The Irish Data Protection Commission (DPC) does not have any power to order an organization to pay compensation to an affected data subject.
In the case of administrative fines, any funds collected from these fines go to the state exchequer. In addition to the powers the DPC has to enforce data subjects’ rights, individuals are also open to take private civil actions against organizations where his or her rights have been infringed – although the DPC does not have any formal role in this process.
A data protection action can be taken before the courts by an individual or by a not-for-profit body, organization or association on behalf of the individual. Individuals are entitled to both make a complaint to the DPC as well as taking a data protection action against an organization, as the right to take such an action is ‘without prejudice’ to the other rights or remedies available to individuals.
Read the Irish DPC’s full statement.
[View source.]
