale of a product or service, shall not use those details for direct marketing unless-

(a) the product or service is the person's own product or service, and

(b) the product or service is of a kind similar to that supplied to the  customer in the context of the sale by the person, and

(c) the customer is clearly and distinctly given the opportunity
to object, in an easy manner and without charge, to the use
of those details-
(i) at the time they are collected, and
(ii) if the customer has not initially refused that use, each time the person sends a message to the customer.

(8)  A person shall not send electronic mail for the purposes of direct marketing, which disguises or conceals the identity of the sender on whose behalf the communication was made, or without a valid address to which the recipient may send a request that such communication shall cease.

(9)  A person who-
(a) contravenes paragraph (1)(a) or (b), or (2), (3), (4), (7) or (8), or

(b) fails to comply with paragraph (6)(a) or (b),

                      commits an offence.

(9A)  In relation to a contravention or failure to comply referred to in paragraph (9), each unsolicited communication or electronic mail sent, or each unsolicited call made, is to be treated as a separate offence.

(9B)  An offence under this Regulation is triable either summarily
or on indictment.

(9C)  If, in proceedings for an offence under this Regulation, the
question of whether or not a subscriber consented to receiving an
unsolicited communication or call is in issue, the onus of establishing
that the subscriber consented to receipt of the communication or call
lies on the defendant.

(9D)  A person found guilty of an offence under this Regulation is
liable on conviction-

(a) if the person is tried summarily, to a fine not exceeding €5,000, or

(b) if the person is a body corporate and the offence is tried on indictment, to a fine not exceeding-

(i) €250,000, or

(ii) if 10 per cent of the turnover of the person is greater than that amount, an amount equal to that percentage, or

(c) if the person is a natural person and the offence is tried on indictment, to a           fine not exceeding €50,000

(10)      [deleted] 

(11)  Where a person is convicted of an offence under this Regulation, the court may order any data material, which appears to the court to be connected with the offence to be forfeited or destroyed and any relevant data to be erased.

(12)  The court shall not make an order under paragraph (11) in relation to data material or data where it considers that some person other than the person convicted of the offence concerned may be the owner of, or otherwise interested in, the data unless such steps as are reasonably practicable have been taken for notifying that person and giving him or her an opportunity to show cause why the order should not be made.

(13) For the purposes of this Regulation, personal data shall be deemed to include a phone number or an e-mail address of a subscriber.

Back to top


14. National Directory Database (NDD)

14. (1) An undertaking referred to in Regulation 21(1) or 21(2) of the Universal Service Regulations shall, for the purposes of Regulation 13(2)(b) or 13(4)(b), record or cause to be recorded in the National Directory Database the relevant information specified in paragraph (2) in respect of a line of any one of its subscribers who –

  (a) is, upon the making of these Regulations, an unlisted subscriber in respect of that line,

  (b) had at any time after the establishment of that Database, made a request to the operator or notified the relevant undertaking, that the subscriber does not consent to unsolicited calls for the purpose of direct marketing or to such calls by means of an automated calling machine or a facsimile machine to a line of that subscriber.

(2) An undertaking referred to in Regulation 21(1) or 21(2) of the Universal Service Regulations that has not already done so shall, ensure that its subscribers are, provided with information regarding their entitlements under Regulations 13(1)(a), 13(2)(b) and 13(4)(b), and the possibilities referred to in Regulation 14(1).

(3) An undertaking referred to in Regulation 21(1) or 21(2) of the Universal Service Regulations shall, for the purposes of Regulation 13(2)(b) and 13(4)(b) and when so notified by any one of its subscribers, make available to the operator the following relevant information in respect of a line of that subscriber to be recorded in the entry in the National Directory Database in relation to that subscriber:

(a) the fact that the subscriber does not consent to unsolicited telephone calls for the purpose of direct marketing or to such calls by means of automated calling machines or facsimile machines.

(b) if appropriate, the date on which a notification under Regulation 13(2)(b) or 13(4)(b) was received by the operator.

 (4) (a) An undertaking, for the purposes of Regulation 13(2)(b) or 13(4)(b), shall, as soon as practicable after having been notified under paragraph (1), that a subscriber does not consent to unsolicited telephone calls for the purpose of direct marketing or to such calls by means of automated calling machines or facsimile machines transmit particulars of such notification to the operator or other person who publishes a directory to whom the undertaking supplies relevant information relating to its subscribers for inclusion in that directory.

