Personal Injuries Assessment Board

Introduction .................................................................................................................................... 3 2. Legal Framework for the Inquiry and the Decision ......................................................................... 3 i. Legal Basis for the Inquiry ........................................................................................................... 3 ii. Legal Basis for the Decision ......................................................................................................... 4 3. Findings ........................................................................................................................................... 4 4. Right of Appeal ................................................................................................................................ 5 1. Introduction 2.1 This document (“the Decision”) is a Decision of the Data Protection Commission (“the DPC”) in accordance with Section 111 of the Data Protection Act (“the 2018 Act”). I make this Decision having considered the information obtained in the own volition inquiry (“the Inquiry”) conducted by a Case Officer of the DPC (“the Case Officer”) pursuant to Section 110 of the 2018 Act. The Case Officer who conducted the Inquiry provided the Personal Injuries Assessment Board (“PIAB”) with the Draft Inquiry Report and the Final Inquiry Report. The Decision is being provided to PIAB pursuant to Section 116(1)(a) of the 2018 Act in order to give PIAB notice of the Decision and the reasons for it. 2.2 PIAB was provided with the Draft Decision on this inquiry on 30 November 2021 to give PIAB a final opportunity to make submissions. PIAB acknowledged receipt of the Draft Decision on 14 December 2021 and made no submissions in this regard. 2. Legal Framework for the Inquiry and the Decision i. Legal Basis for the Inquiry 2.1 The GDPR is the legal regime covering the processing of personal data in the European Union. As a regulation, the GDPR is directly applicable in EU member states. The 2018 Act gives the GDPR further effect in Irish law.