Number 25 of 1988
DATA PROTECTION ACT, 1988
CONVENTION FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO AUTOMATIC PROCESSING OF PERSONAL DATA DONE AT STRASBOURG ON
THE 28TH DAY OF JANUARY, 1981
PREAMBLE
The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve
greater unity between its members, based in particular on respect
for the rule of law, as well as human rights and fundamental
freedoms;
Considering that it is desirable to extend the safeguards for
everyone's rights and fundamental freedoms, and in particular the
right to the respect for privacy, taking account of the increasing
flow across frontiers of personal data undergoing automatic
processing;
Reaffirming at the same time their commitment to freedom of
information regardless of frontiers;
Recognising that it is necessary to reconcile the fundamental
values of the respect for privacy and the free flow of information
between peoples,
Have agreed as follows:
CHAPTER I - GENERAL PROVISIONS
Article 1
Object and Purpose
The purpose of this convention is to secure in the territory of
each Party for every individual, whatever his nationality or
residence, respect for his rights and fundamental freedoms, and in
particular his right to privacy, with regard to automatic
processing of personal data relating to him ("data
protection").
Article 2
Definitions
For the purposes of this convention:
a. "personal data" means any information relating
to an identified or identifiable individual ("data
subject");
b. "automated data file" means any set of data
undergoing automatic processing;
c. "automatic processing" includes the following
operations if carried out in whole or in part by automated
means: storage of data, carrying out of logical and/or
arithmetical operations on those data, their alteration,
erasure, retrieval or dissemination;
d. "controller of the file" means the natural or
legal person, public authority, agency or any other body who
is competent according to the national law to decide what
should be the purpose of the automated data file, which
categories of personal data should be stored and which
operations should be applied to them.
Article 3
Scope
1. The Parties undertake to apply this convention to
automated personal data files and automatic processing of
personal data in the public and private sectors.
2. Any State may, at the time of signature or when
depositing its instrument of ratification, acceptance,
approval or accession, or at any later time, give notice by a
declaration addressed to the Secretary General of the Council
of Europe:
(a) that it will not apply this convention to certain
categories of automated personal data files, a list of
which will be deposited. In this list it shall not
include, however, categories of automated data files
subject under its domestic law to data protection
provisions. Consequently, it shall amend this list by a
new declaration whenever additional categories of
automated personal data files are subjected to data
protection provisions under its domestic law;
(b) that it will also apply this convention to
information relating to groups of persons, association,
foundations, companies, corporations and any other bodies
consisting directly or indirectly of individuals, whether
or not such bodies possess legal personality;
(c) that it will also apply this convention to personal
data files which are not processed automatically.
3. Any State which has extended the scope of this
convention by any of the declarations provided for in
sub-paragraph 2.b or c above may give notice in the said
declaration that such extensions shall apply only to certain
categories of personal data files, a list of which will be
deposited.
4. Any Party which has excluded certain categories of
automated personal data files by a declaration provided for in
sub-paragraph 2.a above may not claim the application of this
convention to such categories by a Party which has not
excluded them.
5. Likewise, a Party which has not made one or other of the
extensions provided for in sub-paragraph 2.b or c above may
not claim the application of this convention on these points
with respect to a Party which has made such extensions.
6. The declarations provided for in paragraph 2 above shall
take effect from the moment of the entry into force of the
convention with regard to the State which has made them if
they have been made at the time of signature or deposit of its
instrument of ratification, acceptance, approval or accession,
or three months after their receipt by the Secretary General
of the Council of Europe if they have been made at any later
time. These declarations may be withdrawn, in whole or in
part, by a notification addressed to the Secretary General of
the Council of Europe. Such withdrawals shall take effect
three months after the data of receipt of such notification.
CHAPTER II-BASIC PRINCIPLES FOR DATA PROTECTION
Article 4
Duties of the Parties
1. Each Party shall take the necessary measures in its
domestic law to give effect to the basic principles for data
protection set out in this chapter.
2. These measures shall be taken at the latest at the time
of entry into force of this convention in respect of that
Party.
Article 5
Quality of data
Personal data undergoing automatic processing shall be:
a. obtained and processed fairly and lawfully;
b. stored for specified and legitimate purposes and not
used in a way incompatible with those purpose;
c. adequate, relevant and not excessive in relation to
the purposes for which they are stored;
d. accurate and, where necessary, kept up to date;
e. preserved in a form which permits identification of
the data subjects for no longer than is required for the
purpose for which those data are stored.
