No, there is no provision in data protection law for the Data Protection Commission (DPC) to award the fine or part of any fine to an affected individual.

This relates to an Article 15 subject access request.

The Data Protection Commission (DPC) deals with data subjects themselves in relation to their own data protection rights. However, if someone wishes to have a third party act on their behalf, then a signed letter of authority, by that individual will be required. The DPC will obtain the authorisation directly from the individual themselves and will therefore require their contact details in order to do so.

If you wish to raise a concern or lodge a complaint with the Data Protection Commission (DPC), you can go to the ‘Contact the DPC’ section of the DPC website and complete the webform in full.

Alternatively, you can email the DPC at info@dataprotection.ie. You will need to clearly set out your data protection concern.

Before making a complaint to the Data Protection Commission (DPC), it is recommended that you contact the data controller and set out your data protection concerns in writing. It is also recommended that you request a written response from the data controller; the reason being, it is the experience of the DPC, that matters can be often addressed between the individual and the data controller when the matter is initially raised with them, which means you may not need the assistance of the DPC at all.

The criteria for making a valid complaint to the Data Protection Commission (DPC) is set out under Article 77 of the General Data Protection Regulation (GDPR). This states that an individual can make a complaint if they consider that the ‘processing of personal data relating to him or her infringes this Regulation’. Therefore, for a complaint to be valid, there must be processing of your personal data in the first instance and this processing must then infringe some part of the GDPR.

The Data Protection Commission (DPC) cannot examine any allegations of defamation (a defamatory statement that tends to injure a person’s reputation in the eyes of reasonable members of society). If you have evidence that the records are factually inaccurate then you can request their erasure or rectification. You may also wish to seek independent legal advice on the matter.

For further information, read our guidance on Data Subject Access Requests – FAQ.

Article 16 of the General Data Protection Regulation (GDPR) provides for the rectification of personal data where the personal data that is being processed is inaccurate, or taking into account the purposes of processing, the data is incomplete in some way.

Depending on the data you are seeking access to, it may be the case that the access request falls under the Law Enforcement Directive (LED) as opposed to the General Data Protection Regulation (GDPR). You can request your information from An Garda Síochána (AGS) by following the instructions on the Data Access Request section of the An Garda Síochána website.

Data protection law does not apply to the personal data of deceased persons. However, a particular data controller, for reasons of goodwill, may choose upon request to supply data relating to a deceased person to a relative. Should this occur, care must be exercised by the relevant data controller when such data is being disclosed to ensure that it does not disclose the personal data of third parties.