Data Protection Act, 2019, a child's consent and sensitive personal data

Section 8 makes the processing of a child's personal data lawful only where and to the extent that consent is given or authorised by the child's parent or guardian, and requires the data controller to make reasonable efforts to verify in such cases that the consent came from a parent or guardian, taking available technology into account; a child is a person under the age of 18.

Section 9 prohibits the processing of sensitive personal data, which the Act defines to include genetic data and biometric data alongside racial or ethnic origin, political opinions, religious beliefs, membership of a political body or trade union, sexual orientation or sexual life, financial record or position and criminal record, unless one of the grounds it lists applies: the data subject's consent; necessity for a right or obligation imposed on the controller by law in connection with employment; the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld; processing by a not-for-profit political, philosophical, religious or trade union body confined to its members and not disclosed onward without consent; data the data subject has deliberately made public; legal proceedings, legal advice or the establishment, exercise or defence of legal rights; the administration of justice; functions of Parliament, of a public authority or conferred by an enactment; medical purposes undertaken by a health care professional or someone under an equivalent duty of confidentiality; and equality monitoring by racial or ethnic origin carried out with appropriate safeguards.

Section 9(2) lets the Minister by order specify further circumstances in which sensitive personal data may be processed. Section 100 leaves commencement to a proclamation. The Official Gazette of 26 March 2021 carries Statutory Instrument 2021 No. 24, the Proclamation re Data Protection Act, 2019, which is the day these provisions began to bind.