Patrick Costello (Dublin South Central, Green Party) | Oireachtas source

The reality is that although the SCCs were not struck down in the judgment, they are only valid where it is considered that the data protection controls in place in the third-party country meet the adequacy standard. American data protection standards do not meet that adequacy standard, as we have seen in the context of Safe Harbor and now the EU-US privacy shield. There is no way that these SCCs will hold up to examination. What will happen is that the DPC will have to examine individually each of the approximately 5,500 SCCs, which will add to its workload. It is deeply predictable that they will not stand up because the adequacy is not there.

The same problems that mean the US data protection controls are inadequate exist in the UK. Very soon, we will not be able to transfer data to the UK, which will make Brexit just a little bit more awkward and, as we know, it is already damn awkward.

The Data Protection Commissioner is not entirely independent of the Government. It is the Government that provides her budget and ensures she has adequate staff and resources to do this work. Her work has just become significantly more complicated. Her office was already struggling under the weight and complexity of complaints. We need to provide more funding for the DPC and look very seriously at the consequences that may ensue because the SCCs quite simply will not stand up and are not safe. In fact, the transfer of data should not happen until they are certified as adequate. It is evident that they will not be so certified, given the record of decisions on this matter.

See this speech in context