Data protection
Ireland applies the GDPR through the Data Protection Act 2018. Because many large technology companies have their EU headquarters in Dublin, the Irish Data Protection Commission acts as lead supervisory authority for their European operations, and has issued some of the largest fines in the EU.
Key points
| Rights | Access, rectification, erasure, restriction, portability, objection |
|---|---|
| Timeframe | One month, extendable by two for complex requests |
| Regulator | Data Protection Commission, lead authority for many multinationals |
| Fines | Up to €20m or 4 % of global turnover |
| One-stop shop | Complaints can be lodged with your own national authority even against an Irish-established company |
| ePrivacy | Separate regulations govern cookies and electronic marketing |
| Lead authority | The DPC supervises many global technology companies headquartered here |
| Caseload | Cross-border complaints can take years to resolve |
| Amicable resolution | The DPC attempts this before a formal inquiry |
| Courts | A data protection action can be brought in the Circuit Court |
In practice
- State clearly what outcome you want: deletion, correction, or an inquiry.
- For a modest claim, the Circuit Court route can be faster than waiting for the regulator.
Cost and coverage
Free.
Recent changes
The Irish DPC's decisions against major platforms have shaped European practice on consent, behavioural advertising and international transfers.
Where to go
- Data Protection Commission — online complaint form.
- Company data protection officers.
- Digital Rights Ireland and other civil society organisations.
Worth knowing
If a service is established in Ireland, you can still complain to the regulator where you live: it must forward the case under the one-stop-shop mechanism. Because Ireland is the lead authority for so many platforms, complaints about large companies are handled as cross-border cases and take much longer.
The general article: Data protection · Compare with another country
Privacy
The Irish courts have recognised privacy as an unenumerated personal right under Article 40.3 of the Constitution. Day to day, the GDPR and the Data Protection Act 2018 do the heavy lifting, and the Data Protection Commission supervises many of the largest technology companies because their European headquarters are in Ireland.
Key points
| Constitution | Privacy recognised as an unenumerated personal right under Article 40.3 |
|---|---|
| Statute | GDPR and Data Protection Act 2018 |
| Regulator | Data Protection Commission, free to complain to |
| Online abuse | Harassment, Harmful Communications and Related Offences Act 2020 |
| Media | Press Council and Office of the Press Ombudsman, free complaints |
| Remedy | Compensation is available under the GDPR, but proven damage is required |
| Constitutional damages | Available for breach of the constitutional right, independently of statute |
| Injunctions | Granted to restrain publication where private information is at stake |
| Circuit Court | Data protection actions can be brought there, with lower costs than the High Court |
In practice
- Use the Circuit Court for modest claims: the costs exposure is far lower.
Where to go
- Data Protection Commission.
- Office of the Press Ombudsman.
- Free Legal Advice Centres.
Worth knowing
The Data Protection Commission handles a very large caseload as lead authority for many global platforms, so complaints about big tech can take a long time. Say clearly what outcome you want. The constitutional right to privacy exists alongside data protection law, so a claim can be framed in both ways at once.
Image rights
The Harassment, Harmful Communications and Related Offences Act 2020, known as Coco's Law, created two offences: distributing intimate images without consent and with intent to cause harm, and the broader offence of recording or distributing an intimate image without consent, regardless of intent. Beyond that, the constitutional right to privacy and the GDPR apply to identifiable images.
Key points
| Statute | Harassment, Harmful Communications and Related Offences Act 2020 |
|---|---|
| Two offences | One requiring intent to harm, one not requiring it at all |
| Anonymity | The victim is entitled to anonymity in proceedings |
| Data protection | An identifiable image is personal data under the GDPR |
| Online safety | Coimisiún na Meán supervises platforms and can require removal |
| Public places | Photography in public is generally lawful |
| Online safety code | Regulated platforms must provide complaint mechanisms |
| Both offences | One requires intent to harm; the other does not |
In practice
- Report through Hotline.ie for content hosted anywhere: it works with international partners.
Recent changes
Coimisiún na Meán, Ireland's online safety regulator, now has statutory powers over platforms, including individual complaints mechanisms.
Where to go
- An Garda Síochána, local station.
- Hotline.ie for reporting illegal content.
- Coimisiún na Meán.
Worth knowing
The second offence under Coco's Law does not require proof that the person wanted to hurt you: the absence of your consent is enough. That makes it far easier to prosecute. The offence that does not require intent is the one to rely on. Prosecutors need only prove the absence of consent.
The general article: Image rights · Compare with another country
Speech and online harassment
Defamation remains claimant-friendly, though reform is underway, and harmful online communications were criminalised in 2020.
