The General Data Protection Regulation (GDPR) restricts how personal data may be processed by a data controller. In particular, personal data may not be used for a purpose incompatible with the purpose for which the data was initially collected.
One exception to this is Section 41(b) of the Data Protection Act 2018. This allows a data controller operating in Ireland to disclose personal data to a third party to the extent that this is “necessary and proportionate for the purposes of preventing, detecting, investigating or prosecuting criminal offences.“
Typically, this arises following a request from An Garda Síochána or another law enforcement body for disclosure of information containing personal data. Such requests are common in sectors such as financial services and insurance, although it is up to each company to handle such requests in a compliant manner.
However, data controllers in other sectors might be alarmed to receive a request from the Gardaí seeking disclosure of information under Section 41(b). This might be for various information relating to named individuals or for a copy of CCTV footage. The request might be marked urgent, refer to serious criminal allegations, or be broad or exploratory in nature. You might feel under pressure to comply with the request.
The most important thing to know is that you are under no obligation to comply with a request if it is made under Section 41(b) of the Data Protection Act 2018. However, the catch is that if you choose to comply with such a request in full or in part, you bear the risk as the data controller. This means being satisfied that disclosing the personal data is necessary and proportionate for the purpose of preventing, detecting, investigating or prosecuting criminal offences. This places a high burden on you as the data controller, including keeping appropriate records to justify your decision and to demonstrate accountability under GDPR. You also have other obligations, including transparency to data subjects, data minimisation, facilitating data subject rights, and ensuring appropriate data security.
If information concerning particular individuals or video footage is that important for a criminal investigation, the Gardaí can (and often will) get a District Court order or even a search warrant. And if this is served on you, there will be a legal obligation to provide the information, and you will have protection as a result. Depending on the circumstances, this may be preferable to complying voluntarily with a request made under Section 41(b) and taking on the risk and potential liability of getting it wrong.
And if you choose not to comply with a disclosure request that is made under Section 41(b), which you are entitled to do in the absence of any other legal or statutory obligation, bear in mind that the communication received will likely contain sensitive or confidential information which should not be retained unless there is a specific reason to do so.