Irish Data Protection Act: Section 8 Compliance

The GDPR and the End of the 1988 Act Framework

The Irish Data Protection Act of 1988, as amended in 2003, has been substantially superseded in practice by the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, which came into force on May 25, 2018, and the Data Protection Act 2018 (Ireland’s implementing legislation). While the 1988 and 2003 Acts remain technically operative for matters not fully covered by the GDPR framework, practitioners advising Irish data controllers or processors, or companies processing data about Irish residents, should work within the GDPR framework as interpreted and enforced by Ireland’s Data Protection Commission (DPC).

The practical significance for companies doing business with Irish residents — or for any company whose EU data processing is conducted through an Irish entity — is substantial. Ireland is home to the European headquarters of many major technology companies, which means the DPC is the lead supervisory authority under GDPR’s one-stop-shop mechanism for those companies. The DPC’s enforcement decisions set precedent for data protection standards across the EU.

GDPR Rights That Replace and Expand Section 8

The rights described in Section 8 of the 1988 Act — the right to object to processing — have been expanded and reformulated under Articles 17, 18, and 21 of the GDPR. Key distinctions include:

• Right to object (Article 21 GDPR). Data subjects may object at any time to processing of their personal data that is based on legitimate interests (Article 6(1)(f)) or that serves the public interest (Article 6(1)(e)). Upon receipt of an objection, the controller must stop processing unless it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject. This is a broader and more immediately enforceable right than Section 8 of the 1988 Act.
• Right to erasure (Article 17 GDPR). Often called the “right to be forgotten,” this right allows data subjects to demand deletion of personal data in six circumstances, including where the data is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where the data subject has successfully exercised the Article 21 right to object. Controllers must respond to erasure requests within one month.
• Right to restriction (Article 18 GDPR). Data subjects may request that processing be restricted — data retained but not used — while a dispute about accuracy or the lawfulness of processing is pending. This is analogous to the interim protection envisioned by Section 8 but operationally more specific.

DPC Enforcement: What Non-Compliance Costs

The Data Protection Commission has emerged as one of the most consequential data protection regulators in the world, precisely because of its jurisdiction over the Irish establishments of major technology companies. DPC enforcement actions have resulted in record-setting GDPR fines: Meta was fined €1.2 billion in May 2023 for unlawful transfers of EU personal data to the United States; WhatsApp was fined €225 million in 2021 for transparency failures; and Instagram was fined €405 million in 2022 for mishandling children’s data. These decisions are binding across the EU under the consistency mechanism.

For smaller companies, the DPC’s enforcement approach has been to issue reprimands, compliance orders, and warnings before escalating to financial penalties. However, under Article 83 of the GDPR, fines for the most serious violations — including failure to respect data subject rights under Articles 17–21 — can reach €20 million or 4% of global annual turnover, whichever is higher. Companies that systematically ignore data subject objection or erasure requests face this maximum tier.

Data Transfer Compliance: Schrems II and Standard Contractual Clauses

Any company that transfers personal data from Ireland (or the EU more broadly) to the United States must comply with GDPR Chapter V transfer restrictions. The Court of Justice of the EU’s 2020 decision in Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems (Schrems II) invalidated the EU-U.S. Privacy Shield framework and created substantial uncertainty about whether Standard Contractual Clauses (SCCs) could adequately protect data transferred to the U.S. given the scope of U.S. surveillance authorities.

The EU-U.S. Data Privacy Framework, adopted in 2023, provides a new adequacy mechanism for transfers to participating U.S. companies. However, its long-term durability is uncertain — the Privacy Shield, its predecessor, was invalidated twice by EU courts. Companies relying on the DPF should maintain SCCs as a backup transfer mechanism and conduct transfer impact assessments that document the supplementary measures in place to protect transferred data.

Practical Compliance for Companies Processing Irish and EU Data

If your company processes personal data about individuals in Ireland or elsewhere in the EU, compliance obligations include: (1) identifying the lawful basis for each category of processing under GDPR Article 6; (2) maintaining records of processing activities under Article 30; (3) implementing a process for responding to data subject rights requests within the GDPR’s one-month deadline; (4) conducting data protection impact assessments for high-risk processing activities; (5) ensuring data processing agreements are in place with all processors; and (6) verifying that cross-border data transfer mechanisms are in place and documented.

The transition from the 1988/2003 Act framework to the GDPR was not merely procedural — it substantially increased both the scope of data subject rights and the penalties for non-compliance. Companies that have not updated their data governance programs since the GDPR came into force are operating with significant legal exposure.

For guidance on GDPR compliance, data subject rights management, or responding to a DPC inquiry, contact Revision Legal’s internet law attorneys through the form on this page or call 855-473-8474.