Skip to content

Part 7 » Exemption from Principles and Rules of Processing of Data

39. National security, defence and public order

A data controller that processes personal data in the interests of national security, defence and public order is exempt from the provisions of part IV, except for section 12 (1) (c), (d), (e) and (g).

40. Prevention, detection, investigation and prosecution of contraventions of law

  1. The processing of personal data in the interests of prevention, detection, investigation and prosecution of an offence or any other contravention of law shall not be permitted unless it is authorised by a written law and is necessary for, and proportionate to, such interests being achieved.
  2. Processing authorised by law under subsection (1) shall be exempt from the provisions of Part IV, except section 12 (1) (c), (d), (e) and (g).
  3. A data controller shall not retain personal data processed under subsection (1) once the purpose of prevention, detection, investigation or prosecution of an offence or other contravention of law is complete except where that personal data is necessary for the maintenance of any record or database which constitutes a proportionate measure to prevent, detect, investigate or prosecute an offence or class of offences in future.
  1. Where processing of personal data is necessary for enforcing a legal right or claim, seeking a relief, defending a charge, opposing a claim, or obtaining legal advice from a legal practitioner in an impending legal proceeding, that processing shall be exempt from the provisions of Part IV except section 12 (1) (c), (d), (e) and (g).
  2. Where processing of personal data by a court or tribunal is necessary for the exercise of any judicial function, that processing is exempt from the provisions of part IV except section 12 (1) (c), (d), (e) and (g).

42. Research, archiving or statistical purposes

  1. Where processing of personal data is necessary for research, archiving, or statistical purposes, that processing is exempt from the provisions of Part IV, except section 12 (1)(c), (d), (e) and (g).
  2. Despite subsection (1), where sensitive personal data is being processed for research purposes that relate to scientific or historical research by a person other than a public body, that person shall not process such sensitive personal data without the authorisation of the Data Protection Commisioner.
  3. Where personal data is being processed for scientifc research purposes by a person other than a public body, that person shall ensure that the personal data is anonymised

43. Journalistic purpose

  1. Where the processing of personal data is necessary for or relevant to a journalistic purpose, that processing is exempt from the provisions of the Act, except —

    1. section 12(1) (c), (d), (e) and (g); and
    2. section 47.

  2. Subsection (1) applies only where a data controller can demonstrate that the processing is in compliance with —

    1. the law regulating journalists in the Republic, or
    2. any code or guidelines issued by the Independent Broadcasting Authority.

44. Processing to be lawful and legitimate

The requirement for the processing of personal data under this Part shall be for the lawful and legitimate purposes.