Dáil debates
Tuesday, 21 July 2020
Saincheisteanna Tráthúla - Topical Issue Debate
Data Protection
11:05 pm
Patrick Costello (Dublin South Central, Green Party)
Link to this: Individually | In context | Oireachtas source
This is a rather complex and long-running case, the consequences of which reach into many areas of public policy. It will have implications for Brexit, foreign direct investment and foreign trade. Quite simply, on foot of this judgment, the EU-US privacy shield has been declared invalid. As such, there is no safe and legal way to transfer data from a European Union citizen to the United States. Any company carrying out such data transfers is doing so at significant risk.
This case started in June 2013, seven years ago. Hopefully now that we finally have the judgment, we can see some real action to protect the fundamental rights of European citizens concerning their own data and privacy. The collapse and demise of the EU-US privacy shield was inevitable and widely predicted. It was a replacement for the previous safe harbour arrangement, to which little change had been made. As that arrangement had been declared invalid, this ruling was inevitable. It would be really positive if we could see some action from the Data Protection Commissioner to prevent what are, according to the European Court of Justice, unsafe and illegal transfers of data. The German Federal Commissioner for Data Protection and Freedom of Information has already been warning people that they should stop these data transfers because of the demise of the EU-US privacy shield and the insufficient safeguards built into the standard contractual clauses on which companies will now have to rely.
The plaintiff in the case, Max Schrems, has published an open letter to the Irish Data Protection Commissioner asking when she will take action. One point we need to know is when the action will happen. The important follow-up question is whether the Data Protection Commissioner actually can act. Have we given her the resources to act properly? While her budget has increased, it is only a third of what she asked for. Her budget has failed to keep pace with the complexity and volume of complaints her office receives. We have seen her struggle to deal with this case. Serious complaints concerning real-time bidding, a very scary practice where data privacy is concerned, seem to have stalled and are going nowhere. Other data protection authorities around Europe have called us out as the roadblock to meaningful enforcement of the general data protection regulation, GDPR. We need to say when the action will happen. Are we giving the Data Protection Commissioner what she needs to act? I have said several times in this Chamber that we have not. After this judgment, her workload will not just become more complex; it will also massively increase. She does not have enough resources as it is, so we need to do more. This has huge consequences for many areas.
Thomas Byrne (Meath East, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
It is very nice to be back on this side of the House after almost ten years. I am glad to be responding to this matter on behalf of the Minister for Justice and Equality. It is a very important case. The Deputy has mentioned the implications for Ireland's data protection regime of the recent judgement of the European Court of Justice on the EU-US privacy shield. I welcome the opportunity to update the House on the matter.
The Government respects the views and findings of the European Court of Justice and is fully supportive of the need to protect European citizens' data. This is an issue that affects us all and should be subject to the highest protections. The Minister acknowledges that the court's decision to strike down the EU-US privacy shield is a matter of serious concern for Irish and European businesses that transfer data to the US but welcomes the court's findings upholding the use of standard contractual clauses to facilitate the transfer of data between the EU and countries outside it. The Minister notes that in these matters, it is important that we respect the independence of the courts and the Data Protection Commission, DPC. The Data Protection Commission is an independent national authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. The DPC is the Irish supervisory authority for the GDPR and has functions and powers related to other important regulatory frameworks, including the Irish e-privacy regulations, and the EU directive known as the law enforcement directive.
Matters concerning data protection are governed by several legislative frameworks, including the GDPR, the Data Protection Acts, the law enforcement directive and the 2011 e-privacy regulations.
The DPC is entirely independent of the Government, as is required under the GDPR. Together with our EU partners, we will need to examine the impact the ruling of the European Court of Justice will have on the continued use of standard contractual clauses, SCCs. Although the original reference to the Court of Justice originated from our High Court, this is not solely an Irish matter, as the Deputy noted, and it is not one that we can unilaterally fix. The ruling strikes down the European Commission's adequacy decision on the EU-US privacy shield. We will need to review the judgment and will work with the European Commission and our European partners to contribute to a solution.
11:15 pm
Patrick Costello (Dublin South Central, Green Party)
Link to this: Individually | In context | Oireachtas source
The reality is that although the SCCs were not struck down in the judgment, they are only valid where it is considered that the data protection controls in place in the third-party country meet the adequacy standard. American data protection standards do not meet that adequacy standard, as we have seen in the context of Safe Harbor and now the EU-US privacy shield. There is no way that these SCCs will hold up to examination. What will happen is that the DPC will have to examine individually each of the approximately 5,500 SCCs, which will add to its workload. It is deeply predictable that they will not stand up because the adequacy is not there.
The same problems that mean the US data protection controls are inadequate exist in the UK. Very soon, we will not be able to transfer data to the UK, which will make Brexit just a little bit more awkward and, as we know, it is already damn awkward.
The Data Protection Commissioner is not entirely independent of the Government. It is the Government that provides her budget and ensures she has adequate staff and resources to do this work. Her work has just become significantly more complicated. Her office was already struggling under the weight and complexity of complaints. We need to provide more funding for the DPC and look very seriously at the consequences that may ensue because the SCCs quite simply will not stand up and are not safe. In fact, the transfer of data should not happen until they are certified as adequate. It is evident that they will not be so certified, given the record of decisions on this matter.
Thomas Byrne (Meath East, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
As I outlined, the Government is fully committed to the highest standards of data protection being in place for the benefit of Irish and other EU citizens. The Minister, Deputy McEntee, supports the entitlement of people across the EU to exercise their rights of data protection. However, the independence of our courts and the European Court of Justice must be respected, as must the independence of the DPC. I take on board the point made by the Deputy regarding the funding of the DPC but it does not detract from its independence. All Members accept that it is independent.
Although the Minister appreciates that the Court of Justice decision to strike down the privacy shield is a matter of serious concern for Irish and European businesses that transfer data to the US, she welcomes the court's findings which uphold SCCs. She is confident that the issues arising from the judgment can be resolved by working in conjunction with our EU partners. In so doing, the Government will endeavour to arrive at practical solutions. I thank the Deputy for raising this important issue and for his very helpful comments on the matter.