Expert Comment, Rob Corbet – Data Protection Ireland, Volume 9 Issue 2

Perhaps the element of the General Data Protection Regulation ('GDPR') that has garnered the most attention so far is the area of sanctions. Currently under the Data Protection Acts 1988 and 2003 ('DPAs') and the ePrivacy Regulations (SI 336 of 2011), the number of criminal offences in data protection law is relatively low. Further, while the possibility of personal criminal liability for company officers exists, such prosecutions have been rare. This may be set to change once the GDPR becomes law, which is now expected to be in mid-to-late 2018.

Current offences under the DPAs

The DPAs contain a small number of offences relating principally to registration issues or obstructing or failing to comply with an investigation or sanctions notice issued by the Office of the Data Protection Commissioner ('ODPC'). In addition, there are offences in Sections 21 and 22 relating to the processing or disclosure of personal data without the authority of the data controller.