Photo of Davinia Brennan

The Court of Justice of the European Union (CJEU) has confirmed the limited competence of a national supervisory authority, that is not the lead supervisory authority (LSA), to bring legal proceedings in their national courts for alleged infringements of the GDPR. The CJEU concluded that in cases of cross-border data processing, a national supervisory authority that is not the LSA has power to bring legal proceedings in its national courts, only if: (i) that power is exercised in one of the situations where the GDPR confers on that supervisory authority a competence to adopt a decision finding that such processing infringes the rules contained in the GDPR, and (ii) that power is exercised with due regard to the cooperation and consistency procedures laid down by the GDPR.

Continue Reading CJEU confirms limited derogations from the GDPR’s one-stop-shop mechanism

Photo of John Cahir

The Irish government has moved swiftly to plug a perceived gap in protection under Irish data protection law that had raised doubts about whether Irish law was fit for purpose as a governing law under EU approved standard contractual clauses (SCCs).

On 4 June 2021, the European Commission adopted new SCCs, which became effective on 27 June 2021. The parties are free to agree an EU member state governing law applicable to their SCCs. However, Clause 17 of the new SCCs, on its face, posed a problem for Ireland. It stated that: “These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of _______ ”

In other words, the parties are free to choose an EU member state law to govern their SCCs so long as that law allows for third party beneficiary rights. But, therein lay the problem for Irish law. As a rule, Irish contract law doesn’t allow for third party beneficiary rights because the privity of contract doctrine still prevails in Irish law with few exceptions.  Controllers and processors in Ireland (and their Iegal advisers) were therefore justifiably concerned that they would not be able to choose Irish law to govern their data transfers under the new SCCs.

The Irish government has moved remarkably quickly to dispel the legal uncertainty. On 24 June 2021, the Minister for Justice adopted the European Union (Enforcement of Data Subjects’ Rights on Transfer of Personal Data Outside the European Union) Regulations 2021 (S.I. 297/2021).

These Regulations insert a new section – Section 117A – into the Data Protection Act 2018. The new section confers an express right on data subjects to enforce the SCCs provisions (or other contractual transfer mechanisms such as BCRs) against the parties to the contract.  Controller and processors in Ireland can now breathe a sigh of relief: Irish law does provide third-party beneficiary rights for data subjects making Irish law eligible as a governing law for SCC transfers.

 

Photo of Davinia Brennan

The Data Protection Commission (DPC) has published guidelines addressing the issue of what information employers can process in relation to their employees’ return to the workplace. In particular, the DPC considers the question as to whether employers can lawfully collect and process information about the Covid-19 vaccination status of their employees.

Information about a person’s vaccination status is special category personal data for the purposes of GDPR. It represents part of their personal health record, and is afforded additional protections under data protection law. The guidelines make it clear that the DPC does not consider there is any general legal basis for employers to request the vaccination status of their employees at this time.

Continue Reading DPC publishes Guidelines on collection of vaccination data of employees

Photo of Davinia Brennan

​The EU Commission has formally adopted two UK adequacy decisions, one under the GDPR and the other under the Law Enforcement Directive (LED). This means that personal data can continue to flow freely from the EU to the UK, without putting in place additional safeguards, such as the Standard Contractual Clauses.

The adequacy decisions were adopted just two days before the interim solution agreed under the EU-UK Trade and Cooperation Agreement, permitting the free flow of data from the EU to the UK, was due to expire on 30 June 2021.

Continue Reading UK Adequacy Decisions adopted by European Commission

Photo of Grace Moore

On 25 May the Grand Chamber of the European Court of Human Rights, (ECtHR) ruled that the UK’s surveillance regime of bulk interception of online communications violated the European Convention on Human Rights (Convention) in the case of Big Brother Watch v United Kingdom.  According to the ECtHR this regime breached the rights to privacy and freedom of expression enshrined within Article 8 and 10 of the Convention, a ruling that will have significant implications for state surveillance across Europe.

