1. => Update on General Data Protection Regulation and Law Enforcement Directive
Seamus Carroll
Civil Law Reform Division
Department of Justice and Reform

2. Timelines
Political deal on data protection reform package in mid-December
Publication of GDPR in May 2016; applies from May 2018 to both public and private sectors; contains some specific rules and limitations for the public sector
Separate Directive dealing with law enforcement requires transposition into national law by May 2018
Data Protection Bill which will give ‘further effect’ to GDPR and transpose the Directive approved by Government for drafting; it will also equip the data Protection Commissioner with procedural and due process safeguards
Publication in Autumn 2017; enactment in Spring 2018

3. Objective of Regulation (GDPR)
“Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those [in the public and private sectors] who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States”
(Recital 11).

4. Need for higher data protection standards?
The Lisbon Treaty introduced a new legal basis for higher data protection standards in the EU (Article 16); the right to data protection is also in the Charter of Fundamental Rights (Article 8)
The data protection standards set out in the 1995 Data Protection Directive – on which current data protection law is based – need to be updated to take account of technological advances (Internet; social networking; Big Data) and new business models (cloud computing), i.e. the digital economy
Rapidly developing case law of EU Court of Justice on data protection
Need for more consistent application of data protection law in the single digital market pointed towards a Regulation to replace the Directive; increased activity in law enforcement area pointed towards a new Directive

5. Digital economy – v – human rights
Technological advances and innovative business models in the digital economy present opportunities for innovation, job creation and economic growth both in Member States and across the Union
Data protection is about the rights and freedoms of individuals: their rights to control the uses to which their personal data are put and their freedom not to be subjected to unnecessary monitoring or observation
Data protection rights and safeguards must keep pace with the emerging technologies and new business models; otherwise there will be insufficient consumer trust and confidence in the digital economy to ensure that its jobs and growth potential is fully realised

6. Benefits for customers and clients
More onerous obligations on data controllers to provide information to data subjects in a transparent and speedy manner, and without charge
Strengthened rights of data subjects:
- to obtain information about the processing of their personal data, whether collected directly or obtained from another source
- to obtain copies of personal data undergoing processing
- to rectification of incorrect or incomplete data
- to erasure (“right to be forgotten”) and to restriction of processing
- to data portability (new)
- to object to processing
- limitation on automated decision-making, including profiling

7. What’s new for data controllers?
More emphasis on transparency
Personal data must be processed lawfully, fairly and in a transparent manner: Article 5.1(a)
Provide information “in an intelligible and accessible form, using clear and plain language”: Article 12
More emphasis on accountability
The controller shall be responsible for and be able to demonstrate compliance with the Regulation: Article 5.2
More emphasis on security
Personal data must be processed in a way that ensures appropriate security of the personal data: Article 5
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk: Article 32

8. Risk-based approach to controller obligations
The controller shall implement appropriate technical and organisational measures to ensure and be able to demonstrate that the processing of personal data is in compliance with the Regulation, taking into account:
the nature, scope, context and purposes of the processing, and
the risks of varying likelihood and severity for the rights and freedoms of individuals
(Articles 24 and 32 of Regulation)

9. Mitigation of risk
Data protection impact assessments (Articles 35 of Regulation)
Mandatory prior consultation of DPA in cases of identified risks and intended legislation (Articles 36 of Regulation)
Designation of data protection officer; mandatory for certain data controllers, including public authorities and bodies (Articles 37 of Regulation)
Codes of conduct (Articles 40 and 41 of Regulation)
Certification mechanisms and data protection seals and marks (Articles 43 and 44 of Regulation)

10. Mandatory reporting of data breaches
Mandatory reporting of personal data breaches to DPA unless a breach is unlikely to result in a risk for rights and freedoms of individuals:
without undue delay and, where feasible, not later than 72 hours after becoming aware of it
report must identify the likely consequences of the breach and the measures taken, or to be taken, to mitigate possible adverse effects for individuals
facts surrounding the breach, its effects and remedial action taken must be documented to verify compliance
DPA may require notification of individuals where a breach is likely to result in high risk for their rights and freedoms