 (b) When the operator or other person who publishes a directory receives particulars of a notification under paragraph (1), the notification shall be deemed, for the purposes of this Regulation, to have been made to the operator or that other person at the time the operator or that other person receives particulars of it.

 (5) The operator shall record, the relevant information referred to in paragraph (3) in respect of a line of a subscriber, in the entry in the National Directory Database in relation to that subscriber, when it made available to the operator.

(6) (a) For the purpose of complying with Regulation 13(2)(b) or 13(4)(b), a person may, on such terms and conditions as may be approved under Regulation 4(3) of the Universal Service Regulations and on payment to the operator of such fee as may be required by the operator

(i) be allowed access to the National Directory Database at all reasonable times and take copies of, or of extracts from, entries
 in that Database, or

(ii) obtain from the operator a copy (certified by the operator or by a member of the operator's staff to be a true copy) of, or of an extract from, any entry in the National Directory Database,

or both, but the operator shall refuse such inspection or copying of, or of extracts from, entries in the National Directory Database if the operator has reasonable grounds to believe that the person will not comply with the Data Protection Act 1988 and these Regulations in respect of the information in that Database.

(b) A subscriber, or other person with the written consent of the subscriber, may -

(i) be allowed access to the entry in the National Directory Database in relation to that subscriber in respect of a particular line of the subscriber at all reasonable times and, on payment to the operator of such fee as may be required by the operator, take a copy of that entry, or

(ii) on payment to the operator of such fee as may be required by the operator, obtain from the operator a copy (certified by the operator or by a member of the operator's staff to be a true copy) of that entry,

  or both.

(c) In any proceedings -

(i) a copy of, or of an extract from, an entry in the National Directory Database certified by the operator or by a member of the operator's staff to be a true copy is evidence of the entry or extract on the date that it is so certified, and

(ii) a document purporting to be such a copy, and to be certified, as aforesaid is deemed to be such a copy and to be so certified unless the contrary is proved.

(d) In any proceedings -

(i) a certificate signed by the operator or by a member of the operator's staff of an entry in the National Directory Database in relation to a specified subscriber in respect of a particular line is evidence of the entry on the date that it is so certified, and

(ii) a document purporting to be such a certificate, and to be signed, as aforesaid is deemed to be such a certificate and to be so signed unless the contrary is proved.

(7) (a) Subject to subparagraph (c), the operator may require the payment of fees in respect of the matters referred to in paragraph (6)(a) or (6)(b), and the amount of those fees shall be designed to secure, as nearly as may be and taking one year with another, that the aggregate amount of fees received, or reasonably expected to be received, equals the costs incurred, or reasonably expected to be incurred, by the operator in performing the functions conferred on the operator by this Regulation.

 (b) Different fees may be required in respect of the matters referred to in paragraphs (6)(a) and (6)(b),

 (c) The amount of the fees required under subparagraph (a) is subject to the approval of the Regulator.

(8) A reference in the Universal Service Regulations to Regulation 10 of the Data Protection Regulations shall be construed as a reference to this Regulation.

Back to top

15. Technical Features and Standardisation

15. (1) In implementing these Regulations the Regulator shall ensure subject to paragraphs (2) and (3) that no mandatory requirements for specific technical features are imposed on terminal or other electronic communication equipment, which could impede the placing of equipment on the market and the free circulation of such equipment in the European Community.

 (2) Where these Regulations can be implemented only by requiring specific technical features in electronic communications networks, the Regulator shall inform the Commission in accordance with the procedure provided for by Directive 98/34/EC  of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services.

 (3) The Regulator shall make such determinations or issue such directions as may be necessary for the purposes of requiring any specific technical features in electronic communications networks necessary under paragraph (1).

Back to top


16. Damages for contravention of Regulations

16. (1) A person who suffers loss and damage as a result of a contravention of any of the requirements of these Regulations by any other person shall be entitled to damages from that other person for that loss and damage.

  (2) In legal proceedings seeking damages against a person under these Regulations, it is a defence for a person to provide that he, she or it had taken all reasonable care in the circumstances to comply with the requirement concerned.

