The DPC received a complaint in which the complainant’s representative indicated that they wished to make a formal complaint regarding the delay by Tusla to release records containing their client’s personal data on foot of a subject access request. The representative further stated that a full response to the complainant’s access request had not been provided and they had been receiving the records containing personal data in a piecemeal fashion for the previous two years. It was unclear to the complainant’s representative the amount of personal data outstanding in relation to their client’s access request.

The DPC commenced an examination of the complaint by contacting Tusla requesting that it provide the individual with a copy of all personal data held or controlled by it in relation to the individual or notify the individual of the refusal of the subject access request identifying any statutory restriction relied on by it to withhold their data.

Tusla responded indicating that it would be in a position to release personal data to the data subject within a specified timeframe. However, this deadline passed without the complete records containing personal data being released. Subsequent to further DPC engagement, Tusla outlined that, due to the volume of personal data involved, the personal data relating to the individual would issue in batches. This release would be subject to restrictions being applied to third party non personal data, personal data subject to legal professional privilege and where the release of personal data would be in contempt of court proceedings.

The complainant’s representative later confirmed they had received  a portion of their client’s personal data but advised that it was heavily redacted. It clarified the records containing the personal data of the individual that remained outstanding and which it was seeking urgently. An extensive exchange of correspondence between Tusla and the DPC followed over an extended period of time during which several deadlines were not met by Tusla in relation to the issuing of records containing personal data and /or responding to correspondence from the DPC and the data subject’s representative.

The DPC considered that an amicable resolution to this complaint was not achievable and considered it appropriate to conclude that process and issue an Enforcement Notice pursuant to Section 109(5)(d)(i) of the Data Protection Act 2018 to require the data controller to furnish the remaining records of personal data to the data subject within a specified timeframe. This notice informed Tusla of the following:

‘A person (being a data controller or data processor) who, without reasonable excuse, fails or refuses to comply with a requirement specified in an enforcement notice shall be guilty of an offence under Section 133*19) of the Data Protection Act 2018 and shall be liable (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or (ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.’

The issuing of this Enforcement Notice resulted in the remaining records containing personal data issuing to the data subject within the timeframe specified in the Enforcement Notice.