Data Protection Act, 2018, Information Commissioner, enforcement and offences

Sections 23 and 24 make the Information Commissioner the officer appointed under section 35 of the Freedom of Information Act, and give the Information Commissioner functions including monitoring compliance, advising public and private bodies, receiving and investigating complaints, and conducting research and education.

Section 25 lets the Information Commissioner investigate, on a data subject's complaint or on the Commissioner's own initiative, whether a public body or private body has contravened the Act, and requires the Commissioner to notify the data subject of the decision and their right of appeal to the Court. Section 28 lets the Information Commissioner serve an information notice requiring a person to furnish access to personal data, documentation of its processing, or information about its security.

Section 30 lets the Information Commissioner serve an enforcement notice on a body that has contravened or is contravening a provision of the Act whose contravention is an offence, specifying the steps required and the time to take them, including rectifying or erasing personal data, and requires the body to notify the data subject and, where reasonably practicable, anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying if compliance materially modifies the data.

Section 31 lets the Information Commissioner assess a body's processing on request or at the Commissioner's own discretion, and report non-compliance to the body with recommendations. Section 32 lets a data subject who suffers damage from a body's contravention of the Act bring civil proceedings in the Court, subject to a defence that the body took reasonable care to comply.

Section 33 makes it an offence, carrying a fine not exceeding five thousand dollars or imprisonment not exceeding six months, to obstruct the Information Commissioner or an authorised officer. Section 34 bars an employer from dismissing, suspending, demoting, disciplining, harassing, disadvantaging, or denying a benefit to an employee for reporting or refusing to participate in a contravention of the Act in good faith.

Section 35 makes it an offence to wilfully disclose personal information in contravention of the Act, or to collect, store, or dispose of personal information in a manner that contravenes the Act, and section 36 makes it an offence to breach the whistleblower confidentiality obligation section 34 establishes. Section 37 makes an officer, director, or agent of a corporation who directed, authorised, assented to, or participated in an offence the corporation committed a party to that offence.

Section 38 sets the residual penalty for an offence with no penalty otherwise specified at, for an individual, a fine of not more than fifty thousand dollars or imprisonment of three years on summary conviction, or one hundred thousand dollars or five years on indictment, and for a body corporate, two hundred and fifty thousand dollars on summary conviction or five hundred thousand dollars on indictment.