What is the Data Protection Commission?
The Data Protection Commission is Ireland’s independent supervisory authority for data protection. It oversees compliance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and other relevant rules, including rules covering electronic communications and law-enforcement processing.
The DPC can receive concerns from individuals, assess whether an issue falls within its remit, and take appropriate steps. Depending on the case, it may facilitate an amicable resolution, give advice, conduct an inquiry or use corrective powers such as an enforcement notice. It can also take action concerning organisations that process large amounts of personal data across the EU where Ireland is the lead supervisory authority.
The DPC is a regulator, not a general privacy helpdesk, court or compensation scheme. A concern needs to relate to the processing of personal data and a possible breach of data protection law.
What data protection rights can you exercise?
- Ask an organisation whether it uses your personal data and request a copy (the right of access).
- Ask for inaccurate data to be corrected, or for data to be erased in circumstances where the right to erasure applies.
- In certain situations, ask an organisation to restrict or stop processing, or object to particular processing, including some direct marketing.
- Ask for data you provided to be supplied in a portable format where data portability applies.
- Seek human review of certain decisions made solely by automated processing where the GDPR provides that right.
These rights have conditions and exceptions. For example, the right to erasure is not absolute, and access may be limited to protect other people’s rights or information subject to a legal exemption. An organisation should explain its response and the reasons for any refusal. The DPC’s Know Your Rights pages explain each right and how to make a request.
How to raise a concern with the DPC
- Write to the organisation responsible for the data (the controller). Explain what happened and what you want it to do, such as provide access, correct a record or stop direct marketing. Keep a copy and note the date.
- Give the organisation a reasonable opportunity to respond. The DPC generally expects you to have raised the issue directly first, unless that is not appropriate or possible.
- If you are dissatisfied with the reply, or receive no reply, use the DPC’s online Contact the DPC form to raise a concern. The form asks for the organisation, the issue, its context and what outcome you are seeking.
- Attach relevant evidence: your original request, full correspondence with dates, the organisation’s response, reminders and documents or screenshots that support your concern. If you act for someone else, include the required authority.
- Keep your DPC case reference and respond to requests for further information. The DPC says it will provide an update or outcome report within three months of a concern being raised; if the matter takes longer, it will provide periodic updates.
The DPC’s online form is the recommended route for a concern. Its published guidance also lists email as an option, but use the current contact details on the official site and avoid sending unnecessary sensitive information.
Examples: is this for the DPC?
| Situation | Likely next step |
|---|---|
| An organisation has not answered your access request | Follow up with the organisation, then raise a concern with the DPC if unresolved |
| A company disclosed your personal information without a proper basis | Ask the organisation for an explanation and raise a concern with the DPC if you believe data protection law was breached |
| You received unwanted marketing | Use the organisation’s opt-out and document the messages; the DPC can handle relevant data protection or electronic marketing concerns |
| You disagree with a service or a bill, but there is no personal-data issue | Use that service’s complaints process or the appropriate sector regulator; the DPC does not resolve ordinary service disputes |
| You want compensation or a court ruling | The DPC is not a court or compensation tribunal; seek independent legal advice about any judicial remedy |
A complaint is not automatically upheld just because an organisation has not done what you asked. The DPC assesses the facts and applicable law. It may reject or dismiss a complaint, provide advice, seek an amicable resolution, carry out an inquiry or take other action permitted by law.
How is the DPC held to account?
The DPC operates independently when carrying out its regulatory functions. Its legal powers come from legislation passed by the Oireachtas, and its work and reports can be scrutinised through parliamentary and public channels. A TD cannot direct the outcome of an individual DPC case. For a wider guide to oversight bodies, seeaccountability bodies in Ireland.
If your concern is specifically about how the DPC itself has handled your personal data, the DPC says you may complain to the competent supervisory authority, which is the DPC, and may also have a judicial remedy against a decision concerning your complaint. Check the DPC’s guidance for the applicable process.