S.I. No. 338/2025 - Data Protection Act 2018 (Section 60(6)) (Defence Forces Tribunal of Inquiry) Regulations 2025

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 22nd July, 2025.

I, SIMON HARRIS, Minister for Defence, in exercise of the powers conferred on me by subsection (6) of section 60 of the Data Protection Act 2018 (No. 7 of 2018), and having duly complied with subsections (9)(b) and (10) of section 60 of that Act, hereby make the following regulations, with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House:

Citation

1. These Regulations may be cited as the Data Protection Act 2018 (Section 60(6)) (Defence Forces Tribunal of Inquiry) Regulations 2025.

Definitions

2. In these Regulations -

“Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018);

“Article 10 data” has the same meaning as it has in section 55 of the Act of 2018;

“Instrument of 2024” means the Tribunals of Inquiry (Evidence) Act 1921 (Appointment of Tribunal) Instrument 2024 ( S.I. No. 304 of 2024 );

“relevant function” has the meaning assigned to it by Regulation 3;

“relevant objective” has the meaning assigned to it by Regulation 4;

“resolutions” means the resolution passed by Dáil Éireann on 24 January 2024 and the resolution passed by Seanad Éireann on 30 January 2024, the text of which resolutions is set out in the recital to the Instrument of 2024;

“Tribunal” means the tribunal appointed by the Instrument of 2024.

Relevant function

3. In these Regulations, “relevant function” means a function of the Tribunal under the Tribunals of Inquiry (Evidence) Acts 1921 to 2011 to inquire into, report and make such findings and recommendations as it sees fit to the Taoiseach on the definite matters of urgent public importance specified in the resolutions.

Relevant objective

4. In these Regulations, “relevant objective” means an objective -

(a) referred to in paragraph (b) of section 60(7) of the Act of 2018, and

(b) pursued by the Tribunal in performing a relevant function.

Scope: categories of personal data

5. (1) These Regulations apply to personal data (including special categories of personal data and Article 10 data) processed by any of the persons specified in paragraph (3) and in respect of which such person is the controller.

(2) The categories of personal data processed by the Tribunal shall be specified in policies prepared by the Tribunal and published on a website maintained by or on behalf of the Tribunal or in such other manner as the Tribunal considers appropriate.

(3) The persons referred to in paragraph (1) are as follows:

(a) the sole member of the Tribunal;

(b) the registrar to the Tribunal;

(c) counsel to the Tribunal;

(d) solicitor to the Tribunal;

(e) a person appointed by the Tribunal in accordance with section 6 of the Tribunals of Inquiry (Evidence) (Amendment) Act 2002 (No. 7 of 2002) to be an investigator;

(f) a member of staff of the Tribunal;

(g) a person appointed by the Tribunal to provide advice or assistance to it in respect of any matter it thinks fit.

Scope: purpose of processing

6. These Regulations apply to the processing, by any of the persons specified in Regulation 5(3), of personal data where that processing is necessary for the achievement of a relevant objective.

Restriction

7. (1) The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article 5 (in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22), of the Data Protection Regulation, in respect of processing to which these Regulations apply, are restricted to the extent that such a restriction is -

(a) necessary, and only for so long as is so necessary, to safeguard a relevant objective, and

(b) proportionate to the need to safeguard that relevant objective,

including, but not limited to, where the exercise of the right or compliance with the obligation, as the case may be, would -

(i) obstruct or otherwise prejudice, in whole or in part, the performance by the Tribunal of a relevant function,

(ii) disclose that the Tribunal is performing a function in pursuit of a relevant objective, in a case in which such disclosure would obstruct or otherwise prejudice the achievement of the relevant objective, or

(iii) prevent the Tribunal processing personal data to which these Regulations apply for a period of time, in a case where any delay to the processing would obstruct or otherwise prejudice the achievement of a relevant objective.

