The Data Protection (Amendment) Act, 2003, puts the following obligations on business:

• Data protection laws now apply to manual and computer files;

• Transfers of personal information outside European Economic Area (the EU and neighbouring states) will be banned, even if the transfer is to a related company, unless certain safeguards are met;

• Consent will be required in almost all cases before a business can process personal data;

• Individuals will have the right to prevent businesses from using their information for a specific purpose;

• A business will have to provide explicit information to customers, employees, or anyone else whose personal information they hold or process, on the nature of their business and the ways in which they will store, use or disclose the data;

• The Data Protection Commissioner, Mr Joe Meade, will have the power to carry out dawn raids and privacy audits on businesses to ensure compliance;

• Businesses will have to take all reasonable measures to protect the personal data under their control; and

• Businesses will be banned from making automated decisions, that is only using computers, about certain individuals.