FAQs
Will I get any money if a data controller has infringed my data protection rights?
There is no mechanism for the Data Protection Commission (DPC) to award compensation so therefore you will never receive any money from the DPC after you submit a complaint even if a finding is made in your favour.
FAQs
What if I do not like how my employer found out that I did something wrong?
The Data Protection Commission (DPC) cannot examine employment issues or criminal matters but occasionally data subjects query whether their employer could use CCTV footage of them stealing or leaving work early to discipline them. As with all data processing, the data controller should be transparent with the data subjects and this can be achieved by having the issues clearly set out in policies such as CCTV policies or privacy policies or other relevant employer/employee policies.
FAQs
Why do you not say it is a breach of my rights?
Within data protection legislation the word “breach” has a defined meaning. A data breach means there was a breach of security on the part of the data controller leading to, amongst other things, destruction or loss or unauthorised disclosure of personal data.
FAQs
Do I receive part of the fine levied on an organisation for a data breach?
No, there is no provision in data protection law for the Data Protection Commission (DPC) to award the fine or part of any fine to an affected individual.
FAQs
Can the DPC get my personal data for me from an organisation?
This relates to an Article 15 subject access request.
FAQs
Can I make a complaint on behalf of another person?
The Data Protection Commission (DPC) deals with data subjects themselves in relation to their own data protection rights. However, if someone wishes to have a third party act on their behalf, then a signed letter of authority, by that individual will be required. The DPC will obtain the authorisation directly from the individual themselves and will therefore require their contact details in order to do so.
FAQs
Making a complaint with the DPC
If you wish to raise a concern or lodge a complaint with the Data Protection Commission (DPC), you can go to the ‘Contact the DPC’ section of the DPC website and complete the webform in full.
Alternatively, you can email the DPC at info@dataprotection.ie. You will need to clearly set out your data protection concern.
FAQs
What do I need to do before I make a complaint to the DPC?
Before making a complaint to the Data Protection Commission (DPC), it is recommended that you contact the data controller and set out your data protection concerns in writing. It is also recommended that you request a written response from the data controller; the reason being, it is the experience of the DPC, that matters can be often addressed between the individual and the data controller when the matter is initially raised with them, which means you may not need the assistance of the DPC at all.
FAQs
What is the basis for making a valid complaint to the DPC?
The criteria for making a valid complaint to the Data Protection Commission (DPC) is set out under Article 77 of the General Data Protection Regulation (GDPR). This states that an individual can make a complaint if they consider that the ‘processing of personal data relating to him or her infringes this Regulation’. Therefore, for a complaint to be valid, there must be processing of your personal data in the first instance and this processing must then infringe some part of the GDPR.
FAQs
What can I do if a data controller has records that defame me or damage my reputation?
The Data Protection Commission (DPC) cannot examine any allegations of defamation (a defamatory statement that tends to injure a person’s reputation in the eyes of reasonable members of society). If you have evidence that the records are factually inaccurate then you can request their erasure or rectification. You may also wish to seek independent legal advice on the matter.
For further information, read our guidance on Data Subject Access Requests – FAQ.