Back to top


17. Enforcement of Regulations by Commissioner

17.       (1)   The Commissioner may investigate, or cause to be investigated, whether any prescribed provision of these Regulations has been, is being or is likely to be contravened or not complied with in relation to a natural person. The power may be exercised either as a result of a complaint made by or on behalf of the person or on the Commissioner's own initiative as a result of forming an opinion that there may be such a contravention.
(2)   Unless of the opinion that a complaint made under paragraph (1) is frivolous or vexatious, the Commissioner shall ensure that the complaint is investigated as soon as practicable after it is received, having regard to the Commissioner's responsibilities under the Data Protection Act 1988.

(3)   If, after the elapse of a reasonable time, the Commissioner is unable to bring about the amicable resolution of the matter to which a complaint relates (other than a complaint giving rise to the commission of an offence), the Commissioner shall notify the person concerned in writing of the Commissioner's decision in relation to the matter. The notice must include a statement to the effect that, if the person is dissatisfied with the Commissioner's decision, the person has a right to appeal to the Circuit Court under Regulation 17D against the decision within 21 days after the date on which the decision is notified to the person under this paragraph.

(4)   If the Commissioner is of opinion that a person has contravened or not complied with, or is contravening or not complying with, a prescribed provision of these Regulations (other than one giving rise to the commission of an offence), the Commissioner may serve on the person an enforcement notice requiring the person to take, within a specified period, such steps as are specified in the notice.

(5)  An enforcement notice-
(a) shall specify the prescribed provision of these Regulations (if any) that, in the opinion of the Commissioner, has been, or is being, contravened or not complied with and the reasons for having formed that opinion, and

(b) subject to paragraph (7), shall state that the person concerned has a right to appeal to the Circuit Court under Regulation 17D against the requirement specified in the notice within 21 days from the service of the notice on that person.

(6) Subject to paragraph (7), the time specified in an enforcement notice for compliance with a specified requirement may not be expressed to expire until after the period of 21 days referred to in paragraph (5)(b). If the requirement subsequently becomes the subject of an appeal, the requirement need not be complied with (and paragraph (10) does not apply in relation to it), pending the determination or withdrawal of the appeal.

(7) Paragraphs (5)(b) and (6) do not apply to an enforcement notice if the  Commissioner-

(a) because of special circumstances, is of the opinion that a requirement specified in an enforcement notice should be complied with without delay, and

(b) includes a statement to that effect in the notice.

In that case, however, the enforcement notice shall contain a statement specifying the effect of Regulation 17D (paragraphs (3) and (4) excepted) and may not require compliance with the requirement before the expiry of 7 days beginning on the date on which the notice was served.

(8) As soon as practicable after complying with paragraph (4) (and in any case not later than 40 days after so complying), a data controller shall notify the blocking, rectification, erasure, destruction or statement concerned-

(a) to the data subject concerned, and

(b) if compliance materially modifies the data concerned and notification is not impossible and does not involve disproportionate effort, to any person to whom the data was disclosed during the period beginning 12 months before the date of the service of the relevant enforcement notice and ending immediately before that compliance. However, a data controller is not required to attempt to comply with subparagraph (b) if notification would be impossible or would involve disproportionate effort by the controller.

(9) The Commissioner may cancel an enforcement notice and, on doing so, shall by notice in writing notify the cancellation to the person concerned.

(10) A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an enforcement notice commits an offence.

(11) For the purposes of this Regulation, Regulations 5, 6, 9, 12, 13 and 14 are prescribed provisions.

Back to top

17A. Power to require information
17A. (1) The Commissioner may serve an information notice on a person requiring the person to give to the Commissioner in writing such information in relation to matters specified in the notice as is necessary or expedient for the performance of the Commissioner's functions.

(2) An information notice shall state that the person concerned has a right to appeal to the Circuit Court under Regulation 17D against the requirement specified in the notice and that, if the right is to be exercised, it must be exercised within 21 days from the date on which the notice is served on that person.

(3) A person to whom a notice is given under paragraph (1) shall, to the extent that it is possible to do so, comply with the notice within the period specified in the notice. That period may not be less than 21 days from the giving of the notice.

(4) If an appeal is brought under Regulation 17D against a requirement specified in the notice, then pending the determination or withdrawal of the appeal-

(a) the requirement need not be complied with, and

(b) paragraph (8) does not apply to a failure to comply with the requirement.

(5) Paragraph (4) does not apply to an information notice if the Commissioner-

(a) because of special circumstances, is of opinion that a requirement specified in the notice ought to be complied with without delay, and

(b) includes in the notice a statement to that effect.

