Department of Employment Affairs and Social Protection May 2021

Date10 May 2021
SectionDecisions made under data protection act 2018
1
In the matter of the General Data Protection Regulation
DPC Case Reference: IN-18-12-01
In the matter of the Department of Employment Affairs
and Social Protection
Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection Act
2018
Further to an own-volition inquiry commenced pursuant to Section 110 of the Data Protection Act 2018
DECISION
Decision-Maker for the Commission:
Helen Dixon
Commissioner for Data Protection
10 May 2021
Data Protection Commission
2 Fitzwilliam Square South
Dublin 2, Ireland
2
Contents
1. Introduction .................................................................................................................................... 3
2. Legal Framework for the Inquiry and the Decision ......................................................................... 3
i. Legal Basis for the Inquiry ........................................................................................................... 3
ii. Legal Basis for the Decision ......................................................................................................... 3
3. Factual Background ......................................................................................................................... 4
4. Scope of the Inquiry ...................................................................................................................... 18
5. Issues for Determination............................................................................................................... 18
6. Issue 1: Article 38(1) ..................................................................................................................... 18
i. Whether the Department was obliged to involve the DPO pursuant to Article 38(1) in the
circumstances ................................................................................................................................... 19
ii. The requirement that the DPO is involved “properly and in a timely manner ....................... 20
iii. Whether the Department complied with its obligation to ensure that the DPO was involved
properly and in a timely manner ...................................................................................................... 23
iv. Finding ....................................................................................................................................... 27
7. Issue 2: Article 38(3) ..................................................................................................................... 28
i. Finding ....................................................................................................................................... 30
8. Right of Appeal .............................................................................................................................. 30
Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 31
3
1. Introduction
1.1 This document (“the Decision”) is a decision made by the Data Protection Commission (“the
DPC”) in accordance with Section 111 of the Data Protection Act 2018 (“the 2018 Act”). I
make this Decision having considered the information obtained in the separate own volition
inquiry (“the Inquiry”) conducted by authorised officers of the DPC (“the Inquiry Team)
pursuant to Section 110 of the 2018 Act. The Inquiry Team provided the Department of
Employment Affairs and Social Protection (“the Department”) with the Draft Inquiry Report
and the Final Inquiry Report.
1.2 The Department was provided with the Draft Decision on this Inquiry on 8 March 2021 to
give it a final opportunity to make submissions. The Department made submissions on the
Draft Decision on 29 March 2021 and I have had regard to those submission before making
this Decision. This Decision is being provided to the Department pursuant to Section 116(1)(a)
of the 2018 Act in order to give the Department notice of the Decision and the reasons for it.
2. Legal Framework for the Inquiry and the Decision
i. Legal Basis for the Inquiry
2.1 The General Data Protection Reg ulation (“the GDPR”) is a legal regime concerning the
processing of personal data in the European Union. As a regulation, the GDPR is directly
applicable in EU member states. The 2018 Act gives the GDPR further effect in Irish law. As
stated above, the DPC commenced the Inquiry pursuant to Section 110 of the 2018 Act. By
way of background in this regard, under Part 6 of the 2018 Act, the DPC has the power to
commence an inquiry on several bases, including on foot of a complaint, or of its own volition.
2.2 Section 110(1) of the 2018 Act provides that the DPC may, for the purpose of Section
109(5)(e) or Section 113(2) of the 2018 Act, or of its own volition, cause such inquiry as it
thinks fit to be conducted, in order to ascertain whether an infringement has occurred or is
occurring of the GDPR or a provision of the 2018 Act, or regulation under the Act that gives
further effect to the GDPR. Section 110(2) of the 2018 Act provides that the DPC may, for
the purposes of Section 110(1), where it considers it appropriate to do so, cause any of its
powers under Chapter 4 of Part 6 of the 2018 Act (excluding Section 135 of the 2018 Act) to
be exercised and / or cause an investigation under Chapter 5 of Part 6 of the 2018 Act t o be
carried out.
ii. Legal Basis for the Decision
2.3 The decision-making process for this Inquiry is provided for under Section 111 of the 2018
Act, and requires that the DPC must consider the information obtained during the Inquiry; to
decide whether an infringement is occurring or has occurred; and if so, to decide on the
corrective powers, if any, to be exercised. As the sole member of the DPC, I perform this

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT