Oireachtas Joint and Select Committees
Wednesday, 3 April 2019
Joint Oireachtas Committee on Justice, Defence and Equality
Implementation of the General Data Protection Regulation: Data Protection Commission
Ms Jennifer O'Sullivan:
I might answer the question on Brexit generally first and then hand over to Mr. Ryan to speak directly to the exchange of information between policing authorities on the island and across Europe. The commission has been engaged heavily in Brexit preparations for the past several months and it is an active topic of conversations with colleagues in the EU at the EDPB. The transfer of personal data outside the EU is a central element of EU data protection law and is taken very seriously because the relative standard of protection for personal data is so high in Europe. To not have those safeguards in place would undermine that standard. The DPC has been issuing guidance to organisations that seek to transfer data from Ireland to the UK. Over the past several months, we have being doing that and it has also been done via the Government's communications channels. The EDPB has also been issuing guidance on that. We are also working with our UK counterparts in preparation for the potential impact on live cases that are cross-border in nature. On the transfers question, there are several mechanisms available for the transfer of personal data outside the EU. If the UK leaves without a withdrawal agreement, it will be considered a third country. For regular organisations, the simplest and quickest method to utilise will be standard contractual clauses. We have templates for those on our website. There are some organisations which choose to use a mechanism called "binding corporate rules". When it comes to transfers by public bodies, particular provisions are in place and the DPC has been involved recently in authorising some of those as required by the GDPR. Mr. Ryan might speak specifically to the question of the exchange of data in a policing context.