In that case, the notice shall contain a statement specifying the effect of
Regulation 17D (paragraphs (3) and (4) excepted) and provide that compliance
with the requirement may not be required before the expiry of 7 days
beginning on the date on which the notice was served.

(6) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from giving to the Commissioner information necessary or expedient for the performance or exercise of the Commissioner's functions.

(7) Paragraph (6) does not apply to information that in the opinion of the Minister for Justice, Equality and Law Reform or the Minister for Defence is, or at any time was, kept for the purpose of safeguarding the security of the State or information that is privileged from disclosure in proceedings in a court

(8) A person who-
 (a) without reasonable excuse, fails or refuses to comply with a requirement specified in an information notice, or

(b) in purported compliance with such a requirement, gives information to the Commissioner that the person knows to be false or misleading in a material respect, commits an offence.

Back to top

17B. Powers of authorised officers
17B. (1) In this section 'authorised officer' means a person authorised in writing by the Commissioner under the Data Protection Act 1988 to exercise the powers conferred by section 24 of that Act or these Regulations, or both.

(2) An authorised officer may, for the purpose of obtaining information that is necessary or expedient for the performance of the Commissioner's functions under these Regulations, do all or any of the following:

(a) at any reasonable time-

(i) enter premises that the officer reasonably believes to be occupied by a data controller or a data processor,

(ii) inspect the premises and any data located on the premises (other than data consisting of information specified in Regulation 17A(7)), and

(iii) inspect, examine, operate and test any data equipment located on the premises;

(b) require any relevant person (data controller or data processor, or an employee of either of them)-

(i) to disclose to the officer any such data and produce to the officer any data material (other than data material consisting of information so specified) that is within the power or under
the control of that person, and

(ii) to give to the officer such information as the officer reasonably requires in relation to the data or material;

(c) either on the premises or elsewhere, inspect and copy or extract information from those data, or inspect and copy or take extracts from that material;

(d) require any relevant person to give to the officer such information as the officer reasonably requires in relation to-

(i) the procedures employed for complying with the provisions of these Regulations and the Data Protection Act 1988, and

(ii) the sources from which those data are obtained, and

 (iii) the purposes for which they are kept, and

(iv) the persons to whom they are disclosed, and

(v) the data equipment kept on the premises.

(3) A person commits an offence if the person-

(a) obstructs or impedes an authorised officer in the exercise of a power conferred by this Regulation, or

(b) without reasonable excuse, does not comply with a requirement imposed by such an officer under this Regulation, or

(c) in purported compliance with such a requirement, gives information to such an officer that the person knows to be false or misleading in a material respect.

Back to top

17C. Service of notices
17C. Any notice authorised by these Regulations to be served on a person by the Commissioner may be served-

(a) if the person is a natural person-

(i) by delivering it to the person personally, or

(ii) by sending it to the person by post addressed to the person at the person's usual or last-known place of residence or business, or

(iii) by leaving it for the person at that place,

(b) if the person is a body corporate or an unincorporated body of persons-by sending it to the body by post to, or addressing it to and leaving it at-

(i) in the case of a company, its registered office, and

(ii) in any other case, the principal place of business of the body.

Back to top

17D. Appeals to Circuit Court
17D. (1) An appeal may be made to and heard and determined by the Circuit Court against-

(a) a requirement specified in an enforcement notice or an information notice, or

(b) a decision of the Commissioner in relation to a complaint made under Regulation 17.

(2) Such an appeal may be brought only within 21 days from the service on the person concerned of the relevant notice or the receipt by that person of the notification of the relevant decision.

(3) The jurisdiction conferred on the Circuit Court by these Regulations is exercisable by the judge for the time being assigned to the circuit where the appellant ordinarily resides or carries on any profession, business or occupation or, at the option of the appellant, by a judge of that Court for the time being assigned to the Dublin Circuit.

(4) Subject to paragraph (5), a decision of the Circuit Court under this Regulation or Regulation 17E is final.

(5) An appeal may be brought to the High Court on a point of law against such a decision; in which case a reference in these Regulations to the determination of an appeal is to be read as including a reference to the determination of the appeal to the High Court and of any appeal from the decision of that Court.

