BGBlur: Secretly recorded in Ireland - your rights under the GDPR and the Data Protection Act 2018, emergency measures, preservation of evidence and data protection
Is secret recording illegal in Ireland? Know your rights under GDPR, the Data Protection Act 2018 and Irish law – and find out exactly what steps you should take if it happened to you.
It depends – and that surprises most people. Ireland's approach to secret recording is more nuanced than a simple yes or no, and it is this complexity that perpetrators exploit. Someone is filming you without your knowledge, recording a private conversation, or posting intimate footage of you online - and you're not sure if you even have a case. You have this. This guide explains the applicable laws – clearly and understandably.
PH0
Is secret recording illegal in Ireland?
Irish citizens have a right to privacy under both the Constitution and the European Convention on Human Rights. This right is not unlimited – courts weigh it against competing interests – but it is the foundation on which everything else is built. If someone secretly recorded you in your home, bedroom, or other place where you had a reasonable expectation of privacy, your constitutional right to privacy has almost certainly been violated—regardless of whether a specific criminal law was broken.
The applicable laws
GDPR & the Data Protection Act 2018 - Ireland's core data protection law
The Irish Data Protection Act 2018 came into force on 25 May 2018 to give further effect to the GDPR in Ireland, establish a new Data Protection Commission and provide a comprehensive framework for the handling of personal data.
Under the GDPR, any video recording, photo or audio recording that identifies you is considered your personal data. Anyone recording you, storing the material, sharing it or using it without a legal basis is violating the GDPR. Serious violations can result in fines of up to 20 million euros or 4% of an organization's annual global turnover, whichever is greater.
The responsible authority is the Data Protection Commission (DPC). The DPC is the national independent authority that safeguards the fundamental right of individuals in the EU to protect their personal data and acts as the Irish supervisory authority for the GDPR. You can lodge a complaint directly with the DPC online. The DPC can order the deletion of your recordings, initiate investigations and impose sanctions - all without you having to go through a full criminal procedure first.
The Interception of Postal Packets and Telecommunications (Regulation) Act 1993)
Under this law, recording a telephone conversation between other people without their permission is a serious criminal offense. The principle of unilateral consent applies to secretly recorded telephone conversations - as long as one party to the conversation consents, recording is permitted under the 1993 law. However, the 1993 law does not apply to Internet conversations via FaceTime or WhatsApp, or to covert recordings of face-to-face meetings and private conversations. If someone has recorded your WhatsApp calls or personal conversations without being a participant in the conversation, this falls completely outside the scope of the 1993 Act - and falls squarely within the scope of the GDPR.
The Non-Fatal Offenses Against the Person Act 1997, Section 10 (Harassment) Under Section 10, persistently recording another person may constitute harassment if it disturbs their peace and privacy. Penalties include up to 7 years' imprisonment on conviction on indictment and a fine of up to 1,500 euros and/or up to 12 months' imprisonment on summary conviction. If someone has repeatedly filmed you, followed you with a camera, or recorded you on multiple occasions, this is the criminal route that can result in a prison sentence.
The ePrivacy Regulation 2011
The European Community Electronic Communications Networks and Services (Privacy and Electronic Communications) Regulations 2011 lay down specific rules for electronic communications and require that the confidentiality of such communications must be maintained. If someone has intercepted your messages, monitored your network activity, or accessed your device communications without permission, these regulations apply in addition to the GDPR.
Why these laws are important
Most people who are secretly recorded freeze, feel ashamed, or assume that nothing can be done. That's exactly the wrong reaction - and it's a reaction that matters to the person who took you in.
Irish law does not specifically prohibit photographing or recording people in all contexts, but if someone persistently observes or records you, it may constitute the offense of harassment. More importantly, GDPR means that even a single covert recording of you – if stored, shared or used – triggers data protection liability. The person who filmed you is holding your personal information without your consent. This is their legal problem - not yours, which you have to accept in silence.
According to Article 82 of the GDPR, any person who has suffered material or non-material damage as a result of a breach has the right to compensation from the responsible controller or processor. Section 117 of the Data Protection Act 2018 allows individuals to bring a data protection claim in court. Stress, sleep loss, anxiety and emotional damage are all included. You don't need physical or financial damage to file a claim.
How to act
First, back up everything. Take screenshots of messages, note dates and times, save any evidence of where the material appeared. Do not confront the person until you have documented the situation.
Then proceed in three ways at the same time. Make a complaint to the DPC at dataprotection.ie - the online form is easy and free. You can lodge a complaint using the form on the DPC website and the DPC is obliged to provide you with an update or outcome within three months. If the material appeared on a platform such as Instagram, TikTok, WhatsApp or Snapchat, report it directly to the platform and request immediate removal - platforms operating in the EU are also bound by the GDPR.
For criminal matters relating to harassment or wiretapping, report it to An Garda Síochána. For civil damages claims, a lawyer can advise you on a data protection lawsuit in court. Free legal advice is available through FLAC (Free Legal Advice Centres) at flac.ie or by calling 1890 350 250.
Frequently asked questions
Is it illegal to secretly film someone in a bathroom or bedroom in Ireland? Yes, this would violate the constitutional right to privacy and is almost certainly a breach of the GDPR as the material is personal data collected without consent and without a legal basis. If repeated, it could also constitute harassment.
What exactly does the GDPR cover in this context?
Any recording, photo or video that identifies you is your personal information. Anyone who collects, stores, shares or uses this material without a legal basis is violating the GDPR. You have the right to request deletion, to find out what data exists about you and to lodge a complaint with the DPC.
What if someone posted my private video online?
Immediately report it to the platform for removal. File a complaint with the DPC in accordance with the GDPR. If the content is intimate in nature, you should also report it to An Garda Síochána as sharing intimate images without consent is considered serious under Irish law.
Can I receive compensation?
Yes. You can bring a civil privacy claim under Section 117 of the Data Protection Act 2018 for both material and non-material damages, including stress and emotional distress. This runs parallel to a DPC complaint or a criminal complaint.
Is there free legal help?
Yes. FLAC offers free legal aid clinics nationwide. You can also contact your local Citizens Information Center at citizensinformation.ie or call 0818 07 4000.
Can I report online without going to the Garda station?
You can lodge a complaint with the DPC entirely online at dataprotection.ie. For platform reports, use the reporting functions integrated in each app. Criminal matters usually require a visit to a Garda station to make a formal report.
Irish law gives you real tools. The GDPR is one of the strongest data protection frameworks in the world and Ireland's DPC is one of the most active enforcement authorities in Europe. The person who took you in has a legal problem. Take advantage of that.