Law note · Ireland
GDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in Ireland
The DPC is Ireland's supervisory authority under Part 5 of the DPA 2018, with General Data Protection Regulation (GDPR) Article 83 administrative fines. Article 82 arms an individual with a direct private right of action, and Section 117 DPA 2018 specifies that the civil action for material or non-material damage, including distress, is brought in the Circuit Court or the High Court.
Ireland's own collective-redress channel is limited: a not-for-profit body can act on a data subject's authorised behalf under Article 80(1), and the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 lets a body designated a qualified entity by the Minister for Enterprise, Trade and Employment bring representative actions covering DPA 2018 claims, a designation reviewed at least every five years and revocable.
What it asks of an app
- Expect the Data Protection Commission to have jurisdiction and fining power, up to the higher of EUR 20,000,000 or 4 percent of global annual turnover, over your processing of personal data of a person in Ireland.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor in the Circuit Court or the High Court, under General Data Protection Regulation (GDPR) Article 82 and Data Protection Act 2018 Section 117.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Data Protection Act 2018 §117; Representative Actions for the Protection of the Collective Interests of Consumers Act 2023