The Defamation Act 2009 governs, with defences of truth, honest opinion and fair and reasonable publication. Reform legislation to abolish juries in High Court defamation actions and to address strategic lawsuits has been progressing. Coco's Law — the Harassment, Harmful Communications and Related Offences Act 2020 — criminalised sharing intimate images without consent.
Key points
| Defamation | Claimant-friendly; the plaintiff need not prove falsity |
|---|---|
| Limitation | One year, extendable to two in limited circumstances |
| Juries | Historically used in the High Court; reform to abolish them has been advancing |
| Coco's Law | Criminalises distributing intimate images without consent, with or without intent to cause harm |
| Harassment | Persistent communication offences, including online |
| Online Safety Code | Coimisiún na Meán regulates video-sharing platforms and can require removals |
| Damages | Historically high, one of the drivers of the reform programme |
| Defamation Act 2009 | Under review, with proposals to abolish juries in defamation cases |
| One-year limitation | Extendable to two years only in limited circumstances |
| Press Ombudsman | Free complaints against member publications |
In practice
- Use the Press Ombudsman for newspaper complaints: it is free and relatively fast.
- Take advice before issuing defamation proceedings; costs exposure in Ireland is high.
Cost and coverage
Defamation proceedings are costly; reporting under Coco's Law is free through the Gardaí.
Recent changes
Coimisiún na Meán, established in 2023, became Ireland's online safety regulator and is the national coordinator under the EU Digital Services Act.
Where to go
- Hotline.ie for reporting illegal content.
- Coimisiún na Meán for platform complaints.
- An Garda Síochána for criminal harassment and image-based abuse.
Worth knowing
Coco's Law covers threats to share images as well as actual sharing — a threat alone is an offence and can be reported immediately. Irish defamation awards have historically been high, which makes both claiming and defending expensive. Reform has been under discussion for years.
The general article: Speech and online harassment · Compare with another country
Copyright
Fair dealing on the British model, with life plus seventy years and a 2019 reform broadening the exceptions.
The Copyright and Related Rights Act 2000 sets a term of life plus seventy years and permits fair dealing for research, private study, criticism, review and news reporting. The Copyright and Other Intellectual Property Law Provisions Act 2019 broadened exceptions for education, libraries and people with disabilities, and raised the jurisdiction of the lower courts for IP claims.
Key points
| Statute | Copyright and Related Rights Act 2000, amended in 2019 |
|---|---|
| Term | Life plus 70 years |
| Fair dealing | Research, private study, criticism, review, news reporting |
| 2019 reform | Wider education and library exceptions; District and Circuit Courts can hear IP claims |
| Moral rights | Paternity and integrity rights |
| Registration | None: protection is automatic on creation |
| Government material | Reusable under public sector information rules |
| Education exceptions | Widened by the 2019 Act |
| Small claims | IP claims can now be heard in the lower courts |
In practice
- Use the District or Circuit Court for low-value infringement claims.
Recent changes
Ireland extended jurisdiction over copyright disputes to the District and Circuit Courts in 2019, a significant practical change for individual authors.
Where to go
- Intellectual Property Office of Ireland.
- Irish Copyright Licensing Agency and IMRO.
- Circuit Court for lower-value claims.
Worth knowing
The 2019 Act made the lower courts available for copyright claims, which brought the cost of enforcement down substantially for small creators. The 2019 reform brought enforcement within reach of individual creators by allowing claims in the lower courts.
The general article: Copyright · Compare with another country
Identity theft
Prosecuted as deception and fraud offences; the Central Credit Register lets you see loans taken out in your name.
The Criminal Justice (Theft and Fraud Offences) Act 2001 covers deception, false accounting and unlawful use of a computer to make a gain. Reports go to An Garda Síochána, with the Garda National Economic Crime Bureau handling serious cases. The Central Credit Register, run by the Central Bank, holds a record of loans of 500 euro or more and can be checked free of charge.
Key points
| Statute | Criminal Justice (Theft and Fraud Offences) Act 2001 |
|---|---|
| Reporting | Local Garda station; the Economic Crime Bureau for large cases |
| Central Credit Register | Free report from the Central Bank, showing loans in your name |
| Bank liability | Unauthorised transactions must be refunded under payment services rules |
| Data breach | Report to the Data Protection Commission where a company lost your data |
| Documents | Report a lost or stolen passport to the Passport Service immediately |
| Financial Services Ombudsman | Free escalation for disputes with banks |
| Passport cancellation | A stolen passport must be reported to prevent misuse |
| Garda Pulse record | Keep the incident number; institutions ask for it |
In practice
- Tell your bank and freeze the affected cards the same day.
- Report to the Gardaí and get the incident number.
