Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Amendment No. 1 replaces the definition of "public authority" in this section. This is important because article 37 of the General Data Protection Regulation, GDPR, requires public authorities to designate a data protection officer to carry out the tasks listed in article 39. The amended definition would ensure that both the Office of the Director of Corporate Enforcement and the Irish Auditing and Accounting Supervisory Authority were classified as public authorities under the Bill. The definition will exclude recognised schools other than those established and maintained by education and training boards, ETBs, and where the ETB is the sole patron. From the entry into force of the GDPR next May, all schools, as data controllers, will be required to implement appropriate measures to ensure, and to be able to demonstrate, that the processing of personal data is performed in accordance with the regulation. However, most of the 4,000 recognised schools are small and independently owned and, therefore, the exclusion of non-ETB schools from the definition is recognition of the fact that many of them, as small, independent organisations, would face additional administrative burdens were they to be so defined as public authorities. ETB schools in contrast are part of a larger ETB organisation, which is the data controller for all processing activities within the board.

The revised definition will also ensure that certain bodies funded by the Health Service Executive, HSE, will be classified as public authorities for the purpose of the Bill. The Health Acts empower the HSE to enter into arrangements with service providers to provide health and social services on its behalf. Specifically, section 38 arrangements involve organisations, mainly large voluntary organisations, being funded to provide services on behalf of the HSE. Section 38 bodies are found primarily in the acute hospital and disability sectors. The public funding provided to these bodies by the executive is significant and the Minister for Health considers that it is proper from a data protection perspective that such bodies should be treated in a similar manner to statutory bodies operating in the same area. The inclusion of paragraph (g) in the definition of "public authority" will achieve that purpose.

Amendment No. 37 can be moved by Senator Higgins. Amendment No. 38, which substitutes the correct definition of "genetic data" in section 63, is taken directly from article 4 of the GDPR and article 3 of the directive. Amendments Nos 57 and 58 are drafting amendments to the definitions of "relevant enactment" and "relevant provision" in section 100.