Back to top

17E. Circumstances in which person need not comply with enforcement or information notice
17E. If-

(a) a person appeals to the Circuit Court under Regulation 17D, and

(b) the appeal is brought within the period specified in the relevant enforcement or information notice, and

(c) the Commissioner has included in that notice a statement to the effect that, because of special circumstances, the Commissioner is of the opinion that the person should comply with the requirement specified in that notice urgently and that that notice should therefore have immediate effect,

the Court may, on application made to it for the purpose, make an order determining that non-compliance by the person with the requirement does not constitute an offence pending determination or withdrawal of the appeal or during such other period as may be specified in the order. An order may be made under this Regulation despite any other provision of these Regulations to the contrary.

Back to top

17F. Evidence in legal proceedings
17F. (1) In any legal proceedings-

(a) a certificate signed by the Minister for Justice, Equality and Law Reform or the Minister for Defence and stating that in the opinion of the Minister concerned personal data are, or at any time were, kept for the purpose of safeguarding the security of the State is evidence of that opinion, or

(b) a certificate-

  (i) signed by an authorised person, and

(ii) stating that, in the person's opinion, a disclosure of personal data is required for that purpose,

is evidence of that opinion.

(2) A document purporting to be a certificate under subparagraph (a) or (b) of paragraph (1) and to be signed by a person specified in the relevant subparagraph is taken to be such a certificate and to be so signed unless the contrary is proved.

(3) Information supplied by a person in compliance with a request made under the Data Protection Act 1988, or a requirement imposed, or a direction of a court in proceedings, under these Regulations is not admissible in evidence against the person or the person's spouse in proceedings for an offence under these Regulations.

(4) For the purpose of paragraph (1)(b), a person is an authorised person if the person  is-

(a) a member of the Garda Síochána not below the rank of chief superintendent, or

(b) an officer of the Permanent Defence Force who holds an army rank not below that of colonel and is designated by the Minister for Defence under section 8(a) of the Data Protection Act 1988.

Back to top

17G. Hearing of proceedings in private
17G. The whole or any part of proceedings under these Regulations may, if the court thinks appropriate, be heard otherwise than in public.

Back to top

17H. Offences by officers of bodies corporate
17H. (1) If an offence under these Regulations-

(a) has been committed by a body corporate, and

(b) is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of, an officer of the body,

that officer commits a separate offence and is liable to be proceeded against
and punished as if that person had committed the first-mentioned offence.

(2) If the affairs of a body corporate are managed by its members, paragraph (1) applies to the acts and defaults of a member in connection with the member's functions of management as if the member were a director or manager of the body corporate.

(3) An officer of a body corporate may be proceeded against for an offence under paragraph (1) whether or not the body corporate has been proceeded against or been convicted of the offence committed by the body.

(4) In this Regulation, 'officer', in relation to a body corporate, means a director, manager, secretary or other officer of the body, or a person who is purporting to act in any such capacity.

Back to top

17I. Prosecution of offences
17I. (1) The Commissioner may bring and prosecute proceedings for an offence under these Regulations that is to be tried summarily.

(2) Paragraph (1) does not limit any other power conferred by law to prosecute an offence under these Regulations.

(3) If of the opinion that the circumstances relating to a complaint investigated under Regulation 17 involve the commission of an offence under these Regulations, the Commissioner may bring and prosecute proceedings for the offence without attempting to bring about an amicable resolution of the complaint.

(4) Despite section 10(4) of the Petty Sessions (Ireland) Act 1851, summary proceedings for an offence under these Regulations may be brought within 2 years after the date on which the offence is alleged to have been committed.

Back to top

17J. Penalties for offences under the Regulations
17J. (1) Except as provided by Regulation 13, a person found guilty of an offence under these Regulations is liable on summary conviction to a fine not exceeding €5,000.

(2) If a person is convicted of an offence under these Regulations, the court may order any data material that appears to it to be connected with the commission of the offence to be forfeited or destroyed and any relevant data to be erased.

(3) The court may not make such an order in relation to data material or data if it considers that some person other than the person convicted of the offence concerned might be the owner of, or have a proprietary interest in, the data unless all reasonably practicable steps have been taken-

(a) to notify the person of the proposed forfeiture, destruction or erasure, and

(b) to give the person an opportunity to show cause why the order should not be made.

Back to top

17K. Obtaining consent to obtaining, recording and rescinding consent of subscribers
17K. For the purpose of Regulations 5, 6, 9, 12, 13 and 14, the Commissioner, in consultation with the Regulator, may specify the form and other requirements regarding obtaining,  recording and rescinding consents of subscribers and users for the purposes of these Regulations.