- Request your Central Credit Register report and dispute anything unfamiliar.
- Notify the Passport Service and the NDLS if identity documents were taken.
- Escalate to the Financial Services and Pensions Ombudsman if a bank refuses to refund.
Where to go
- An Garda Síochána, local station.
- Central Credit Register, centralcreditregister.ie.
- Data Protection Commission.
Worth knowing
Irish credit reporting is centralised at the Central Bank, so one free request shows you every regulated loan in your name — a simpler check than in most countries. The Central Credit Register report is free and shows every regulated loan in your name. It is the fastest way to discover borrowing you did not authorise.
The general article: Identity theft · Compare with another country
Online shopping
Fourteen days to change your mind, a modernised Consumer Rights Act since 2022, and free help from the CCPC.
The Consumer Rights Act 2022 consolidated and modernised Irish consumer law, implementing EU directives on the sale of goods, digital content and services. It provides a 14-day cooling-off period for distance contracts, a 30-day right to reject faulty goods, and rules for digital products including updates.
Key points
| Cooling-off | 14 days from delivery for most distance purchases |
|---|---|
| Right to reject | 30 days for faulty goods |
| Remedies hierarchy | Repair or replacement, then price reduction or termination |
| Digital content | Quality and update obligations, including for free services paid for with data |
| Burden of proof | Reversed in favour of the consumer for the first year |
| Chargeback | Available through card schemes |
| Cross-border | European Consumer Centre assists with EU sellers |
| Consumer Rights Act 2022 | Consolidated and modernised consumer law, including digital content |
| Thirty-day right | A short-term right to reject faulty goods |
| European Consumer Centre | Handles cross-border disputes free of charge |
In practice
- Use the European Consumer Centre for traders in another member state.
- Put the complaint in writing with a deadline before escalating.
Cost and coverage
CCPC advice and ECC assistance are free.
Recent changes
The 2022 Act extended consumer protection to services paid for with personal data, an important change for app users.
Where to go
- Competition and Consumer Protection Commission helpline.
- European Consumer Centre Ireland for cross-border disputes.
- Small Claims procedure for low-value cases, filed online.
Worth knowing
The Small Claims procedure is cheap, online and designed to be used without a solicitor — the practical route once a seller stops responding. The 2022 Act replaced a patchwork of older statutes. Guidance written before it may describe rights that have since changed.
The general article: Online shopping · Compare with another country
Romance scams
Reporting through the Garda economic crime bureau, and a fraud-specific route through the financial ombudsman.
Reports go to the local Garda station, with economic crime handled by the Garda National Economic Crime Bureau. There is no mandatory reimbursement scheme for authorised payments: recovery depends on how quickly the bank can recall the transfer and on the bank's own assessment. A refusal can be escalated free of charge to the Financial Services and Pensions Ombudsman. The national fraud awareness campaign publishes current scam patterns.
Key points
| Reporting | Local Garda station; economic crime bureau for larger cases |
|---|---|
| Reimbursement | No mandatory scheme; depends on the bank's assessment |
| Recall | Possible in the first hours, rarely afterwards |
| If refused | Financial Services and Pensions Ombudsman, free to use |
| Card payments | Chargeback through the card scheme, with a strict deadline |
| Suspicious texts | Forward free to 50015 |
| Awareness | National fraud awareness campaign, run with the banks |
In practice
- Call the bank before anything else and use the word "recall" explicitly.
- A card payment is far easier to recover than a transfer: always prefer card where you have the choice.
- If the bank refuses, the ombudsman is free and has upheld a meaningful share of fraud complaints.
- Get the Garda incident number: insurers and banks both ask for it.
Cost and coverage
Reporting and the ombudsman are free.
Where to go
- Local Garda station and the national economic crime bureau.
- Your bank's fraud line, immediately.
- Financial Services and Pensions Ombudsman.
- Competition and Consumer Protection Commission, for guidance.
Worth knowing
Ireland has no equivalent of the mandatory reimbursement now in force next door. That makes the first phone call to the bank, within minutes rather than hours, the single most valuable action.
Sources
- An Garda Síochána — report to your local station; economic crime bureau for larger cases
- Financial Services and Pensions Ombudsman — free escalation if the bank refuses
- Competition and Consumer Protection Commission — consumer rights and scam alerts
- Forward scam texts to 50015 — free reporting of smishing
- Central Bank of Ireland — warnings on unauthorised firms — check before any investment suggested online
- National Cyber Security Centre — national alerts and advice
The general article: Romance scams · Compare with another country
General sources
- Citizens Information — official plain-language guide to rights and entitlements
- Irish Statute Book — legislation as enacted