Role of the Office of the Data Protection Commissioner

The Office of the Data Protection Commissioner is established under the Data Protection Acts in order to provide protection for the rights of individuals under the Acts to provide protection for the rights of individuals under the Acts.

The Data Protection Commissioner’s role is to ensure that those who keep personal data comply with the provisions of the Acts.  The Office of the Data Protection Commissioner has a wide range of enforcement powers to assist in ensuring that the principles of data protection are being observed. These powers include the serving of legal notices compelling data controllers (i.e. schools/ETBs) to provide information needed to assist the enquiries of the Office of the Data Protection Commissioner and compelling a data controller to implement one or more provisions of the Acts in a particular prescribed manner.

The Office of the Data Protection Commissioner may investigate complaints made by the general public or carry out investigations proactively. The Office of the Data Protection Commissioner may, for example, authorise officers to enter premises and to inspect the type of personal information kept, how it is processed and the security measures in place.  A repository of case studies is available on the Office of the Data Protection Commissioner website. Click here to view case studies.

Data controllers are required to co-operate fully with such officers.  A data controller found guilty of an offence under the Acts can be fined amounts up to €100,000 on conviction on indictment, (or up to €250,000 for offences under the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (SI 336/2011)) and/or may be ordered to delete all or part of the database. The Commissioner also publishes an annual report which names, in certain cases, those data controllers that were the subject of investigation or action by the Commissioner’s Office.

It is important to note that where schools/ETBs may have a particular concern or query in relation to data protection, advice should be sought at an early stage.