Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Section 33 of the Bill, which relates to the designation of data protection officers, provides for the possible introduction of regulations that would require additional categories of controllers or processors to appoint data protection officers in accordance with Article 37(4) of the GDPR. Section 33(3) sets out the policies and principles that would apply for the purposes of underpinning any such regulations, including, in section 33(3)(d), "the costs of implementation of any requirement if it were imposed under" section 33(1). I cannot accept the deletion of this provision, as proposed in amendment No. 35. It is an appropriate and legitimate provision. In requiring the cost of implementation to be taken into account when additional obligations are being determined, especially with regard to the needs of small and medium-sized enterprises and microbusinesses, it is fully compliant with the GDPR. Articles 25 and 32 of the GDPR acknowledge the relevance of the cost of implementation as a factor to be taken into account when determining the obligations of controllers and processors. I cannot accept amendment No. 35 on this basis.