Photo of Sarah Cleary

The Data Protection Commission (DPC) is accepting feedback on its Draft Regulatory Strategy for 2021–2026 until 30 June 2021. We have set out the key highlights of the Strategy below.

The DPC’s strategic goals are to: (i) regulate consistently and effectively; (ii) safeguard individuals and promote data protection awareness; (iii) prioritise the protection of children and other vulnerable groups; (iv) bring clarity to stakeholders; and (v) support organisations and drive compliance.


Continue Reading DPC seeks feedback on Draft Regulatory Strategy for 2021-2026

Photo of Davinia Brennan

The Portuguese Data Protection Authority (known as the CNPD) has ordered the National Institute of Statistics (NIS) in Portugal to stop sending census data to the U.S. or other third countries, that do not provide an adequate level of data protection.

NIS used Cloudfare Inc. (a U.S. based company) to assist it with the collection of personal data from Portuguese citizens in 2021 Census Surveys. Following receipt of complaints about the collection of census data via the internet, the CNPD carried out an investigation into NIS. The CNPD found that NIS had a contract in place with Cloudfare Inc ., which provided for the transfer of the census data to the U.S., using the Standard Contractual Clauses (SCCs).  It noted that Cloudfare Inc., as a U.S. company, is directly subject to U.S. surveillance legislation for national security purposes, which provides U.S. public authorities with unrestricted access to personal data in its possession, without informing data subjects.


Continue Reading Portuguese Data Protection Authority suspends data transfers to the U.S.

Photo of Grace Moore

The European Data Protection Board (EDPB) recently published new Guidelines (09/2020) on the meaning of and interpretation of a “relevant and reasoned objection” under Article 60(3) of the GDPR.

The Guidelines relate to the cooperation and consistency provisions set out in Chapter VII of the GDPR, under which a lead supervisory authority (LSA) has a duty to cooperate with other concerned supervisory authorities (CSAs) in order to reach a consensus on cases with a cross-border component. The so-called one-stop-shop (OSS) mechanism.


Continue Reading EDPB adopts Guidelines on “Relevant and Reasoned” Objections

Photo of Davinia Brennan

The Conseil d’État, France’s highest administrative court, recently ruled that personal data collected via a platform managed by Doctolib, and hosted by an EU subsidiary of a US-based company (subject to US surveillance laws), was compatible with the GDPR. The ruling is an important follow-up to Schrems II.

Continue Reading French court considers lawfulness of using EU subsidiary of US cloud service provider post-Schrems II

Photo of Sarah Dunne

The European Data Protection Board (EDPB) recently responded to questions submitted by the EU Commission seeking clarification on the consistent application of the GDPR to health research. The responses cover 21 questions and provide clarity on issues such as: the legal basis for processing health data; processing of special categories of data on a large scale; and further processing of previously collected health data. While it is clear that many questions remain unanswered, further responses are expected in forthcoming guidance currently being prepared by the EDPB.

Continue Reading EDPB responds to questions on processing health data

Photo of Davinia Brennan

The Data Protection Commission (DPC) has published its Annual Report for 2020. The Report looks back on the span of regulatory work completed by the DPC over the past year, and reveals some interesting trends and statistics. It discusses the complaints and breach notifications received; case-studies; the 83 domestic and cross-border inquiries it has open; and the fines, reprimands, and compliance orders it has issued for infringements of the GDPR and Law Enforcement Directive (LED). This briefing note considers some of the key highlights of the Report.

Continue Reading DPC publishes Annual Report for 2020

Photo of Davinia Brennan

The EU Commission looks set to adopt two adequacy decisions in favour of the UK, which will allow businesses to continue to freely transfer personal data from the EU/EEA to the UK.  On 19 February 2021, the EU Commission published two draft adequacy decisions permitting transfers of personal data to the UK under the GDPR,

Photo of Davinia Brennan

On 10 February 2021, the EU Member States agreed on the EU Council’s negotiating mandate for the draft ePrivacy Regulation. The new Regulation will repeal and replace the existing ePrivacy Directive 2002/58/EC. The text approved by the EU Member States allows the EU Council to start negotiations with the European Parliament on the final text of the ePrivacy Regulation.

Key Highlights

The EU Council’s Press Release sets out the key highlights of the draft ePrivacy Regulation, which include:

  • The rules will apply when end-users are in the EU. This also covers cases where the processing takes place outside the EU or the service provider is established or located outside the EU.
  • The Regulation will cover electronic communications content and metadata (such as information on location, time and recipient of a communication).


Continue Reading EU Council agrees its position on draft ePrivacy Regulation

Photo of Davinia Brennan

The Irish Data Protection Commission (DPC) has imposed a €70,000 fine on University College Dublin (UCD) for failure to implement appropriate security measures; storing data longer than necessary, and delaying in notifying the DPC of a data breach. This is the sixth GDPR fine imposed by the DPC.  Previous GDPR fines included 3 fines on Tusla (the Child and Family Agency) amounting to a total of €200,000; a €450,000 fine on Twitter, and a €65,000 fine on the HSE. These fines similarly concerned failure to implement appropriate security measures to prevent the unauthorised disclosure of personal data; delaying in notifying the  DPC of the data breach; and failing to adequately document the breach.

Continue Reading DPC fines UCD €70,000 for GDPR breach

Photo of Davinia Brennan

On 15 December 2020, the Minister for Health announced Ireland’s National COVID-19 Vaccination Strategy. The first vaccine was approved for use on 21 December 2020, with the first dose administered in Ireland on 29 December 2020. A second vaccine was approved for use on 6 January 2021 and the approval of additional vaccines is anticipated