James Browne (Wexford, Fianna Fail) | Oireachtas source

I move amendment No. 24:

In page 31, after line 33, to insert the following: “Amendment of section 117A of Act of 2018

57.The Act of 2018 is amended by the substitution of the following section for section 117A:

“117A. (1) This section applies to a transfer of personal data by a controller or processor to a third country or an international organisation pursuant to Article 46 where the transfer is subject to appropriate safeguards provided for in the rules or clauses (in this section referred to as ‘relevant instruments’) set out in subsection (5).

(2) Without prejudice to any other remedy available to him or her, including his or her right to bring an action under section 117 or to lodge a complaint, a data subject whose personal data is included in a transfer referred to in subsection (1) may, where the transfer is subject to appropriate safeguards set out in a relevant instrument, enforce—

(a) any rights (whether described as third party beneficiary rights or otherwise) conferred on data subjects by, or any clauses or rules expressed to be for the benefit of data subjects in, the instrument concerned, and

(b) where that transfer is subject to any additional safeguards conferring rights on data subjects, those rights.

(3) An action to enforce any rights conferred on data subjects or any clauses or rules expressed to be for the benefit of data subjects referred to in subsection (2)—

(a) may be taken against—

(i) a party to the transfer referred to in subsection (1), or

(ii) a sub-processor of a party referred to in subparagraph (i) in so far as that sub-processor is processing personal data referred to in that subsection,

and

(b) shall be deemed to be an action founded on contract.

(4) Subsections (3) to (10) of section 117 shall apply to an action taken by a data subject under this section subject to the following modifications:

(a) a reference in those subsections to a data protection action shall be taken to be a reference to an action under this section;

(b) a reference in subsections (5) and (5A) to the limit of that court’s jurisdiction in tort shall be taken to be a reference to the limit of that court’s jurisdiction in contract;

(c) a reference in subsections (4)(b) and (8)(b) to compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment shall be taken to be a reference to compensation for damage suffered by the plaintiff as a result of the infringement of the relevant instrument.

(5) The relevant instruments are:

(a) binding corporate rules approved in accordance with Article 47;

(b) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

(c) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

(d) contractual clauses authorised by a supervisory authority pursuant to Article 46(3)(a);

(e) standard contractual clauses which are the subject of a decision adopted by the Commission in accordance with Article 26(4) of 20 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.”.”.

See this speech in context