Data Protection (Processing of Personal Data in the Police Sector)

L.N. 188 of 2012

DATA PROTECTION ACT

(CAP. 440)

Data Protection (Processing of Personal Data in the Police Sector)

(Amendment) Regulations, 2012

IN EXERCISE of the powers conferred by articles 5 and 54(m)

of the Data Protection Act, the Minister for Justice, Dialogue and the

Family, after consultation with the Information and Data Protection

Commissioner, has made the following regulations:-

The title of these regulations is the Data Protection

(Processing of Personal Data in the Police Sector) (Amendment)

Regulations, 2012, and theses regulations shall be read and construed

as one with the Data Protection (Processing of Personal Data in the

Police Sector), Regulations, hereinafter referred to as the "principal

regulations".

Regulation 3 of the principal regulations shall be

substituted by the following

(1) The scope of these regulations is to

"Scope.

ensure a high level of data protection in the Police

sector, in accordance with the principles contained in

Recommendation No. R (87) 15 of the Council of

Europe.

(2) The Act shall be extended to apply to public

bodies exercising police powers to the extent as is

provided in these regulations.".

3. Immediately after regulation 4(2) of the principal

regulations there shall be added the following new sub-regulation

"(3) Public bodies exercising police powers shall consult

with the Information and Data Protection Commissioner, prior

to processing personal data which will form part of a new filing

system to be created where

(a)

sensitive personal data are to be processed; or

(b) the type of processing, in particular using

new technologies, mechanism or procedures, holds

otherwise specific risks for the fundamental rights and

freedoms, and in particular the privacy of the data

subject.".

In regulation 9(1) of the principal regulations, for the Amends

words "regarding the protection of the data subject" there shall be regulation

principal

substituted the words "or regulation laying down specific rules on the regulations.

processing or exchange of personal data in the context of police and

judicial cooperation".

Regulation 14 of the principal regulations shall be Substitutes

regulation 14 of

substituted by the following

principal

regulations.

Where a data subject has suffered damage

as a result of an unlawful processing operation, or of

any act incompatible with these regulations, he shall

be entitled to exercise an action for damages in

accordance with article 46 of the Act.".

6. Regulation 15 shall be renumbered as regulation 18.

Renumbers

regulation 15 of

the principal

regulations.

7. Immediately after regulation 14 of the

principal Adds new

regulations to

regulations there shall be added the following regulations

the principal

regulations.

(1) Any person who has access to

personal data which falls within the scope of these

regulations may process such data only if that person

is a member of, or acts on instructions of public bodies

exercising police powers, unless he is required to do so

by law.

(2) Persons working for a public body

exercising police powers shall be bound by all the data

protection rules applicable to such body and also any

other law or legally binding instrument regulating

confidentiality and secrecy applicable to their official

capacity.

(1) Public bodies exercising police

powers shall implement appropriate technical and

organisational measures to protect personal data

against accidental or unlawful destruction or

accidental loss, alteration, unauthorised disclosure or

access, in particular where the processing involves the

transmission over a network or the making available

by granting direct automated access, and against all

other unlawful forms of processing, taking into

account in particular the risks represented by the

processing and the nature of the data to be protected.

Having regard to the state of the art and the cost of

their implementation, such measures shall ensure a

level of security appropriate to the risks represented by

the processing and the nature of the data to be

protected.

(2) In respect of automated data processing,

public bodies exercising police powers shall

implement measures designed to

(a)

deny unauthorised persons access to

data-processing equipment used for processing

personal data (equipment access control);

(b) prevent the unauthorised reading,

copying, modification or removal of data media

(data media control);

(c)

prevent the unauthorised input of

data and

the unauthorised inspection,

modification or deletion of stored personal data

(storage control);

(d) prevent the use of automated data-

processing systems by unauthorised persons

using data communication equipment (user

control);

(e)

ensure that persons authorised to use

an automated data-processing system only have

access to the data covered by their access

authorisation (data access control);

(f)

ensure that it is possible to verify and

establish to which bodies personal data have

been or may be transmitted or made available

using

data

communication

equipment

(communication control);

(g) ensure that it is subsequently possible

to verify and establish which personal data have

been input into automated data-processing

systems and when and by whom the data were

input (input control);

(h) prevent the unauthorised reading,

copying, modification or deletion of personal

data during transfers of personal data or during

transportation of data media (transport control);

(i)

ensure that installed systems may, in

case of interruption, be restored (recovery);

(j)

ensure that the functions of the

system perform, that the appearance of faults in

the functions is reported (reliability) and that

stored data cannot be corrupted by means of a

malfunctioning of the system (integrity).

(3) Where a public bodies exercising police

powers engages a processor to act upon its behalf

within the meaning of article 25 of the Act, such

processor may be designated only if it can guarantee

observance of the requisite technical and

organisational measures under sub-regulation (1) and

comply with the instructions of the public bodies

exercising police powers under regulation 15. The

public bodies exercising police powers shall monitor

the processor in those respects.

(4) Personal data may be processed by a

processor only on the basis of a written contract or by

any other legally binding instrument laying down

specific data protection rules applicable to the

entrusted data processing.

(1) The Information and Data Protection

Commissioner shall be responsible for the independent

supervision and to provide advice and monitor the

application of these regulations.

(2) In order to ensure compliance with these

regulations the Information and Data Protection

Commissioner shall exercise the same functions and

powers as conferred to him under the Act.

(3) Pursuant to sub-regulation (2), the

Information and Data Protection Commissioner may

impose fines as stipulated in the Act and as may be

prescribed by means of regulations laying down

effective, proportionate and dissuasive penalties to be

imposed in case of infringements of said Act and

regulations made thereunder.".

€0.45