Following the EDPB’s Opinion last month, the Irish Data Protection Commission (DPC) has published a non-exhaustive list of processing operations requiring a Data Protection Impact Assessment (DPIA) to be carried out. The list encompasses both national and cross-border data processing operations. It should be read in conjunction with Article 35 of the GDPR and the WP29 DPIA Guidelines.
Continue Reading Data Protection Commission confirms list of processing operations requiring a DPIA
The UK Court of Appeal has dismissed an appeal against the High Court’s decision that Morrisons is vicariously liable to 5,000 employees for misuse of their personal data by a rogue employee.
The decision is causing shockwaves amongst businesses, as it shows that a company may be held vicariously liable for a data breach caused by an employee, even if the employee’s motive in committing the breach was to harm the company (Wm Morrisons Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339).
The amount of compensation to be awarded has yet to be determined. The Court of Appeal acknowledged that data breaches caused by either corporate system failures or negligence by individuals acting in the course of their employment may lead to a large number of claims against companies for ”potentially ruinous amounts”, and said that the solution is to insure against such catastrophes. In the court’s view, the availability of such insurance was a valid answer to the “Doomsday or Armageddon arguments” about the effect of its decision.
Although this is a UK decision, it will be of persuasive authority to the Irish courts if a similar action is brought here. It remains to be seen whether the decision will open the floodgates to vicarious liability actions being taken against companies for data breaches caused by employees. However, it is likely to be easier to take such actions, as the Irish Data Protection Act 2018 allows compensation to be awarded to data subjects for non-material loss, such as emotional distress. Morrisons has indicated that it intends to appeal the decision to the UK Supreme Court.
Our blog on the High Court’s decision is available here.
Earlier this year, the Irish Data Protection Commission (DPC) published a draft list of processing operations for which it considers it is mandatory to conduct a Data Protection Impact Assessment (DPIA). Following a public consultation, the DPC submitted its draft list to the European Data Protection Board (EDPB) for approval. The EDPB has now published an opinion on the DPC’s draft list. The DPC has two weeks to communicate to the EDPB whether it intends to amend its draft list or maintain it in its current form, and provide an explanation for its decision.
Continue Reading EDPB publishes opinion on processing operations requiring a DPIA
The Irish Government has published its legislation programme for Autumn 2018. The programme lists priority legislation for publication this Autumn, as well as legislation expected to undergo pre-legislative scrutiny. Listed below are the data protection, cyber-security and IP-related Bills coming down the track.
Priority Legislation
Continue Reading Priority Data Protection, Cyber-Security and IP Legislation for Autumn 2018
On 12 September 2018, the UK Deputy Information Commissioner, James Dipple-Johnstone, made a speech to the CBI Cyber Security: Business Insight Conference in which he discussed recent data breach reporting trends in the UK.
The Deputy Commissioner noted that since the GDPR came into effect on 25 May 2018, the ICO has received approximately 500 calls per week to its breach reporting line. After a discussion with the ICO’s officers, roughly one third of these organisations decide that their breach does not meet the reporting threshold. The Irish Data Protection Commission has also been reported as having received a massive increase in breach notifications since the introduction of the GDPR.
Continue Reading ICO receiving 500 breach notification calls a week
New Regulations require organisations to obtain an individual’s explicit consent in advance of processing personal data for health research purposes. The Regulations, known as the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (SI 314/2018), set out a number of mandatory suitable and specific safeguards to be put in place when processing personal data for health research purposes. The Regulations came into effect on 8 August 2018.
Continue Reading Explicit consent required to use personal data for health research purposes
New court rules were introduced on 1 August 2018 which will give members of the media permission to access court documents. These measures, which apply in both the civil and criminal courts, will formalise the media’s access to information. The rules give effect to Section 159 (7) of the Data Protection Act 2018 to facilitate fair and accurate reporting of court proceedings.
The European Parliament has voted for the suspension of the Privacy Shield unless the U.S. complies by 1 September 2018. The non-binding resolution was passed 303 to 223 votes, with 29 abstentions. Parliament takes the view that the current Privacy Shield arrangement does not provide the adequate level of protection required by EU data protection law and the EU Charter as interpreted by the European Court of Justice (CJEU). It considers that, if the US is not fully compliant by 1 September, then the Commission has failed to act in accordance with Article 45(5) GDPR and the Commission should suspend the Privacy Shield until the US authorities comply with its terms. Continue Reading Parliament calls on US to comply with Privacy Shield by September
The Data Protection Commission (DPC) has published Guidelines to support the Government with drafting future regulations restricting the rights of individuals afforded by the GDPR. Whilst the GDPR strengthens the rights of individuals, Article 23 allows Member States or the EU to restrict the scope of individuals’ rights and controllers’ obligations in certain circumstances. Section 60 of the Irish Data Protection Act 2018 (the Act), which came into effect alongside the GDPR, provides for a number of such restrictions, as well as allowing Government Ministers to make regulations further restricting individuals’ rights. It is a mandatory requirement that the Government Minister consults with the DPC before making such regulations.
Continue Reading New guidelines issued by DPC on limiting data subjects’ rights
The Data Protection Commission (DPC) has revamped its website and published online forms to help organisations comply with their new obligations under the GDPR.
The website contains a new Data Protection Officer (DPO) Notification Form, which must be completed by organisations to inform the DPC of their DPO’s contact details. The GDPR requires the appointment of a DPO in the following circumstances: (i) where the processing is carried out by public bodies or authorities; (ii) where an organisation’s core activities consist of large-scale regular and systematic monitoring of data subjects; and (iii) where an organisation’s core activities involve large-scale processing of special categories of data (i.e. sensitive data) or personal data relating to criminal convictions and offences. A DPO may also be appointed on a voluntary basis. However, organisations should be aware that a DPO designated on a voluntary basis will be subject to the same obligations and tasks under the GDPR as if the designation had been mandatory.
Continue Reading Data Protection Commission publishes online DPO and Data Breach Notification Forms