Article 6
Special categories of data
Personal data revealing racial origin, political opinions or
religious or other beliefs, as well as personal data concerning
health or sexual life, may not be processed automatically unless
domestic law provides appropriate safeguards. The same shall apply
to personal data relating to criminal convictions.
Article 7
Data security
Appropriate security measures shall be taken for the protection
of personal data stored in automated data files against accidental
or unauthorised destruction or accidental loss as well as against
unauthorised access, alteration or dissemination.
Article 8
Additional safeguards for the data subject
Any person shall be enabled:
a. to establish the existence of an automated personal
data file, its main purposes, as well as the identity and
habitual residence or principal place of business of the
controller of the file;
b. to obtain at reasonable intervals and without
excessive delay or expense confirmation of whether
personal data relating to him are stored in the automated
data file
as well as communication to him of such data in an
intelligible form;
c. to obtain, as the case may be, rectification or
erasure of such data if these have been processed contrary
to the provisions of domestic law giving effect to the
basic principles set out in Articles 5 and 6 of this
convention;
d. to have a remedy if a request of confirmation or, as
the case may be, communication, rectification or erasure
as referred to in paragraphs b and c of this article is
not complies with.
Article 9
Exceptions and restrictions
1. No exception to the provisions of Articles 5, 6 and 8 of
this convention shall be allowed except within the limits
defined in this article.
2. Derogation from the provisions of Articles 5, 6 and 8 of
this convention shall be allowed when such derogation is
provided for by the law of the Party and constitutes a
necessary measure in a democratic society in the interests of:
a. protecting State security, public safety, the
monetary interests of the State or the suppression of
criminal offences;
b. protecting the data subject or the rights and
freedoms of others.
3. Restrictions on the exercise of the rights specified in
Article 8, paragraphs b, c and d, may be provided by law with
respect to automated personal data files used for statistics
or for scientific research purposes when there is obviously no
risk of an infringement of the privacy of the data subjects.
Article 10
Sanctions and remedies
Each Party undertakes to establish appropriate sanctions and
remedies for violations of provisions of domestic law giving
effect to the basic principles for data protection set out in this
chapter.
Article 11
Extended protection
None of the provisions of this chapter shall be interpreted as
limiting or otherwise affecting the possibility for a Party to
grant data subjects a wider measure of protection than that
stipulated in this convention.
CHAPTER III - TRANSBORDER DATA FLOWS
Article 12
Transborder flows of personal data and domestic law
1. The following provisions shall apply to the transfer
across national borders, by whatever medium, of personal data
undergoing automated processing or collected with a view to
their being automatically processed.
2. A Party shall not, for the sole purpose of the
protection of privacy, prohibit or subject to special
authorisation transborder flows of personal data going to the
territory of another Party.
3. Nevertheless, each Party shall be entitled to derogate
from the provisions of paragraph 2:
4. a. insofar as its legislation includes specific
regulations for certain categories of personal data or of
automated personal data files, because of the nature of
those data or those files, except where the regulations of
the other Party provide an equivalent protection;
b. when the transfer is made from its territory to the
territory of a non-Contracting State through the
intermediary of the territory of another Party, in order
to avoid such transfers resulting in circumvention of the
legislation of the Party referred to at the beginning of
this paragraph.
CHAPTER IV - MUTUAL ASSISTANCE
Article 13
Co-operation between Parties
1. The Parties agree to render each other mutual assistance
in order to implement this convention.
2. For that purpose:
a. each Party shall designate one or more authorities,
the name and address of each of which it shall communicate
to the Secretary General of the Council of Europe;
b. each Party which has designated more than one
authority shall specify in its communication referred to
in the previous sub-paragraph the competence of each
authority:
3. An authority designated by a Party shall at the request
of an authority designated by another Party:
a. furnish information on its law and administrative
practice in the field of data protection;
b. take, in conformity with its domestic law and for
the sole purpose of protection of privacy, all appropriate
measures for furnishing factual information relation to
specific automatic processing carried out on its
territory, with the exception however of the personal data
being processed.
Article 14
Assistance to data subjects resident abroad
1. Each Party shall assist any person resident abroad to
exercise the rights conferred by its domestic law giving
effect to the principles set out in Article 8 of this
convention.
2. When such a person resides in the territory of another
Party he shall be given the option of submitting his request
through the intermediary of the authority designated by that
Party.
