The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Ashbury Taverns: Failure to comply with an access request

My Office received a complaint regarding alleged non-compliance with an access request. This complaint was made by a legal representative on behalf of a data subject formerly employed by Ashbury Taverns of Wexford.

As the access request had not been complied with within the 40 day period, my Office wrote to the data controller. When no response was received, my Office also attempted to make contact on numerous occasions by telephone and by registered post.

As my Office had attempted to investigate this complaint and had been stymied by the failure of the data controller to respond, I decided to issue an Enforcement Notice to Ashbury Taverns. The Enforcement Notice required the data controller to comply with the access request within a period of twenty-one days. During that period, my Office received its first correspondence from Ashbury Taverns by way of a letter from its solicitors. My Office was informed that the access request had not been complied with by Ashbury Taverns because it had likely confused its obligations under the data protection legislation with claims made under employment legislation. The letter also stated that the access request had now been complied with. Upon follow-up communication with the legal representative of the data subject, it was confirmed to my Office that the personal data sought in the access request had been provided.

Once again, this case highlights the scope and strength of my enforcement powers. I intend to use these powers on a routine basis where the right of access to personal data is not granted promptly.