Data Protection Act, 2019, rights of a data subject

Section 10 gives a data subject the right to be told by a data controller whether personal data about them is being processed and to obtain a copy of it, section 11 a right to rectification, section 12 a right to erasure, section 13 a right to restriction of processing and section 14 a duty on the controller to notify recipients of a rectification, erasure or restriction.

Section 15 gives a right to data portability, section 16 a right to prevent processing likely to cause damage or distress, and section 17 an unqualified right to prevent processing for the purposes of direct marketing.

Section 18 gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where the processing is necessary for entering into or performing a contract with them, authorised by an enactment that lays down suitable safeguards, or based on their consent; where a contract or consent is relied on the controller must implement suitable measures to safeguard their rights, freedoms and legitimate interests, and the exceptions do not reach sensitive personal data unless the processing is in the public interest and those safeguards are in place.

Sections 19 and 20 fix the information a controller must give when it collects personal data from the data subject and when it obtains the data elsewhere, and section 21 requires that information and every communication about these rights to be transparent and to be provided in a form that lets the data subject exercise them. Section 100 leaves commencement to a proclamation.

The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.