3. The request for assistance shall contain all the
necessary particulars, relating inter alia to:
a. the name, address and any other relevant particulars
identifying the person making the request;
b. the automated personal data file to which the
request pertains, or its controller;
c. the purpose of the request.
Article 15
Safeguards concerning assistance rendered by designated
authorities
1. An authority designated by a Party which has received
information from an authority designated by another Party
either accompanying a request for assistance or in reply to
its own request for assistance shall not use that information
for purposes other than those specified in the request for
assistance.
2. Each Party shall see to it that the persons belonging to
or acting on behalf of the designated authority shall be bound
by appropriate obligation of secrecy or confidentiality with
regard to that information.
3. In no case may a designated authority be allowed to make
under Article 14, paragraph 2, a request for assistance on
behalf of a data subject resident abroad, of its own accord
and without the express consent of the person concerned.
Article 16
Refusal of requests for assistance
A designated authority to which a request for assistance is
addressed under Articles 13 or 14 of this convention may not
refuse to comply with it unless:
a. the request is not compatible with the powers in the
field of data protection of the authorities responsible
for replying;
b. the request does not comply with the provisions of
this convention;
c. compliance with the request would be incompatible
with the sovereignty, security or public policy (order
public) of the Party by which it was designated, or with
the rights and fundamental freedoms of persons under the
jurisdiction of that Party.
Article 17
Costs and procedures of assistance
1. Mutual assistance which the Parties render each other
under Article 13 and assistance they render to data subjects
abroad under Article 14 shall not give rise to the payment of
any costs of fees other than those incurred for experts and
interpreters. The latter costs or fees shall be borne by the
Party which has designated the authority making the request
for assistance.
2. The data subject may not be charged costs or fees in
connection with the steps taken on his behalf in the territory
of another Party other than those lawfully payable by
residents of that Party.
3. Other details concerning the assistance relating in
particular to the forms and procedures and the languages to be
used, shall be established directly between the Parties
concerned.
CHAPTER V - CONSULTATIVE COMMITTEE
Article 18
Composition of the committee
1. A Consultative Committee shall be set up after the entry
into force of this convention.
2. Each Party shall appoint a representative to the
committee and a deputy representative. Any member State of the
Council of Europe which is not a Party to the convention shall
have the right to be represented on the committee by an
observer.
3. The Consultative Committee may, be unanimous decision,
invite any non-member State of the Council of Europe which is
not a Party to the convention to be represented by an observer
at a given meeting.
Article 20
Functions of the committee
The Consultative Committee:
a. may make proposals with a view to facilitating or
improving the application of the convention;
b. may make proposals for amendment of the convention
in accordance with Article 21;
c. shall formulate its opinion on any proposal for
amendment of this convention which is referred to it in
accordance with Article 21, paragraph 3;
d. may, at the request of a Party, express an opinion
on any question concerning the application of this
convention.
Article 20
Procedure
1. The Consultative Committee shall be convened by the
Secretary General of the Council of Europe. Its first meeting
shall be held within twelve months of the entry into force of
this convention. It shall subsequently meet at least once
every two years and in any case when one-third of the
representatives of the Parties request its convocation.
2. A majority of representative of the Parties shall
constitute a quorum for a meeting of the Consultative
Committee.
3. After each of its meetings, the Consultative Committee
shall submit to the Committee of Ministers of the Council of
Europe a report on its work and on the functioning of the
convention.
4. Subject of the provisions of this convention, the
Consultative Committee shall draw up its own Rules of
Procedure.
CHAPTER VI - AMENDMENTS
Article 21
Amendments
1. Amendments to this convention may be proposed by a
Party, the Committee of Ministers of the Council of Europe or
the Consultative Committee.
2. Any proposal for amendment shall be communicated by the
Secretary General of the Council of Europe to the member
States of the Council of Europe and to every non-member State
which has acceded to or has been invited to accede to this
convention in accordance with the provisions of Article 23.
3. Moreover, any amendment proposed by a Party or the
Committee of Ministers shall be communicated to the
Consultative Committee, which shall submit to the Committee of
Ministers its opinion on that proposed amendment.
4. The Committee of Ministers shall consider the proposed
amendment and any opinion submitted by the Consultative
Committee and may approve the amendment.
5. The text of any amendment approved by the Committee of
Ministers in accordance with paragraph 4 of this article shall
be forwarded to the Parties for acceptance.
6. Any amendment approved in accordance with paragraph 4 of
this article shall come into force on the thirtieth day after
all Parties have informed the Secretary General of their
acceptance thereof.
