Every Irish Cloud Has A GDPR Lining
Reform of the Office of the Data Protection Commissioner: As a result of Ireland's importance in the cloud, technology and data sectors the Office of the Data Protection Commissioner will be restructured as the Data Protection Commission (the "Commission") which can be headed up by up to three Commissioners for Data Protection, each of whom may be appointed for terms of between four and five years. The Minister for Justice will appoint one of the Commissioners to be the chairperson, who shall have the casting vote as regards decisions to be taken by the Commission in the event of a tied vote.
The Commission has been granted a wide range of new or enhanced powers, including:
- The ability, for the first time, to issue fines (more below);
- Greater investigative powers, such as allowing Commission officers to apply for and execute search warrants; and
- The power to apply to the High Court to suspend or restrict data processing where there is an urgent need to protect the rights of the data subjects.
Age of Digital Consent: The age of 'digital consent' has been set at 13. This is the youngest age allowed under the GDPR and was also the age that was heavily lobbied for by both marketing groups and numerous child protection agencies who viewed access to the internet as a vital resource for young people. It is also expected that a Commissioner for Digital Safety will be appointed to ensure online security particularly for children.
Representation of Data Subjects: Although child protection agencies' input was taken into account in relation to the age of 'digital consent', it is not yet clear if the Bill fully implements Article 80.2 of the GDPR. That Article enables Member States to provide in legislation that not-for-profit bodies, such as child protection agencies, may lodge complaints with supervisory authorities and pursue judicial remedies independently of the mandate of a data subject.
The Bill does allow not-for-profit bodies to bring data protection actions on behalf of data subjects, however it remains to be seen if these bodies will be able to take class actions on behalf of multiple data subjects for breaches of the GDPR, as such actions are not currently permitted under Irish law.
Exemption for Public Authorities and Public Bodies: The Bill grants an exemption to public authorities and public bodies from fines, unless they are acting as "an undertaking" within the meaning of the Competition Act 2002 - "a person being an individual, a body corporate or an unincorporated body of persons engaged for gain in the production, supply or distribution of goods or the provision of a service."
Offences Attributable to Company Officers: Where an offence is committed "with the consent or connivance of, or to be attributable to any neglect on the part of, a person being a director, manager, secretary or other officer of the body corporate or a person who was purporting to act in any such capacity, that person, as well as the body corporate, shall be guilty of that offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first-mentioned offence".
This creates wide scope for liability for directors or company officers who may be found criminally liable even if they have no actual knowledge of an offence under the GDPR but should have and failed to do something that was expected of them.
Circuit Court to Confirm Fines: All decisions by the Commission to issue administrative fines will be referred to the Circuit Court for confirmation. If a controller or processor does not appeal a decision of the Commission, then the Commission will apply to the Circuit Court for confirmation of the administrative fine. The Circuit Court must confirm the fine unless there is "good reason not to do so".
This judicial oversight addresses any constitutional concerns of due process, natural justice and separation of powers which may have arisen by granting the Commission the power to investigate, adjudicate and impose the abovementioned fines.
Conclusion
The Bill is still subject to change as it progresses through the Irish houses of Parliament before becoming enacted as law. However given that the Bill must be enacted in time for both the 6 May 2018 deadline for the Law Enforcement Directive as well as the coming into force of the GDPR on 25 May 2018, the scope for major alteration is limited.
Article provided by: Leo Moore, Partner, William Fry. Follow us on Twitter: @WFIDEA, @WilliamFryLaw
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org