Continue Reading Big Brother was watching: ECHR Grand Chamber rules that UK bulk interception surveillance regime violates human rights

Photo of Davinia Brennan

The European Commission has published its final Implementing Decision on new standard contractual clauses (SCCs) for the transfer of personal data to third countries.

The new SCCs have been expected for some time in order to address the entry into force of the GDPR and the requirements of that regime. The delay to the update was due partly to the European Court of Justice’s decision in Schrems II (C-311/18), and the need for the European Commission to reconcile the new SCCs with that decision. They also take into account the Joint Opinion (2/2021) of the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) on the draft SCCs, as well as the EDPB’s draft recommendations on supplementary measures.

Continue Reading European Commission publishes finalised SCCs

Photo of Davinia Brennan

The Data Protection Commission (DPC) has completed its ‘own volition’ inquiry into whether the Department of Employment Affairs and Social Protection interfered with the role of its Data Protection Officer (DPO).  The inquiry concerned the process leading to the amendment of the Department’s Privacy Statement on 6 July 2018. The DPC examined whether the Department’s DPO was involved in a proper and timely manner in the process (as required by Article 38(1) of the GDPR); and whether the DPO received instructions regarding the exercise of his tasks (contrary to Article 38(3) of the GDPR). The DPC concluded that the Department had not breached Articles 38(1) or 38(3) of the GDPR.

Continue Reading DPC completes statutory inquiry into suspected interference with role of DPO

Photo of Davinia Brennan

The High Court, in a 197-page judgment, has dismissed a legal challenge against a decision by the Data Protection Commission (DPC) to commence an “own volition” inquiry into the applicant’s data transfers to its parent company in the US, and to issue a preliminary draft decision (PDD) proposing to suspend such transfers.

The applicant brought judicial review proceedings against the DPC, alleging that the inquiry and PDD were unlawful on a number of procedural grounds. In particular, the applicant claimed that the DPC had breached its legitimate expectation that the DPC would follow the statutory inquiry procedure set out in its Annual Report for 2018, on its website, and that it had adopted in other inquiries. The applicant also claimed the DPC had breached its right to fair procedures by failing to conduct an investigation/inquiry before reaching a decision. The High Court rejected all of the applicant’s grounds of challenge, finding that the DPC’s decision to commence an inquiry and issue the PDD, along with the associated procedural steps, were lawful.

The proceedings concerned the procedural rights and obligations of the parties in the context of the DPC’s inquiry following Schrems II, rather than the merits of the DPC’s preliminary views in the PDD.

Continue Reading High Court rejects procedural challenge against DPC’s inquiry into EU-US data transfers

Photo of Davinia Brennan

The Government has published its legislation programme for Summer 2021. We have set out below the status of key Bills of relevance to the data protection, commercial and technology sector.

Bills expected to undergo pre-legislative scrutiny this Summer Session 

  • Online Safety and Media Regulation (OSMR) Bill – This Bill will provide for the establishment of a multi-person Media Commission (including an Online Safety Commissioner), the dissolution of the Broadcasting Authority of Ireland, a regulatory framework to tackle the spread of harmful online content, and implementation of the revised Audiovisual Media Services (AVMS) Directive 2018/1808. The Heads of Bill were published on 9 January 2020, with additional provisions approved on 8 December 2020. The government also recently approved the integration of the Broadcasting (Amendment) Bill into the OSMR Bill. Member States were due to implement the revised AVMS Directive in national law by 19 September 2020, so Ireland has missed this deadline. Pre-legislative scrutiny is currently underway.

Continue Reading Government publishes Summer Legislation Programme

Photo of Davinia Brennan

Last Friday 21 May 2021, MEPs passed a resolution asking the EU Commission to modify its draft UK adequacy decisions, to bring them into line with recent EU court rulings and to address concerns raised by the European Data Protection Board (EDPB) in its recent opinions. The EDPB stated that UK law and practice relating to bulk data collection, onward transfers and its international agreements in the field of intelligence sharing, need to be further assessed by the EU Commission.

Continue Reading MEPs ask European Commission to amend draft UK adequacy decisions