The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Data Protection Rule 3

Use and further processing of personal information

"the data shall not be further processed in any manner incompatible with that purpose or those purposes"
- section 2(1)(c)(ii) of the Act

If you obtain peronal information for a particular purpose, you may not use the data for any other purpose, and you may not divulge the personal data to a third party, except in ways that are "compatible" with the specified purpose. A key test of compatibility is whether you use and disclose the data in a way in which those who supplied the information would expect it to be used and disclosed.

Note that transfers of personal data to agents of yours, who are carrying out operations upon the data on your behalf and not retaining it for their own purposes, do not constitute "disclosures" of data for the purposes of the Act. (See the definitions section for the formal definition of "disclosure".) Examples of such transfers would include the transfer of staff data to a separate payroll company for payroll administration purposes, and the transfer of personal data from a general practitioner to a clinical laboratory for analysis of tissue samples. You should also note that, even though such transfers would not involve "disclosure" of personal data, the data controller might also have to consider whether the data have been "fairly obtained" for these purposes.

The restriction on processing of personal data (including disclosure to a third party) is lifted in a limited number of circumstances, specified in section 8 of the Data Protection Acts, where the right to privacy must be balanced against other needs of civil society, or where the processing is in the interests of the individual.

LINK» more about disclosures permitted under section 8 of the Act

Use and Disclosure: Test Yourself

You should be able to answer YES to the following questions:-

  • Do you use the data only in ways consistent with the purpose or purposes for which they are kept?
  • Do you disclose the data only in ways consistent with that purpose or purposes?

Practical steps

Carry out an inventory of all current and proposed disclosures and check each one against the stated purposes.

Some Case Studies relevant to this topic:

The following Case Studies, which have appeared in Annual reports of the Data Protection Commissioner over recent years, may be of some interest. Click on the Case Study details to see the full text.

CASE STUDIES - Disclosure



MENU Select Page No.
<- Previous    Next ->