Irish High Court Clarifies DSAR Exemptions Under The GDPR And Data Protection Act 2018

In the recent case of O’Brien v The Data Protection Commission and Ors [2026] IEHC 250, the High Court upheld the Data Protection Commission’s (“DPC”) decision that an organisation was entitled to rely on certain exemptions contained in the Irish Data Protection Act 2018 (the “2018 Act”) to refuse a data subject’s access request (“DSAR”).

The Court upheld the relevant exemptions as compatible with the GDPR (EU 2016/679) in particular, Article 23 GDPR, which permits Member States to restrict certain data subject rights in specified circumstances. This judgment is a welcome development for organisations relying on Irish statutory exemptions when dealing with DSARs.

Background

This case arose from a DSAR submitted by the appellant to Red Flag Consulting Limited (“Red Flag”) in 2018, in the context of long-running litigation concerning a dossier prepared by Red Flag on behalf of an unidentified client relating to the appellant. In the DSAR, the appellant sought access to a copy of