Data Protection Act 1988 (Section 16(1)) Regulations 2007
Statutory Instruments
Source: Statutory Instruments

num: 1
paragraphs: (1) These Regulations may be cited as the Data Protection Act 1988 (Section 16(1)) Regulations 2007.
(2) These Regulations come into operation on 1 October 2007.
num: 2
paragraphs: In these Regulations—
(a) the office of President of Ireland, or
(b) membership of—
(i) either House of the Oireachtas,
(ii) the European Parliament, or
(iii) a local authority;
num: 3
paragraphs: (1) Subject to paragraph (2) and Regulation 4, the following categories of data controller and data processor are specified for the purposes of section 16(1) (inserted by section 16 of the Act of 2003) of the Principal Act:
(a) a data controller who processes personal data relating to the data controller’s past, existing or prospective employees in the ordinary course of personnel administration and not for any other purpose, where the data are not processed other than where it is necessary to carry out such processing in the ordinary course of personnel administration;
(b) a data controller, being a person—
(i) who is seeking or intends to seek nomination as a candidate for election to a political office,
(ii) who is nominated as a candidate for election to a political office, or
(iii) who holds a political office,
(I) electors, for the purpose of electoral activities,
(II) persons from whom donations are sought by the data controller, for political purposes,
(III) persons by whom or on whose behalf donations are made to the data controller, for political purposes,
(IV) persons seeking advice or assistance from the data controller in his or her capacity as a person falling under clause (i), (ii) or (iii), for the purpose of providing such advice or assistance,
(c) a data controller, being a person who sought nomination as a candidate for election to a political office but was not so nominated, or who was so nominated, but who was not elected to such office at the election in respect of which he or she was so nominated, who, for a reasonable period thereafter, processes personal data relating to—
(i) electors, for the purpose of electoral activities,
(ii) persons from whom donations are sought by the data controller, for political purposes,
(iii) persons by whom or on whose behalf donations are made to the data controller, for political purposes,
(iv) persons seeking advice or assistance from the data controller in his or her capacity as a person who sought nomination as a candidate for election to a political office or election to such office, as the case may be, for the purpose of providing such advice or assistance,
(d) a data controller, being an educational establishment, that is—
(i) a preschool service within the meaning of Part VII of the Child Care Act 1991 (No. 17 of 1991),
(ii) a primary school,
(iii) a post-primary school,
(iv) an institution providing adult, continuing or further education, or
(v) a university or any other third-level or higher-level institution,
(e) a data controller, being a solicitor who, for the purpose of providing legal services to his or her clients, processes personal data relating to—
(i) his or her clients, or
(ii) persons who are, or may be, connected with the provision by him or her of such services to his or her clients,
(f) a data controller, being a barrister who processes personal data relating to—
(i) his or her clients, or
(ii) persons who are, or may be, connected with the provision by him or her of legal professional services to his or her clients,
(g) a data controller, other than a health professional who processes personal data relating to the physical or mental health or condition of a data subject for medical purposes, who processes personal data relating to the past, existing or prospective customers or suppliers of the data controller for the purposes of—
(i) advertising or marketing the data controller’s business, activity, goods or services,
(ii) keeping accounts relating to any business or other activity carried on by the data controller,
(iii) deciding whether to accept any person as a customer or supplier,
(iv) keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments and deliveries are made or services provided by or to the data controller in respect of those transactions,
(v) making financial or management forecasts to assist in the conduct of the business or other activity carried on by the data controller, or
(vi) performing a contract with a data subject,
(h) a data controller, being a company which processes personal data relating to the past or existing shareholders, directors or other officers of the company for the purpose of compliance with the Companies Acts, where the data are not processed other than where it is necessary to carry out such processing for that purpose;
(i) a data controller who processes personal data with a view to the publication of any journalistic, literary or artistic material, where the data are not processed other than where it is necessary to carry out such processing for journalistic, literary or artistic purposes;
(j) a data controller or a data processor to whom a code of practice in respect of which a resolution approving of it has been passed by each House of the Oireachtas under section 13(3) of the Principal Act applies;
(k) a data processor who processes personal data on behalf of a data controller insofar as the processing of the data would, if undertaken by the data controller, fall under any one or more of paragraphs (a) to (j).
(2) The specification of the categories of data controller and data processor referred to in paragraph (1) for the purposes of section 16(1) (inserted by section 16 of the Act of 2003) of the Principal Act shall apply even if such a data controller or data processor processes the personal data to which the specification relates in the circumstances specified in section 8 of that Act.
num: 4
paragraphs: The following categories of data controller and data processor are not specified for the purposes of section 16(1) (inserted by section 16 of the Act of 2003) of the Principal Act even if such a data controller or data processor falls under any one or more of paragraphs (a) to (k) of Regulation 3(1):