Photo of Davinia Brennan

At its plenary meeting this month, the WP29 adopted the final version of its Data Protection Impact Assessment (DPIA) guidelines.

It also adopted draft guidelines on data breach notification and profiling, and administrative fines, which will be open for public consultation for 6 weeks before their final adoption. The guidelines are expected to be published shortly on the European Commission’s WP29 webpage.

Each WP29 subgroup provided a state of play of its work on the WP29’s priorities on the GDPR, including guidelines on consent, transparency, and update of data transfer tools which are to be adopted between November 2017 and February 2018.

On certification, the discussions are continuing and the guidelines should be proposed for adoption at the February 2018 WP29 plenary.

The WP29 also worked on the organization and structure of the EDPB and of the cooperation system to be ready for May 2018.

Photo of Davinia Brennan

The Government has published its legislation programme for Autumn 2017.  The programme lists priority legislation, legislation due to undergo pre-legislative scrutiny, and all other legislation it is working on. Listed below are the data protection, cyber-security and IP-related Bills coming down the track.

Priority legislation

  • Data Protection Bill – This Bill will give effect to and provide for derogations from the GDPR, and transpose the Law Enforcement Directive (2016/680). The Heads of Bill were published in May 2017, and pre-legislative scrutiny was completed on July 2017.  The legislation programme lists the Bill as “priority legislation for publication” this Autumn, but there is no indication as to when exactly the Bill is expected to be finalised and start its passage through the Oireachtas. See our blog post on the Heads of Bill here.

Continue Reading Data Protection, Cyber-Security & IP legislation coming down the track

Photo of John Cahir

In a much anticipated judgment, the Irish High Court yesterday decided to ask the Court of Justice of the European Union (CJEU) to rule on the validity of Standard Contractual Clauses (SCCs).

What is at stake?

SCCs, also known as “Model Contracts”, are contractual terms approved by the European Commission for validating transfers of personal data to countries outside the EEA region. SCCs are perhaps the most widely used legal instrument supporting EU-US data transfers. For many businesses, they are the only available means of lawfully transferring data to the US or other third countries.

If the SCCs are held to be invalid by the CJEU, many businesses operating from Europe will find themselves unable to lawfully transfer personal data to the US. This will in turn pose severe logistical and economic challenges to EU-US trade.

The legal challenge to the SCCs touches on the politically sensitive areas of data privacy and state surveillance. Therefore, a ruling that invalidates the SCCs will also present a fresh challenge for the EU and US authorities to negotiate a long lasting solution to transatlantic data transfers.

Pending the CJEU’s ruling, businesses can continue to rely on the SCCs.

How did the case come about?

Back in 2013, Mr Schrems complained to the Irish Data Protection Commissioner (DPC) about the transfer of his personal data by Facebook in Ireland to its parent company in the US under the EU-US Safe Harbour mechanism.

That complaint resulted in the invalidation of the EU-US Safe Harbour mechanism by the CJEU (Schrems I). Following the CJEU decision, Facebook placed reliance on the SCCs for making legal transfers of data between Ireland and the US, and Mr Schrems decided to reformulate his complaint against Facebook.

In the course of carrying out the new investigation, the DPC determined that she had “well-founded” objections in relation to the validity of the SCCs. In particular, she was concerned that there was an absence of effective legal remedies for EU citizens whose data are transferred to the US, and she believed that the SCCs do not answer these concerns. Only the CJEU can decide on the validity of European Commission decisions such as the SCCs. Therefore, the DPC applied to the Irish High Court so that questions regarding the validity of the SCCs could be brought before the CJEU.

What did the Irish High Court say?

Ms Justice Costello delivered a wide-ranging 152 page judgement. Of particular note are the following:

Court’s Jurisdiction

  • The Court rejected the argument advanced by Facebook that the case is concerned with processing of data for “national security” purposes and that consequently it falls outside the scope of EU law by virtue of Article 4(2) of the Treaty on the European Union, which reserves competence over national security issues to Member States.
  • In particular, the Court held that this submission was inconsistent with the ruling of the High Court and the CJEU in Schrems I, where the court proceeded on the basis that it had jurisdiction to rule on the reference.
  • The Court also rejected the argument that that the EU-US Privacy Shield precludes the making of a reference to the CJEU.  The Court held that the Privacy Shield is a decision that is confined to data transferred to US organisations that have self-certified as complying with the Privacy Shield principles, and that it is not an unconditional adequacy decision.


