April 2003 - New legislation amending Irish Data Protection Law has come into force

On the 10th April 2003 the Data Protection (Amendment) Act 2003 was signed into law. This new amending legislation substantially updates the Data Protection Act 1988 and gives full effect to the provisions of the EU Data Protection Directive (95/46/EC).

Among the important changes are the following:

• The data protection principles contained in the 1988 Act has been modified and extended.
• There are new rules governing the use of personal data for direct marketing purposes.
• The transfer of personal data to countries outside the EEA will be subject to new controls.
• The rights of access by individuals to their personal data are strengthened.
• The powers of the Data Protection Commissioner have been extended.
• There are new requirements for annual registration with the Data Protection Commissioner.
• The requirements regarding keeping personal data secure are strenghtened.
• Any businesses outsourcing the processing of personal data (e.g. payroll) will have to have an appropriate contract in place with the data processor concerned.

The orders to commence the main provisions of the Act with effect from the 1st July 2003 are in the course of being drafted by the Department of Justice, Equality and Law Reform.

The new rules governing the requirement to register annually with the Data Protection Commissioner may by postponed to enable a public consultation to take place.

For further information or general enquiries contact: -

Patrick Ryan
Email: pryan@kilroys.ie
Telephone: +3531-439 5600
Fax: +3531-439 5601/439 5602

© Kilroys Solicitors May 2003