Unlawful for an employer to make an employee put in a data access request

With the signing by the Minister for Justice and Equality, Frances FitzGerald of Statutory Instruments 337 and 338 of 2014, the remaining sections of the Data Protection Acts 1988 and 2003 (the “Acts”) have now been brought into force with effect from 18 July 2014. This means that all provisions of the Acts are now in force.

Data Protection Act 1988 (Commencement) Order 2014 (SI No. 337 of 2014) brings into force Sections 6(2)(b) and 10(7)(b) of the Data Protection Act 1988 (as amended). Section 6 provides that a data controller must rectify, block or erase personal data that are collected, processed or otherwise dealt with in contravention of the Acts and to notify the data subject accordingly. With its commencement, subsection (2)(b) now requires a data controller to also notify any person to whom the personal data were disclosed during the preceding 12 months unless such notification proves impossible or involves a disproportionate effort.

Section 10(7) provides that a data controller must notify the data subject where it blocks, rectifies, erases, destroys or adds a statement to personal data in compliance with an enforcement notice issued by the Data Protection Commissioner. With its commencement, subsection (7)(b) now requires a data controller to also notify any person to whom the personal data were disclosed during the preceding 12 months unless such notification proves impossible or involves a disproportionate effort.

Data Protection (Amendment) Act 2003 (Commencement) Order 2014 (SI No. 338 of 2014) brings into force Section 5(d) of the Data Protection (Amendment) Act 2003 in so far as it inserts subsection (13) of section 4 of the Data Protection Act 1988. This provision makes it unlawful for employers to require employees or applicants for employment to make an access request seeking copies of personal data which is then made available to the employer or prospective employer. This provision also applies to any person who engages another person to provide a service.

For more information go to www.dataprotection.ie