  • The Court agreed with the DPC that the SCCs alone cannot ensure an adequate level of protection in third countries for data protection rights. Even when data has been transferred to a third country under the SCCs, “the data is still entitled to a high level of protection” and “DPAs have an obligation to ensure that the data still receives a high level of protection and they are expressly granted powers to suspend or prohibit data transfers” (paragraph 153).
  • The terms of the SCCs do not themselves provide an answer to the concerns raised by the DPC and the Court focussed on the question of whether Article 4 of the SCCs and Article 28 of the Data Protection Directive (the Directive) alleviated those concerns – these provisions enable a national data protection authority to ban or suspend data transfers to third countries.
  • The Court ruled that a referral to the CJEU is necessary to determine whether the existence of the discretionary power conferred on the DPC by Article 4 of the SCCs and Article 28(3) of the Directive to suspend or ban data transfers to a non-EEA country, on the basis of the legal regime in that country, is sufficient to secure the validity of the SCCs.

Article 47/52 of the Charter

  • The Court held that the DPC had raised well-founded concerns that there is an absence of an effective remedy in US law compatible with the requirements of Article 47 of the Charter of Fundamental Rights, for an EU citizen whose data are transferred to the US.
  • The Court agreed with the DPC that there are well-founded concerns that the limitations on the Article 47 right, faced by EU data subjects in the US, are not proportionate or strictly necessary within the meaning of Article 52(1) of the Charter.


  • The Court noted the undesirability of having data transfers banned in one Member State under the SCCs on the basis of the inadequate laws of the third country, but without that ban impacting on transfers made to the same third country from other EU member states.  The Court indicated that only a decision of the CJEU can resolve the potential for inconsistent applications of the Directive in this regard.

Privacy Shield Ombudsperson

  • The Court agreed with the DPC that there are well-founded concerns that the Privacy Shield Ombudsperson redress mechanism, which is available to data subjects whose data are transferred under SCCs (as well as the EU-US Privacy Shield), does not respect the essence of EU citizens’ rights under Article 47 of the Charter.
  • The Court held that a decision of the CJEU is necessary to determine whether the mechanism amounts to a remedy satisfying the requirements of Article 47.

What next?

The Court has not yet framed the questions to be sent to the CJEU.  The parties to the proceedings will be afforded an opportunity to make written submissions on the form of such questions to be referred to the CJEU, and the Court will then determine the exact questions to refer.

Once the reference is made, it will be for the CJEU to fix a hearing date. It usually takes an average of 1.5 years before the CJEU rules on a reference, although the CJEU may decide to prioritise the hearing of this case given its importance.

For further information, please contact John WhelanJohn CahirMark Rasdale or Claire Morrissey.

Photo of Davinia Brennan

The UK Information Commissioner’s Office (ICO) is consulting on draft GDPR guidance on contracts and liabilities between controllers and processors. The guidance seeks to help organisations understand what must be included in contracts under the GDPR, and the new responsibilities and liabilities of processors.

Continue Reading ICO opens consultation on draft guidance on controller/processor contracts and liabilities

Photo of Davinia Brennan

The Data Protection Commissioner (DPC) has called for submissions on issues of Transparency and International Data Transfers under the GDPR. The submissions received by the DPC from its consultation will be shared with the Article 29 Working Party (WP29), at its third Fablab in Brussels on 18 October 2017 to inform the preparation of new guidelines on transparency under the GDPR and the updating of existing guidelines on international data transfers.

Continue Reading DPC consultation on international transfers & transparency under the GDPR

Photo of Davinia Brennan

The EU Council has proposed amendments to the draft ePrivacy Regulation (the Regulation). The Presidency points out that work on the text will be incremental and this is only its first redraft.

Proposed amendments include:

Scope – The Presidency clarifies the precise material and territorial scope of the Regulation, as including:

  • the processing of electronic communications content in transmission, and of electronic communications metadata carried out in connection with the provision of electronic communications services to end-users in the EU;
  • information related to, processed by, or stored in the terminal equipment of end users located in the EU;
  • the placing on the market of software permitting electronic communications, including the retrieval and presentation of information on the internet;
  • the offering of a publicly available directory of end-users of electronic communications services located in the EU, and
  • the sending or presenting of direct marketing communications to end users located in the EU.

