Pat Breen (Clare, Fine Gael) | Oireachtas source

I move amendment No. 186:

In page 115, between lines 31 and 32, to insert the following:"(4) The Commission, as soon as practicable after—

(a) a decision to impose an administrative fine is confirmed under section 140(3)(a) or 141(2), or

(b) the court decides, under section 140(3)(b), to impose a different fine, shall give the controller or processor concerned a notice in writing, requiring the controller or processor to pay the amount of the fine concerned to the Commission within the period of 28 days commencing on the date of the notice.

(5) A controller or processor shall comply with a requirement referred to in subsection (4).

(6) All payments received by the Commission under this section shall be paid into or disposed of for the benefit of the Exchequer in such manner as the Minister for Finance may direct.".

Amendment No. 186 proposes to insert three new procedural subsections into section 139, which provides for the imposition of administrative fines. The proposed new subsection (4) provides that the commission will issue a notice requiring payment of a fine within 28 days of its decision to impose the fine. The proposed new subsection (5) requires the controller or processor concerned to comply with such a notice. The proposed new subsection (6) provides for the payment of any fines into the Exchequer. Amendment No. 188 corrects an incorrect reference to section 139 in section 140. I assure Deputy Ó Laoghaire that the issue at the heart of amendment No. 187, in his name - the recovery of any profits made by a controller or processor because of infringements - is dealt with in Article 83.2(k) of the GDPR. It provides that when determining the amount of any administrative fine, the data protection authority shall have regard to "financial benefits gained, or losses avoided, directly or indirectly, from the infringement". I thank Deputy Ó Laoghaire for his amendment, but I think the matter is adequately covered already in Article 83 of the GDPR.