business data-protection data-ownership ireland data
How long should I wait for a Data Access Request in Ireland
<p>A few weeks ago I made a Data Access request to an Irish company I've been doing business with for just over 10 years. I've not received any sort of response - not even an acknowledgment of my e-mail. Ignoring mails isn't unusual for this company but it is increasingly becoming a problem for me. This is why I have decided to get my data and go somewhere else.</p>
<p>I've been told that I have a right to this data. Some people mentioned GPDR as a reason. Other people have talked about the Freedom of information act.</p>
<ol>
<li>How long do I need to wait?</li>
<li>Do I have to send them reminder letters? If so, how many?</li>
<li>What do I do if they continue to ignore me?</li>
</ol>
<p>I need this data to move on, and the Taxman will certainly need some of it</p>

<p>According to The official government page <a href="https://www.citizensinformation.ie/en/government_in_ireland/national_government/standards_and_accountability/freedom_of_information.html#l9c495" rel="nofollow noreferrer">&quot;Freedom of information (FOI)&quot;</a></p>
<blockquote>
<p>FOI only applies to FOI bodies. These are mostly bodies that are publicly funded (for example, government departments).</p>
<p>If you want to apply for records that are held about you by a private organisation, you can apply under <a href="https://www.citizensinformation.ie/en/government_in_ireland/data_protection/rights_under_general_data_protection_regulation.en.html" rel="nofollow noreferrer">data protection laws</a>.</p>
<p>FOI allows the public to have information about what the Government is doing and it is often used by journalists, campaigners and opposition parties.</p>
<p>...</p>
<p><strong>Organisations that are covered by FOI</strong></p>
<p>FOI laws apply to public bodies unless they are exempt. FOI bodies include:</p>
<ul>
<li>Government departments</li>
<li>Bodies that were set up by an Act of the Oireachtas (for example, the Consumer and Competition Authority was set up by the Consumer and Competition Protection Act 2014), or established by a Minister or the Government</li>
<li>A company where the majority of the shares are held by or on behalf of a Minister of the Government, or any of its subsidiaries</li>
<li>A higher education institute that is publicly funded</li>
<li>Some non-public bodies that get a lot of public funding</li>
</ul>
</blockquote>
<p>Unless the company you are dealing with is an &quot;FOI Body&quot; it seems that the Irish FOI will not apply.</p>
<p>The official Irish Government page on <a href="https://www.citizensinformation.ie/en/government_in_ireland/data_protection/rights_under_general_data_protection_regulation.html#l3f4ad" rel="nofollow noreferrer">&quot;How to access your personal data under the GDPR&quot;</a> states:</p>
<blockquote>
<p><strong>Make your request in writing</strong></p>
<p>Ask as soon as possible and in writing. This can either be by letter or email. Seeking your personal data is known as making an access request or a data subject access request. You should state in the letter or email that it is an access request. This means that both you and the data controller will have a record of the request and its content if an issue later arises. Some large companies allow you to automatically download your personal information directly through their website.</p>
<p><strong>Contact the relevant data protection officer</strong></p>
<p>Many large organisations have a Data Protection Officer (or DPO) and they are generally the best person to contact about your request for information. You should be able to find their contact details in the privacy policy or ‘contact us’ section of the organisation’s website. Where there is no specific email address for a data access request, you should use the organisation’s general contact details.</p>
<p>...</p>
<p><strong>How will the company or organisation deal with my request?</strong></p>
<p>The data controller must respond to your request within one month. However, if you complain to the Data Protection Commission, the organisation may be given some extra time if it missed the deadline as a result of COVID-19.</p>
<p>If the request is complex or involves a large amount of information, the data controller can extend the time to respond by a further two months. You should receive a written explanation for any extension within the initial one-month period.</p>
<p>If your request is very broad and requires the data controller to provide a large amount of information and documents, you may be asked to reduce the number of documents containing personal data requested. However, you can insist on receiving all the information and documentation held. If you do, it may take longer to comply with your access request.</p>
<p>In general, the data controller should respond to your access request in the same format the request was made, or in the way in which you specifically asked for a response. For example, if you emailed your request, the data controller should provide the information by email, unless you request otherwise.</p>
<p>...</p>
<p><strong>What can I do if I am unhappy with the outcome of an access request?</strong></p>
<p>If you are unhappy with the way your access request was processed, you can make a complaint to the Data Protection Commission (DPC)](<a href="https://www.dataprotection.ie/" rel="nofollow noreferrer">https://www.dataprotection.ie/</a>).</p>
<p>The DPC is Ireland’s independent authority with responsibility for upholding the right of people in the EU to have their personal data protected. It monitors compliance with GDPR and other data protection legislation and deals with complaints in relation to data protection breaches. The DPC website contains helpful explanations of data protection law.</p>
<p>You may be unhappy with the way your request was handled because:</p>
<ul>
<li>There was no response or a delayed response to your access request</li>
<li>The response to the request was incomplete</li>
<li>You believe the data controller wrongly relied on exemptions to not share your personal data with you</li>
</ul>
<p><strong>How do I make a complaint?</strong></p>
<p>Complete the DPC’s online complaint form. You will be asked to provide evidence to support your complaint. This includes:</p>
<ul>
<li>Evidence of your access request</li>
<li>Correspondence between you (or your legal representative) and the data controller and</li>
<li>information in support of your belief that the data controller holds your personal Information</li>
</ul>
</blockquote>
<p>The GDPR provides the right of access to one's personal information under <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Article 15</a>, but leaves the details of times for response and handling of complaints to the national data protection authority and to national law. In the case of Ireland this is the Irish DPC.</p>
<p>The GDPR dos not provide a right of private action (that is the right to bring an individual lawsuit) to enforce its data access provisions.That can only be done through a complaint to a national data protection authority.</p>