Continue Reading EU Council proposes revisions to the draft ePrivacy Regulation

Photo of Davinia Brennan

The U.S. Federal Trade Commission (FTC) announced on 8 September that three U.S. companies have agreed to settle FTC charges that they misled consumers, by falsely claiming they were certified to participate in the Privacy Shield. In separate complaints, the FTC alleges, all three companies failed to complete the certification process for the Shield.  As part of their settlements with the FTC, the three companies are prohibited from misrepresenting the extent to which they participate in any privacy or data security program sponsored by the government or any self-regulatory or standard-setting organization, and must comply with FTC reporting requirements. The actions against the three companies are the first cases the FTC has brought to enforce the Shield, which was adopted last July 2016.

Continue Reading Three U.S. companies charged for falsely claiming compliance with Privacy Shield

Photo of Davinia Brennan

Employee monitoring versus privacy rights is back in the spotlight due to today’s decision by the Grand Chamber of the European Court of Human Rights (ECHR) in Bărbulescu v. Romania.  The Grand Chamber held there had been a violation of Article 8 of the European Convention on Human Rights, where an employer monitored and accessed personal emails sent by an employee during work hours from his Yahoo Messenger account, using a company computer, without notifying the employee in advance of such monitoring.

Continue Reading ECHR rules employees must receive prior notice of email monitoring

Photo of Neasa Ni Ghrada

The General Data Protection Regulation (GDPR) will automatically come into force across the EU on 25 May 2018. As the deadline fast approaches, Member States are busy progressing their draft implementing legislation. Article 23 of the GDPR provides Member States with discretion over how certain provisions will apply. These proposed derogations to the GDPR have been a focus point for many commentators on the draft national legislation.

Article 23

Under Article 23, Member States can introduce exemptions from the GDPR’s transparency obligations and individual rights, but only where the measure respects the essence of the individual’s fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society. The measure must safeguard one of the following:

  • national security;
  • defence;
  • public security;
  • the prevention, investigation, detection or prosecution of criminal offences, the execution of criminal penalties or breaches of ethics in regulated professions;
  • other important public interests, in particular economic or financial interests (e.g. budgetary and taxation matters, public health and security);
  • the protection of judicial independence and proceedings;
  • monitoring, inspection or regulatory functions connected to the exercise of official authority regarding security, defence, other important public interests or crime/ethics prevention;
  • the protection of the individual, or the rights and freedoms of others; or
  • the enforcement of civil law matters.

Chapter IX of the GDPR provides Member States with further exemptions, derogations, conditions or rules in relation to specific processing activities.

UK Call for Views on the GDPR

Earlier this year, the UK’s Department for Digital Culture, Media and Sport (DCMS) opened a public “call for views” as part of its implementation process. All stakeholders with an interest in data protection were encouraged to share views on any and all derogations in the UK Data Protection Bill.

Following the end of the call for views, the DCMS published its Statement of Intent and outlined its approach to the Data Protection Bill. The document (available here) emphasises the UK Government’s desire to continue its “gold standard” of data protection law. It states that the GDPR will be implemented in a way that, as far as possible, preserves the concepts of the UK’s Data Protection Act 1998 and ensures a smooth transition post Brexit, while complying with the GDPR and other applicable directives.

The DCMS has also provided a detailed summary of the proposed GDPR derogations in the Data Protection Bill (available here). The summary usefully sets out the derogations in the GDPR, the relevant GDPR article, and the reason for the UK deviating from the default position, where applicable.

It is reported that the Bill will be published in early September 2017.

Photo of John Cahir

News reports have confirmed that on Wednesday 26 July, after a public consultation period on the issue, the Irish Government have agreed to set the digital age of consent at 13 years of age. Article 8 of the General Data Protection Regulation (GDPR) provides that a child under the age of 16 cannot consent to the processing of their personal data without the express consent of their parents. EU Member States have been granted the discretion to set a lower age under the GDPR provided that it is no lower than 13.

The decision follows consideration of a submission made by Special Rapporteur for Child Protection, Dr Geoffrey Shannon, who had previously called for the lowest age of consent to be adopted in a Joint Oireachtas Committee on Justice, Defence and Equality meeting on 5 July which discussed the General Scheme of the Data Protection Bill 2017. Dr Shannon stressed the importance of protecting a child’s right to participate and have their voice heard when considering the digital age of consent.

A similar decision has been taken in the UK where the Department of Digital, Culture, Media  & Sport have confirmed that they intend to set the age of digital consent at the lower threshold of 13 years of age, in a Statement of Intent released on 7 August, discussing the proposed Data Protection Bill 2017.