Case Studies Law Enforcement Directive (LED)

 

Law Enforcement Directive (LED) Access Request - Rights and Restrictions

Under the Law Enforcement Directive (LED) as transposed into Irish law by Parts 5 & 6 (sections 69 to 104) of the Data Protection Act 2018 (the Act), there may be restrictions placed on an individual’s right of access to records containing personal data. 

An individual requested all personal data pertaining to themselves processed by An Garda Siochána (AGS).  AGS responded to the individual providing some documentation containing personal data. In its reply, AGS also advised that certain documents were being released in a redacted format and that further documents were being withheld, in their entirety.  The exemptions on which AGS were relying were sections 91(7) and 94(3)(a) of the Act.  Section 91(7) refers to data that includes personal data relating to another individual that would reveal,  or would be capable of revealing, the identity of the other individual while 94(3) (a) relates to data that would prejudice the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties.

As the individual was not satisfied with the response received from AGS, they made a complaint to the DPC. Upon receipt of the complaint, the DPC identified it as being a LED complaint as opposed to a GDPR complaint. As part of the DPC’s examination of the complaint, the DPC requested AGS to provide further detail in relation to its reliance on exemptions to withhold personal data in response to the access request. Upon receipt of the requested further detail from AGS, the DPC then requested to view all redacted and withheld personal data and attended at the AGS office to do so.

 
An on-site visit took place in which the DPC examined the documents in question. During this visit, the DPC engaged with AGS seeking clarification on the exemptions being applied to the documents that were being redacted and withheld in their entirety. Following this engagement, further personal data was identified for release. The outcome of this onsite visit resulted in the individual receiving their personal data and the AGS gained a greater understanding of the how the exemptions can be applied.

Key Takeaway

  • The viewing of the documentation by the DPC at the offices of the AGS allowed the DPC to engage directly with AGS in relation to its use of exemptions.  In requiring AGS to be more thorough in its assessment of such exemptions, the DPC enabled additional personal data to be accessed by the individual – albeit legitimately redacted – per the 2018 Act.