CHAPTER VII - FINAL CLAUSES
Article 22
Entry into force
1. This convention shall be open for signature by the
member States of the Council of Europe. It is subject to
ratification, acceptance or approval. Instruments of
ratification, acceptance or approval shall be deposited with
the Secretary General of the Council of Europe.
2. This convention shall enter into force on the first day
of the month following the expiration of a period of three
months after the data on which five member States of the
Council of Europe have expressed their consent to be bound by
the convention in accordance with the provisions of the
preceding paragraph.
3. In respect of any member State which subsequently
expresses its consent to be bound by it, the convention shall
enter into force on the first day of the month following the
expiration of a period of three months after the data of the
deposit of the instrument of ratification, acceptance or
approval.
Article 23
Accession by non-member States
1. After the entry into force of this convention, the
Committee of Ministers of the Council of Europe may invite any
State not a member of the Council of Europe to accede to this
convention by a decision taken by the majority provided for in
Article 20.d of the Statute of the Council of Europe and by
the unanimous vote of the representatives of the Contracting
States entitled to sit on the committee.
2. In respect of any acceding State, the convention shall
enter into force on the first day of the month following the
expiration of a period of three months after the date of
deposit of the instrument of accession with the Secretary
General of the Council of Europe.
Article 24
Territorial clause
1. Any State may at any time of signature or when
depositing its instrument of ratification, acceptance,
approval or accession, specify the territory or territories to
which this convention shall apply.
2. Any State may at any later date, by a declaration
addressed to the Secretary General of the Council of Europe,
extend the application of this convention to any other
territory specified in the declaration. In respect of such
territory the convention shall enter into force on the first
day of the month following the expiration of a period of three
months after the date of receipt of such declaration by the
Secretary General.
3. Any declaration made under the two preceding paragraphs
may, in respect of any territory specified in such
declaration, be withdrawn by a notification addressed to the
Secretary General. The withdrawal shall become effective on
the first day of the month following the expiration of a
period of six months after the date of receipt of such
notification by the Secretary General.
Article 25
Reservations
No reservation may be made in respect of the provisions of this
convention.
Article 26
Denunciation
1. Any Party may at any time denounce this convention by
means of a notification addressed to the Secretary General of
the Council of Europe.
2. Such denunciation shall become effective on the first
day of the month following the expiration of a period of six
months after the data of receipt of the notification by the
Secretary General.
Article 27
Notification
The Secretary General of the Council of Europe shall notify the
member States of the Council and any State which has acceded to
this convention of:
a. any signature;
b. the deposit of any instrument of ratification,
acceptance, approval or accession;
c. any date of entry into force of this convention in
accordance with Articles 22, 23 and 24;
d. any other act, notification or communication relating to
this convention.
In witness whereof the undersigned, being duly authorised
thereto, have signed this Convention.
Done at Strasbourg, the 28th day of January 1981, in English
and in French, both texts being equally authoritative, in a single
copy which shall remain deposited in the archives of the Council
of Europe. The Secretary General of the Council of Europe shall
transmit certified copies to each member State of the Council of
Europe and to any State invited to accede to this Convention.
The Data Protection Commissioner
1. The Commissioner shall be a body corporate and shall be
independent in the performance of his functions.
2. (1) The Commissioner shall be appointed by the
Government and, subject to the provisions of this Schedule,
shall hold office upon such terms and conditions as the
Government may determine.
(2) The Commissioner-
(a) may at any time resign his office as
Commissioner by letter addressed to the Secretary to
the Government and the resignation shall take effect
on and from the date of receipt of the letter,
(b) may at any time be removed from office by the
Government if, in the opinion of the Government, he
has become incapable through ill-health of effectively
performing his functions or has committed stated
misbehaviour, and
(c) shall, in any case, vacate the office of
Commissioner on reaching the age of 65 years.
3. The term of office of a person appointed to be the
Commissioner shall be such term not exceeding 5 years as the
Government may determine at the time of his appointment and,
subject to the provisions of this Schedule, he shall be
eligible for re-appointment to the office.
4. (1) Where the Commissioner is-
(a) nominated as a member of Seanad Eireann,
(b) elected as a member of either House of the
Oireachtas, the European Parliament or a local authority,
or
(c) regarded pursuant to section 15 (inserted by the
European Assembly Elections Act, 1984) of the European
Assembly Elections Act, 1977, as having been elected to
such Parliament to fill a vacancy, he shall thereupon cease to be the Commissioner.
