Ark Life Assurance Company dac

Introduction ....................................................................................................................................... 3 B. Legal Framework for the Inquiry and the Decision ........................................................................... 3 a) Legal Basis for the Inquiry .......................................................................................................... 3 b) Data Controller ........................................................................................................................... 3 c) Legal Basis for the Decision ........................................................................................................ 3 C. Provisional Factual Background ......................................................................................................... 4 D. Scope of the Inquiry ........................................................................................................................... 5 E. Issue for Determination: Compliance with Article 32(1) .................................................................. 6 F. Right of Appeal ................................................................................................................................. 10 3 A. Introduction 1. This document is a decision (the 'Decision' or the 'Final Decision') made by the Data Protection Commission ('the Commission') in accordance with section 111 of the Data Protection Act 2018 ('the 2018 Act'). I make this Decision having considered the information obtained in the own volition inquiry ('the Inquiry') pursuant to section 110 of the 2018 Act. 2. Ark Life was provided with the draft decision in this Inquiry on 18 August 2022 (the 'Draft Decision') to provide it with a final opportunity to make submissions. This Decision is being provided to Ark Life pursuant to Section 116(1)(a) of the 2018 Act in order to give Ark Life notice of the Decision and the reasons for it. B. Legal Framework for the Inquiry and the Decision a) Legal Basis for the Inquiry 3. The GDPR is the legal regime covering the processing of personal data in the European Union. As a regulation, the GDPR is directly applicable in EU member states. The GDPR is given further effect in Irish law by the 2018 Act. As stated above, the Inquiry was commenced pursuant to section 110 of the 2018 Act.