Back to top

17L. Power to include requirements under these Regulations in Codes of Practice under the Data Protection Act 1988
17L. The Commissioner's functions under section 13 of the Data Protection
Act 1988 extend to requirements imposed under these Regulations.

Back to top


18. Directions

18. The Regulator may, for the purpose of further specifying requirements to be complied with relating to an obligation imposed by or under these Regulations, issue directions to an undertaking to do or refrain from doing anything which the Regulator specifies in the direction.

Back to top


19. Enforcement of Regulations by the Regulator

19. (1) Subject to the performance by the Commissioner of the functions under Regulation 17, it shall be a function of the Regulator to monitor compliance with Regulations 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 and 15 and to issue such directions as may be necessary, from time to time, for their effective implementation. The Regulator, in consultation with the Commissioner, may also specify the form and any other requirements regarding the obtaining, recording and rescinding of consent of subscribers for the purposes of these Regulations.
 
 (2) The functions of the Regulator under this Regulation shall be deemed to be included in the functions conferred on the Regulator under the Communications (Regulation) Act 2002 (No. 20 of 2002).

 (3) The Regulator may give directions to a person to whom Regulation 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 or 15 applies requiring the person to take specified measures or to refrain from taking specified measures for the purpose of complying with the provision.

 (4) A person to whom Regulation 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 or 15 applies shall furnish the Regulator with such information as the Regulator may reasonably require for the purposes its functions under these Regulations.

 (5) Where the Regulator issues a direction under this Regulation, such direction shall be in writing, state the reasons on which it is based and be addressed to the person or company concerned, and as soon as practicable, be sent or given in any of the following ways-

(a) by delivering it to the person,

(b) by leaving it at the address at which the person carries on business,

(c) by sending it by pre-paid registered post to the address at which the person carries on business,

(d) if an address for the service of directions has been furnished by the person to the Regulator, by leaving it at, or sending it by pre-paid registered post to, that address, or

 (e) in any case where the Regulator considers that the immediate giving of the direction is required, by sending it, by means of a facsimile machine or by electronic mail, to a device or facility for the reception of facsimiles or electronic mail located at the address at which the person ordinarily resides or carries on business or, if an address for the service of notices has been furnished by the person, that address, provided that the sender's facsimile machine generates a message confirming successful transmission of the total number of pages of the direction or the sender's facility for the reception of electronic mail generates a message confirming receipt of the electronic mail.

 (6) For the purposes of paragraph (5), a company within the meaning of the Companies Acts 1963 to 2001 shall be deemed to be carrying on business at its registered office, and any other body corporate or any unincorporated body shall be deemed to be carrying on business at its principal office or place of business.

Back to top


20. Application to High Court

20. (1) Where the Regulator finds that a person has not complied with an obligation under these Regulations or a direction under Regulation 19(1), notify the person of those findings and give the person an opportunity to state his or her views or remedy any non-compliance not later than –

(a) one month after issue of the notification, or

 (b) such shorter period as is agreed by the Regulator with the person concerned or stipulated by the Regulator in case of repeated non-compliance, or

  (c) such longer period as may be specified by the Regulator.

(2) The Regulator may publish, in such manner as it thinks fit, any notification given by it under this Regulation, subject to the protection of the confidentiality of any information, which the Regulator considers confidential. 

 (3) The Regulator may amend or revoke any notification under this Regulation.

 (4) Where, at the end of the period referred to in paragraph (1), the Regulator is of the opinion that a person has not complied with the obligation or the direction, the Regulator may apply to the High Court for such order as may be appropriate to compel compliance with the obligation or direction. The Court may, as it thinks fit, on the hearing of the application make an order compelling compliance with the obligation or direction or refuse the application. An order compelling compliance shall stipulate a reasonable period for the person to comply with the obligation or direction.

 (5) An application for an order under paragraph (4) shall be by motion and the Court when dealing with the matter may make such interim or interlocutory order, as it considers appropriate.

 (6) The Court shall not deny any interim or interlocutory relief referred to in paragraph (5) solely on the basis that the Regulator may not suffer any damage if such relief were not granted pending conclusion of the action.
 
