Charles Flanagan (Laois, Fine Gael) | Oireachtas source

Amendment No. 23 seeks to insert paragraphs into section 45 and amendment No. 36 seeks to insert the same paragraphs into section 54, which is why we are taking them together. The position here is that the imposition of a statutory duty on the Data Protection Commissioner to conduct an impact assessment on regulations to be made under section 45(2) is in conflict with article 36(4) of the GDPR. That provision states that a member state's data protection authority must be consulted on proposals for any legislative measures to be adopted by a national parliament or a regulatory measure based on such a legislative measure which relates to the processing of data. The GDPR imposes an obligation on controllers and on processors, in certain cases, to carry out data protection impact assessments. There is no such an obligation on the data protection authority itself. The imposition of such an obligation not only would have resource implications of some significance but would, in essence, be in conflict with the complete independence of the supervisory authority that is required under Article 52. It will be open to the Data Protection Commissioner to request a controller, whether a Department or any other public authority with a regulation-making power, to carry out such an assessment when it is consulted on the proposed legislative measures. The carrying out of data protection impact assessments will be an obligation on controllers and processors. That is clear under Article 35 of the GDPR. The tasks of the data protection authority specified in Article 57 do not really foresee such a role or obligation. I am not in a position to accept the amendments for those reasons.