FAQs
Do I have to engage in amicable resolution?
Amicable (done in friendly way) resolution is a voluntary process but it is often the quickest way of getting to the root of the issue. It is always helpful to hear from the other side and it is often possible to fix misunderstandings through direct contact. However, it is not mandatory and if it is attempted it does not mean that the DPC cannot continue to examine the complaint in a more formal process.
FAQs
Why can it take a long time to examine my complaint?
You may think your complaint is a simple question but actually, there are often other pieces of legislation and responsibilities to consider as well as other far-reaching effects. For example, you may want a doctor to destroy your medical records but that can have serious implications for any future care you may require or if the doctor advised you to get a test and you refused, the doctor may be required to retain this as evidence in any future legal proceedings.
FAQs
Why will the data controller not do what I want?
Simply put, they may not be legally allowed to do what you are asking or it may not be in their interest to do so and in this instance, their interests may override your rights. For example, if you want a data controller to erase the records it holds on you but you have also threatened legal action, then the data controller’s right to defend themselves in court may override your right to have your personal data erased.
FAQs
Do I need the DPC’s outcome for another statutory body?
No, often data subjects will make a complaint to the Data Protection Commission (DPC) and another statutory body such as the Workplace Relations Commission, the Legal Service Regulatory Authority, the Ombudsman’s Office , and so on. However, those statutory bodies do not require the outcome of the DPC’s examination in order to make their own determination on the complaint that is before them.
FAQs
Do I have to submit a complaint before I can go to court?
No, at all stages it is open to a data subject to make an application to court under section 117 of the Data Protection Act, 2018. Should an individual decide to pursue such a course of action, it is important to note that the Data Protection Commission (DPC) does not have any role to play in such proceedings; in addition, the DPC will not be in a position to speed up any examination it may be undertaking to accommodate any such court action. Likewise, the court does not require the outcome of the DPC’s examination in order to make their own determination.
FAQs
Should I tell the DPC or data controller what I want?
Yes, it will reduce the time it takes to resolve an issue if all parties are aware from the beginning what is expected. However, these expectations should be reasonable and within the power of the data controller to provide.
FAQs
Will I get any money if a data controller has infringed my data protection rights?
There is no mechanism for the Data Protection Commission (DPC) to award compensation so therefore you will never receive any money from the DPC after you submit a complaint even if a finding is made in your favour.
FAQs
What if I do not like how my employer found out that I did something wrong?
The Data Protection Commission (DPC) cannot examine employment issues or criminal matters but occasionally data subjects query whether their employer could use CCTV footage of them stealing or leaving work early to discipline them. As with all data processing, the data controller should be transparent with the data subjects and this can be achieved by having the issues clearly set out in policies such as CCTV policies or privacy policies or other relevant employer/employee policies.
FAQs
Why do you not say it is a breach of my rights?
Within data protection legislation the word “breach” has a defined meaning. A data breach means there was a breach of security on the part of the data controller leading to, amongst other things, destruction or loss or unauthorised disclosure of personal data.
FAQs
Do I receive part of the fine levied on an organisation for a data breach?
No, there is no provision in data protection law for the Data Protection Commission (DPC) to award the fine or part of any fine to an affected individual.