Section 2 · Data Protection Act 1988

Contents

2Collection, processing, keeping, use and disclosure of personal data.#

—(1) A data controller shall, as respects personal data kept by him or her, comply with the following provisions:

(a)the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly,

(b)the data shall be accurate and complete and, where necessary, kept up to date,

(c)the data—

(i)shall have been obtained only for one or more specified, explicit and legitimate purposes,

(ii)shall not be further processed in a manner incompatible with that purpose or those purposes,

(iii)shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and

(iv)shall not be kept for longer than is necessary for that purpose or those purposes,

(d)appropriate security measures shall be taken against unauthorised access to, or unauthorised alteration, disclosure or destruction of, the data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

(2)A data processor shall, as respects personal data processed by him, comply with paragraph (d) of subsection (1) of this section.

(3)Paragraph (a) of the said subsection (1) does not apply to information intended for inclusion in data, or to data, kept for a purpose mentioned in section 5 (1) (a) of this Act, in any case in which the application of that paragraph to the data would be likely to prejudice any of the matters mentioned in the said section 5 (1) (a).

(4)Paragraph (b) of the said subsection (1) does not apply to backup data.

(5)(a) Subparagraphs (ii) and (iv) of paragraph (c) of the said subsection (1) do not apply to personal data kept for statistical or research or other scientific purposes, and the keeping of which complies with such requirements (if any) as may be prescribed for the purpose of safeguarding the fundamental rights and freedoms of data subjects, and,

(b)the data or, as the case may be, the information constituting such data shall not be regarded for the purposes of paragraph (a) of the said subsection as having been obtained unfairly by reason only that its use for any such purpose was not disclosed when it was obtained,if the data are not used in such a way that damage or distress is, or is likely to be, caused to any data subject.

(6)Regulations shall be subject to negative resolution.

(7)References in this Article and Article 17 to legal aid include references to assistance by way of representation.

(8)

Contains Revised Acts prepared by the Law Reform Commission (revisedacts.lawreform.ie): legislative text under the Oireachtas (Open Data) PSI Licence, annotations under CC BY 4.0. Revised Acts are administrative consolidations, not authoritative.