Archbishop of Dublin

Introduction .................................................................................................................................... 3 B. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i) Legal Basis for the Inquiry ........................................................................................................... 3 ii) Data Controller ............................................................................................................................ 4 iii) Legal Basis for the Decision ......................................................................................................... 4 C. Factual Background ......................................................................................................................... 5 D. Scope of the Inquiry and the Application of the GDPR ................................................................... 6 E. Issues for Determination................................................................................................................. 7 F. Analysis of the Issues for Determination ...................................................................................... 12 a) MATERIAL SCOPE ...................................................................................................................... 12 b) CONTROLLERSHIP ...................................................................................................................... 44 c) LEGAL BASIS ............................................................................................................................ 102 d) RIGHT OF RECTIFICATION ....................................................................................................... 141 e) RIGHT OF ERASURE ................................................................................................................. 154 f) STORAGE LIMITATION ............................................................................................................. 171 g) SUMMARY OF FINDINGS ......................................................................................................... 176 G. Finding Regarding Article 5(2) ..................................................................................................... 179 H. Decision on Corrective Powers ................................................................................................... 179 I. Order to amend the Privacy Policy ............................................................................................. 180 J. Right of appeal ............................................................................................................................ 180 Appendix 1: LIST OF ABBREVIATIONS/ RELEVANT TERMS .................................................................. 181 3 A. Introduction 1. This document (‘the Decision’) is a decision made by the Data Protection Commission (‘the DPC’) in accordance with section 111 of the Data Protection Act 2018 (‘the 2018 Act’). I make this Decision having considered the information obtained in the own volition inquiry IN-19-7-6 (‘the Inquiry’) pursuant to section 110 of the 2018 Act. 2. The Archbishop of Dublin (‘the Archbishop’) was provided with a Draft Decision (‘the Draft Decision’) on this inquiry on 4 November 2022 to give him a final opportunity to make any submissions.