Clare Daly (Dublin Fingal, Independent) | Oireachtas source

I move amendment No. 37:

In page 25, lines 14 to 32, to delete all words from and including “purposes,” in line 14 down to and including line 32 and substitute the following:

"purposes, and(b) having regard to the state of the art, the context, nature, scope and purposes of data processing and the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subjects—

(i) logging mechanisms to permit verification of whether and by whom the personal data have been consulted, altered, disclosed or erased,

(ii) in cases in which it is not mandatory under the Data Protection Regulation, designation of a data protection officer,

(iii) where the processing involves data relating to the health of a data subject, a requirement that the processing is undertaken by a person referred to in section 49(2),

(iv) pseudonymisation of the personal data,

(v) encryption of the personal data,

(vi) measures to ensure the confidentiality, integrity, availability and resilience of processing systems and services related to the processing of personal data, including the ability to rapidly restore availability and access in the event of a physical or technical incident,

(vii) technical and organisational measures to ensure that processing complies with the Data Protection Regulation and processes for testing and evaluating the effectiveness of such measures, and

(viii) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.".