The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Disclosures Permitted under section 8 of the Data Protection Act

Section 2(1) (c) of the Data Protection Acts, provides that a data controller shall not further process personal data (which includes disclosure to a third party), except in ways that are compatible with the purpose for which the data were obtained.

However, this non-disclosure rule is not unqualified. Section 8 of the Act lifts the restriction on disclosure in certain circumstances, so that disclosures may be made in cases where the individual's right to privacy must be balanced against other needs of civil society, or where the disclosure is in the interests of the individual. The circumstances specified in section 8 are listed below, along with some explanatory comments.

Section 8(a) "in the opinion of the Garda Siochana not below the rank of chief superintendent or an officer of the Permenant Defence Forces who holds an army rank not below colonel and is designated by the Minister for Defence under this paragraph, required for the purpose of safeguarding the security of the State"

Section 8(b) "required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid"

Comment: The individual's right to privacy must be balanced against the need to investigate offences and collect taxes effectively. If a data controller is approached by a law enforcement authority or by a tax collecting authority, which seeks to have personal data disclosed to it under this section of the Data Protection Act, it is a matter for the data controller: (i) to satisfy itself that the provisions of this section are met, for example by establishing the bona fides of the authority and by obtaining assurances that the disclosure is actually necessary, and not merely of side interest, for the investigation of an offence; and (ii) to decide whether or not to comply with the request for disclosure. While this section of the Data Protection Act lifts the restrictions on disclosure by a data controller to a law enforcement authority or to a tax collecting authority, this section does not impose any obligation on a data controller to comply with the request for disclosure.

Section 8(c) "required in the interests of protecting the international relations of the State"

Section 8(d) "The disclosure is required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property"

Comment: The individual's right to privacy can be set aside where personal data must be disclosed in order to save someone's life or protect someone's health, or to prevent property from being destroyed. This provision does not authorise disclosures of personal information for general health research purposes, or for other medical purposes where there is no immediate or urgent risk to someone's life or health. In such cases, the normal data protection rules apply, including the obtaining of consent where necessary.

Section 8(e) "required by or under any enactment or by a rule of law or order of a court"

Comment: If you are under a legal obligation to disclose personal data, then this obligation takes precedence over the Data Protection Act's prohibition on disclosure. However, if you have a statutory discretion to make information available, matters are not so clear-cut. The Data Protection Commissioner has found, in the past, that a statutory discretion to make information available did not come within the scope of section 8(e) of the Data Protection Act, and that accordingly the restriction on disclosure of personal data remained in force (see Case Study 6/98).

Section 8(f) "required for the purposes of obtaining legal advice or for the purposes of, or in the course of, legal proceedings in which the person making the disclosure is a party or a witness"

Section 8(h) "made at the request or with the consent of the data subject or to a person acting on his behalf"

Comment: If a third party, such as a prospective employer, requests personal information from you about an individual, and if the third party has the clear consent of that individual, then you may disclose the personal data, if you wish. This section of the Data Protection Act places you under no obligation to respond positively to the request for information, if you do not want to.

The following Case Studies, which have appeared in Annual Reports of the Data Protection Commissioner over recent years, may be of some interest. Click on the Case Study details to see the full text.

CASE STUDY 8/03 - Referral of Medical Consultants clinical notes for review - issue of consent - required to prevent injury or other damage to the health of a person

CASE STUDY 1/03 - Investigation into a Medical Consultant's practice - patients felt consent was necessary

CASE STUDY 11/02 - Notifiable diseases and public health interests - disclosure of sensitive data

CASE STUDY 5/02 - Telephone Company - alleged disclosure of customer call information - request of Gardai