No, at all stages it is open to a data subject to make an application to court under section 117 of the Data Protection Act, 2018. Should an individual decide to pursue such a course of action, it is important to note that the Data Protection Commission (DPC) does not have any role to play in such proceedings; in addition, the DPC will not be in a position to speed up any examination it may be undertaking to accommodate any such court action. Likewise, the court does not require the outcome of the DPC’s examination in order to make their own determination.

Yes, it will reduce the time it takes to resolve an issue if all parties are aware from the beginning what is expected. However, these expectations should be reasonable and within the power of the data controller to provide.

There is no mechanism for the Data Protection Commission (DPC) to award compensation so therefore you will never receive any money from the DPC after you submit a complaint even if a finding is made in your favour.

The Data Protection Commission (DPC) cannot examine employment issues or criminal matters but occasionally data subjects query whether their employer could use CCTV footage of them stealing or leaving work early to discipline them. As with all data processing, the data controller should be transparent with the data subjects and this can be achieved by having the issues clearly set out in policies such as CCTV policies or privacy policies or other relevant employer/employee policies.

Within data protection legislation the word “breach” has a defined meaning. A data breach means there was a breach of security on the part of the data controller leading to, amongst other things, destruction or loss or unauthorised disclosure of personal data.

No, there is no provision in data protection law for the Data Protection Commission (DPC) to award the fine or part of any fine to an affected individual.

This relates to an Article 15 subject access request.

The Data Protection Commission (DPC) deals with data subjects themselves in relation to their own data protection rights. However, if someone wishes to have a third party act on their behalf, then a signed letter of authority, by that individual will be required. The DPC will obtain the authorisation directly from the individual themselves and will therefore require their contact details in order to do so.

If you wish to raise a concern or lodge a complaint with the Data Protection Commission (DPC), you can go to the ‘Contact the DPC’ section of the DPC website and complete the webform in full.

Alternatively, you can email the DPC at info@dataprotection.ie. You will need to clearly set out your data protection concern.

Before making a complaint to the Data Protection Commission (DPC), it is recommended that you contact the data controller and set out your data protection concerns in writing. It is also recommended that you request a written response from the data controller; the reason being, it is the experience of the DPC, that matters can be often addressed between the individual and the data controller when the matter is initially raised with them, which means you may not need the assistance of the DPC at all.