Information Management, Data Protection and Use of Technology
This domain tests whether you can use Garda systems lawfully and explain data protection in a policing context. The GDPR, the Data Protection Act 2018 and the Law Enforcement Directive (Part 5 of the 2018 Act) are central. The Garda Síochána (Recording Devices) Act 2023 provides for body-worn cameras, CCTV and ANPR.
Core rules
- Data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
- Access to PULSE and other systems must be for a policing purpose and authorised; curiosity is not a purpose.
- Special category data, including health, ethnicity, religion, sexual orientation and biometric data, requires particular care.
- Subject access rights exist, but law enforcement exemptions can apply.
- Data breaches must be reported promptly and investigated.
Worked example
A Garda looks up a celebrity's address on PULSE after seeing a news story. There is no policing purpose. The access is unauthorised, leaves an audit trail and may breach the Data Protection Act 2018. The correct response is to report it to a supervisor and the data protection unit, preserve the audit record, and consider discipline or criminal referral. The fact that no harm was intended does not make the access lawful.
Traps
Do not assume GDPR does not apply to Gardaí; Part 5 applies specifically to law enforcement processing. Do not use work systems for personal reasons. Do not share operational information on personal phones or social media. Do not ignore retention and disclosure rules.