Allianz plc

Introduction ....................................................................................................................................... 3 B. Legal Framework for the Inquiry and the Decision ........................................................................... 3 a) Legal Basis for the Inquiry .......................................................................................................... 3 b) Data Controller ........................................................................................................................... 3 c) Legal Basis for the Decision ........................................................................................................ 4 C. Factual Background ............................................................................................................................ 4 D. Scope of the Inquiry ........................................................................................................................... 5 E. Issue for Determination: Compliance with Article 32(1) .................................................................. 6 F. Right of Appeal ................................................................................................................................. 12 3 A. Introduction 1. This document is a decision (the ‘Decision’ or the ‘Final Decision’) made by the Data Protection Commission (‘the Commission’) in accordance with section 111 of the Data Protection Act 2018 (‘the 2018 Act’). I make this Decision having considered the information obtained in the own volition inquiry (‘the Inquiry’) pursuant to section 110 of the 2018 Act. 2. Allianz was provided with the draft decision in this Inquiry on 1 June 2022 (the ‘Draft Decision’) to provide it with a final opportunity to make submissions. This Decision is being provided to Allianz pursuant to Section 116(1)(a) of the 2018 Act in order to give Allianz notice of the Decision and the reasons for it. B. Legal Framework for the Inquiry and the Decision a) Legal Basis for the Inquiry 3. The GDPR is the legal regime covering the processing of personal data in the European Union. As a regulation, the GDPR is directly applicable in EU member states. The GDPR is given further effect in Irish law by the 2018 Act. As stated above, the Inquiry was commenced pursuant to section 110 of the 2018 Act.