(2) A person who is for the time being-
(i) entitled under the standing orders of either
House of the Oireachtas to sit therein,
(ii) a member of the European Parliament, or
(iii) entitled under the standing orders of a local
authority to sit therein,
shall, while he is so entitled or is such a member, be
disqualified for the holding the office of Commissioner.
5. The Commissioner shall not hold any other office or
employment in respect of which emoluments are payable.
6. There shall be paid to the Commissioner, out of moneys
provided by the Oireachtas, such remuneration and allowances
for expenses as the Minister, with the consent of the Minister
for Finance, may from time to time determine.
7. (a) The Minister shall, with the consent of the
Minister for Finance, make and carry out, in accordance
with its terms, a scheme or schemes for the granting of
pensions, gratuities or other allowances on retirement or
death to or in respect of persons who have held the office
of Commissioner.
(b) The Minister may, with the consent of the Minister
for Finance, at any time make and carry out, in accordance
with its terms, a scheme or schemes amending or revoking a
scheme under this paragraph.
(c) A scheme under this paragraph shall be laid before
each House of the Oireachtas as soon as may be after it is
made and, if a resolution annulling the scheme is passed
by either such House within the next 21 days on which that
House has sat after the scheme is laid before it, the
scheme shall be annulled accordingly, but without
prejudice to the validity of anything previously done
thereunder.
8. (1) The Minister may appoint to be members of the
staff of the Commissioner such number of persons as may be
determined from time to time by the Minister, with the
consent of the Minister for Finance.
(2) Members of the staff of the Commissioner shall be
civil servants.
(3) The functions of the Commissioner under this Act
may be performed during his temporary absence by such
member of the staff of the Commissioner as he may
designate for that purpose.
(4) The Minister may delegate to the Commissioner the
powers exercisable by him under the Civil Service
Commissioners Act, 1956, and the Civil Service Regulation
Acts, 1956 and 1958, as the appropriate authority in
relation to members of the staff of the Commissioner and,
if he does so, then so long as the delegation remains in
force-
(a) those powers shall, in lieu of being
exercisable by the Minister, be exercisable by the
Commissioner, and
(b) the Commissioner shall, in lieu of the
Minister, be for the purposes of this Act the
appropriate authority in relation to members of the
staff of the Commissioner.
9. (1) The Commissioner shall keep in such form as may
be approved of by the Minister, with the consent of the
Minister for Finance, all proper and usual accounts of all
moneys received or expended by him and all such special
accounts (if any) as the Minister, with the consent of the
Minister for Finance, may direct.
(2) Accounts kept in pursuance of this
paragraph in respect of each year shall be
submitted by the Commissioner in the following
year on a date (not later than a date specified by
the Minister) to the Comptroller and Auditor
General for audit and, as soon as may be after the
audit, a copy of those accounts, or of such
extracts from those accounts as the Minister may
specify, together with the report of the
Comptroller and Auditor General on the accounts,
shall be presented by the Commissioner to the
Minister who shall cause copies of the documents
presented to him to be laid before each House of
the Oireachtas.
Public Authorities and Other Bodies and Persons
1. The Government.
2. A Minister of the Government.
3. The Attorney General.
4. The Comptroller and Auditor General.
5. The Ombudsman.
6. A local authority, a health board and any other body
(other than the Garda Síochána and the Defence Forces)
established-
(1) by or under any enactment (other than the Companies
Acts, 1963 to 1987), or
(2) under the Companies Acts, 1963 to 1987, in
pursuance of powers conferred by or under another
enactment,
and financed wholly or partly by means of moneys provided,
or loans made or guaranteed, by a Minister of the Government
or the issue of shares held by or on behalf of a Minister of
the Government; and a subsidiary of any such body.
7. A company the majority of the shares in which are held
by or on behalf of a Minister of the Government.
8. A body (other than a body mentioned in paragraph 6 or 7
of this Schedule) appointed by the Government or a Minister of
the Government.
9. An individual (other than an individual remunerated by a
body mentioned in paragraph 6, 7 or 8 of this Schedule or in
relation to whom the Government or a Minister of the
Government is the appropriate authority) who is appointed by
the Government or a Minister of the Government to an office
established by or under any enactment.
10. Any other public authority, body or person standing
prescribed for the time being and financed or remunerated
wholly or partly out of moneys provided by the Oireachtas.
|