11. Liability and right to compensation
A person who has suffered material or non-material damage as a result of an infringement shall have the right to receive compensation from the controller
Any controller involved in the processing shall be liable for the damage caused by the processing which is not in compliance with the Regulation; a processor shall be liable for damage only where it has not complied with obligations specifically directed to processors or acted outside the lawful instructions of the controller
A controller shall be exempted from liability if it proves that it is not in any way responsible for the event
Where more than one controller or processor or a controller and a processor are involved in the same processing and, where they are responsible for any damage caused by the processing, each controller or processor shall be held liable for the entire damage, in order to ensure effective compensation of the data subject; a controller shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage

12. Contract between controller and processor
Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a way that the processing will meet the requirements of the Regulation and ensure the protection of the rights of the data subject
The processor shall not enlist another processor without the prior specific or general written consent of the controller. In the latter case, the processor should always inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the opportunity to the controller to object to such changes
Applies in simple cases (shredding company; off-site storage) and complex cases (provider of cloud services)

13. Administrative fines
Each DPA shall ensure that the imposition of administrative fines in respect of infringements of this Regulation shall in each individual case be effective, proportionate and dissuasive
Infringements shall be subject to administrative fines up to €10,000,000 or €20,000,000 (or, in case of an undertaking, up to 2% or 4% of the total worldwide annual turnover of the preceding financial year)
Member States may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies
The exercise by DPAs of the power to impose fines shall be subject to appropriate procedural safeguards in conformity with Union and national law, including effective judicial remedy and due process

14. Specific provisions for the public sector
Lawful processing
consent not a reliable ground (“… where the controller is a public authority … it is unlikely that consent was freely given …”) (recital 43)
legitimate interest ground shall not apply to processing carried out by public authorities (Article 6.1)
Restrictions on processing of special categories of personal data (sensitive personal data, including data concerning health)
processing permitted in certain cases subject to specific measures to safeguard the rights and interests of data subjects
specific provisions in relation to the health sector (Article 9.1(h)) and public health (Article 9.1(i))
Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health (Article 9.4)

15. Further provisions
Restrictions on the exercise of data subject rights permitted to safeguard important objectives of general public interest, subject to conditions (Article 23)
Must be in the form of a legislative measure
Essence of the fundamental rights and freedoms must be respected
Must be a necessary and proportionate measure in a democratic society
Mandatory designation of data protection officer by public authorities and bodies
A single data protection officer may be designated for several public authorities or bodies, taking account of their organisational structure and size
Designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice
Shall directly report to the highest management level

16. Application of both GDPR and Directive by some agencies
GDPR will generally apply to payroll, HR, licensing activity, regulatory oversight etc.
New Data Protection Act (Part 4) will apply to processing of personal data by a ‘competent authority’ for the purposes of prevention, investigation, detection and prosecution of criminal penalties
Definition of ‘competent authority’
Some examples:
Private Security Authority: section 48 offences
Property Services Regulatory Authority: section 94 offences
Agencies need to identify whether they act as a ‘competent authority’ and in respect of what activity

17. Big Data and Data Protection
Ensuring personal data protection becomes more challenging as information is multiplied and shared ever more widely around the world. Information regarding individual’s health, location, electricity use, online activity and so forth can be publicised, raising concerns about profiling, discrimination, exclusion and loss of control.
Big Data analytics does not always involve personal data. But, when it does, it should comply with the rules and principles of data protection: the EU’s Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet. Big Data is no different.
data_factsheet_web_en.pdf

18. Archiving; statistics; research
Purpose limitation: “further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89.1, not be considered incompatible with the initial purposes” (Article 5.1(b))
Storage limitation: “personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89.1 subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of data subjects” (Article 5.1(e))
Obligation in Article 14 to provide information to individuals where personal data have not been obtained directly from them does not apply where provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1)

19. Appropriate safeguards for archiving, scientific or historical research purposes or statistical purposes
Article 89
Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject.
Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner.
Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

20. Next steps
Department of Justice and Equality has prepared draft Bill to give further effect to Regulation, transpose the law enforcement Directive and confer powers of Data Protection Commissioner
All Departments vetting existing legislation in order to identify necessary amendments; should also commence preparation of regulations, e.g. restrictions on data subject rights under Article 23
Oversight by Interdepartmental Committee on Data Issues (chaired by Minister of State Murphy); will now meet on a monthly basis
Agencies should ensure that compliance in included in their strategic and business plans, and non-compliance in their risk registers