(2) Matters which are relevant, for the purposes of paragraph (1), in determining whether a restriction of a right or obligation is -

(a) necessary to safeguard a relevant objective, and

(b) proportionate to the need to safeguard that relevant objective, include -

(i) whether or not the exercise of the right or compliance with the obligation would obstruct or otherwise prejudice the achievement by the Tribunal of the relevant objective,

(ii) the need to respect the essence of the right to data protection of the data subject,

(iii) the risks to the rights and freedoms of the data subject which may result from such a restriction, and

(iv) the need to balance the essence of the right to data protection with the impacts to the rights and freedoms of other persons which may result from the Tribunal being unable to perform a relevant function or achieve the relevant objective.

Information to be provided where a right or obligation is restricted

8. (1) Where a right or obligation referred to in paragraph (1) of Regulation 7 is restricted in accordance with that Regulation, the Tribunal shall notify the data subject who exercised the right or to whom the obligation relates in writing in a timely manner of the restriction, unless, in the opinion of the Tribunal, notifying the data subject may be prejudicial to the achievement of a relevant objective.

(2) A notification under paragraph (1) shall inform the data subject concerned of the following:

(a) the right or obligation referred to in Regulation 7(1) affected by the restriction;

(b) whether the right or obligation concerned has been restricted in whole or in part;

(c) the reasons for the restriction, unless informing the data subject concerned of the reasons may, in the opinion of the Tribunal, obstruct or otherwise prejudice the achievement of a relevant objective;

(d) the categories of personal data to which the restriction applies;

(e) the purposes for which the personal data is being processed;

(f) the controller or categories of controllers processing the personal data;

(g) the policies and procedures referred to in Regulation 10(1) and in compliance with which the restriction and processing are undertaken;

(h) the place where the policies referred to in subparagraph (g) may be inspected;

(i) that the data subject concerned may lodge a complaint with the Data Protection Commission pursuant to Article 77(1) of the Data Protection Regulation;

(j) that the right referred to in subparagraph (i) is without prejudice to any other rights or remedies which the data subject concerned may have in relation to the Tribunal, including judicial review of, and an appeal in relation to, a decision of the Tribunal.

Communication with data subject

9. The Tribunal shall ensure that all information provided to a data subject under or in relation to these Regulations is provided in a concise, intelligible and easily accessible form using clear and plain language.

Safeguards

10. (1) The Tribunal shall prepare and implement policies and procedures to provide for the matters referred to in Article 23(2)(d) and (f) of the Data Protection Regulation.

(2) The policies and procedures referred to in paragraph (1) shall be published on a website maintained by or on behalf of the Tribunal or in such other manner as the Tribunal considers appropriate.

(3) Without prejudice to the generality of paragraph (1), the policies and procedures referred to in that paragraph shall provide for the following:

(a) the use of secure storage, passwords, encryption and other such safeguards as may be necessary, taking into account the nature, scope and purpose of the processing of the category of data, to ensure personal data can only be accessed by the persons specified in Regulation 5(3);

(b) the use of controls to ensure that personal data is only disclosed to the persons specified in Regulation 5(3);

(c) the determination of appropriate storage periods for personal data or classes of personal data, taking into account the nature, scope and purpose of the processing of the category of data;

(d) the treatment of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (c);

(e) data minimisation, including the use of anonymisation and pseudonymisation.

(4) The policies and procedures referred to in paragraph (1) shall be reviewed by the Tribunal on a regular basis and updated where the Tribunal considers it appropriate to do so.

Interaction with other law

11. The restriction referred to in paragraph (1) of Regulation 7 is in addition to and not in substitution for any restriction of the rights and obligations referred to in that paragraph under any other enactment or law of the European Union.

GIVEN under my Official Seal,

11 July, 2025.

SIMON HARRIS,

Minister for Defence.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These Regulations restrict, in limited circumstances, certain obligations and rights provided for in the General Data Protection Regulation (GDPR) (EU Regulation 2016/679). The restrictions only apply where necessary and proportionate in respect of the performance by the Defence Forces Tribunal of Inquiry of its functions.

The Regulations also set out the safeguards that will apply where rights and obligations are being restricted.