 (7) (a) An application for an order under paragraph (4) may include an application for an order to pay to the Regulator such sum as the Regulator may propose as appropriate in the light of the non-compliance.

  (b) In deciding on the application for an order under paragraph (4), the court shall decide what sum (if any) should be payable and shall not be bound by the sum proposed by the Regulator.

  (c) Any sum ordered by the court to be paid by a person against whom an order may be sought shall be retained by the Regulator as income.

  (d) In deciding what sum (if any) should be payable, the court shall consider the circumstances of the non-compliance, including -

(i) its duration,

(ii) the effect on consumers, users and other operators,
 
(iii) the submissions of the Regulator on the appropriate sum, and

(iv) any excuse or explanation for the non-compliance. 

Back to top


21. Appeals

21. Regulation 3 of the Framework Regulations also applies to any user or any undertaking that is affected by a decision, designation, determination, specification, requirement direction or any other act of an equivalent nature of the Regulator under these Regulations.

Back to top


22. Cooperation between Commissioner and Regulator
 
22. The Commissioner and the Regulator shall, in the performance of their functions under these Regulations, cooperate with and provide assistance to each other.

Back to top


23. Amendments

23. (1) Amendment of the Data Protection Acts 1988 and 2003 -
  
In Section 14(1) of the Data Protection Act 1988 (as amended by the Data Protection Act 2003) by the substitution of "activities under the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003 and this Act" for "activities under the European Communities (Data Protection and Privacy in Telecommunications) Regulations 2002 and this Act".

 (2) Amendment of the Postal and Telecommunications Services Act, 1983 (No. 24 of 1983) -

In Section 98(6) as substituted by Section 13 of the Interception of Postal Packages and Telecommunications Messages (Regulation) Act 1993 (No. 10 of 1993) by the insertion of "Neither does it include any filtering mechanisms or processes utilised by undertakings for the purposes of preventing unsolicited commercial emails where such a service has been requested or accepted by a subscriber or user, having first been provided with clear and comprehensive information about the purposes of such filtering" following "shall be construed accordingly."
 
(3) Amendment of the European Communities (Directive 2000/31/EC) Regulations 2003 (S.I. No. 68 of 2003) -

(a) In Regulation 2(b)(ii), by the substitution of "the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003 for "the European Communities (Data Protection and Privacy in Telecommunications) Regulations 2002 (S.I. No. 192 of 2002)."

(b) In Regulation 7(1)(d) by the substitution of "users of the service" for "natural persons" on each occasion the latter phrase occurs.

(c) In Regulation 8(1)(c) by the substitution of "users of the service" for "natural persons" on each occasion the latter phrase occurs.

 (4) Amendment of the Universal Service Regulations (S.I. No. 308 of 2003) -

  In Regulation 21(2) by the substitution of "Regulation 4(3)" for "Regulation 4(4)"

            (5)        A reference in the Framework Regulations to the European Communities
                        (Data Protection and Privacy in Telecommunications) Regulation 2002 (S.I.
                        No. 192 of 2002) shall be construed as a reference to these Regulations.

Back to top

24. Repeals

24. The following enactment is hereby revoked:

(1) European Communities (Data Protection and Privacy in Telecommunications) Regulations 2002 (S.I. No. 192 of 2002).

 

Given under my Official Seal
6 November 2003
   

Dermot Ahern T.D.,
Minister for Communications, Marine and Natural Resources


GIVEN under my Official Seal,
9 December 2008


EAMON RYAN
Minister for Communications, Energy and Natural Resources

Back to top

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation).

The purpose of these Regulations is to give legal effect to Directive 2002/58/EC of the European Parliament and to the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector. The provisions of Article 5.1of the Directive relating to confidentiality of communications are not transposed in the Regulations as adequate provisions were already on the statute book by virtue of Section 98 of the Postal and Telecommunications Services Act of 1983 (No. 24 of 1983) as amended.

These regulations amend the European Communities (Electronic Communications Networks and Services) (Data Protection and Privacy) Regulations 2003 (S.I. No. 535 of 2003) by:-

(1) increasing the penalty for a summary offence,
(2) creating an indictable offence for a contravention of regulation 13
relating to unsolicited communications and providing for the penalties that
may be imposed on conviction of same,
(3) the amendment of regulations or part thereof relating to confidentiality
of communications, unsolicited communications and enforcement respectively
in the interest of clarity.

Back to top






» Permanent Link