Irish Credit Bureau DAC March 2021

• Year: 2021
• Date: 23 March 2021
• Section: Decisions made under data protection act 2018

1

In the matter of the General Data Protection Regulation

DPC Case Reference: IN-19-7-2

In the matter of Irish Credit Bureau DAC

Decision of the Data Protection Commission made pursuant to Section 111 of the Data Protection Act

2018

Further to an own-volition inquiry commenced pursuant to Section 110 of the Data Protection Act 2018

DECISION

Decision-Maker for the Commission:

Helen Dixon

Commissioner for Data Protection

23 March 2021

Data Protection Commission

2 Fitzwilliam Square South

Dublin 2, Ireland

2

Contents

1. Introduction .................................................................................................................................... 3

2. Legal Framework for the Inquiry and the Decision ......................................................................... 3

i. Legal Basis for the Inquiry ........................................................................................................... 3

ii. Legal Basis for the Decision ......................................................................................................... 4

3. Factual Background ......................................................................................................................... 4

4. Scope of the Inquiry ........................................................................................................................ 9

5. Issues for Determination................................................................................................................. 9

6. Issue 1: Article 25(1) of the GDPR ................................................................................................... 9

i. Findings ..................................................................................................................................... 15

7. Issue 2: Articles 5(2) and 24(1) of the GDPR ................................................................................. 16

i. Finding ....................................................................................................................................... 18

8. Issue 3: Article 26(1) of the GDPR ................................................................................................. 19

ii. Finding ....................................................................................................................................... 21

9. Decision on Corrective Powers ..................................................................................................... 21

A. Reprimand ................................................................................................................................. 22

B. Administrative Fine ................................................................................................................... 23

i. Whether Each Infringement Warrants an Administrative Fine ............................................ 23

ii. The Permitted Range ............................................................................................................ 36

iii. Calculating the Administrative Fine ...................................................................................... 37

10. Right of Appeal .......................................................................................................................... 39

Appendix: Schedule of Materials Considered for the Purposes of this Decision ............................... 40

3

1. Introduction

1.1 This document (“the Decision”) is a decision made by the Data Protection Commission (“the

DPC”) in accordance with Section 111 of the Data Protection Act 2018 (“the 2018 Act”). I

make this Decision having considered the information obtained in the separate own volition

inquiry (“the Inquiry”) conducted by a case officer of the DPC (“the Case Officer”) pursuant

to Section 110 of the 2018 Act. The Case Officer provided the Irish Credit Bureau DAC (“the

ICB”) with the Draft Inquiry Report and the Final Inquiry Report.

1.2 The ICB was provided with the Draft Decision on this Inquiry on 2 February 2021 to give it a

final opportunity to make submissions. This Decision is being provided to the ICB pursuant to

Section 116(1)(a) of the 2018 Act in order to give the ICB notice of the Decision, the reasons

for it, and the corrective powers that I have decided to exercise.

1.3 This Decision contains corrective powers under Section 115 of the 2018 Act and Article 58(2)

of the General Data Protection Regulation (“the GDPR”) arising from the infringements that

have been identified herein. In this regard, the ICB is required to comply with these corrective

powers, and it is open to this office to serve an enforcement notice on the ICB in accordance

with Section 133 of the 2018 Act.

2. Legal Framework for the Inquiry and the Decision

i. Legal Basis for the Inquiry

2.1 The GDPR is the legal regime covering the processing of personal data in the European Union.

As a regulation, the GDPR is directly applicable in EU member states. The 2018 Act gives the

GDPR further effect in Irish law. As stated above, the DPC commenced the Inquiry pursuant

to Section 110 of the 2018 Act. By way of background in this regard, under Part 6 of the 2018

Act, the DPC has the power to commence an inquiry on several bases, including on foot of a

complaint, or of its own volition.

2.2 Section 110(1) of the 2018 Act provides that the DPC may, for the purpose of Section

109(5)(e) or Section 113(2) of the 2018 Act, or of its own volition, cause such inquiry as it

thinks fit to be conducted, in order to ascertain whether an infringement has occurred or is

occurring of the GDPR or a provision of the 2018 Act, or regulation under the Act that gives

further effect to the GDPR. Section 110(2) of the 2018 Act provides that the DPC may, for

the purposes of Section 110(1), where it considers it appropriate to do so, cause any of its

powers under Chapter 4 of Part 6 of the 2018 Act (excluding Section 135 of the 2018 Act) to

be exercised and / or cause an investigation under Chapter 5 of Part 6 of the 2018 Act t o be

carried out.