Alice-Mary Higgins (Independent) | Oireachtas source

I move amendment No. 55:

In page 77, line 9, to delete “or” and substitute “and”.

This refers to where personal data is being transferred to a third country. This again will relate to some of the issues around Brexit and so on. I refer to personal data being transferred to a third country and to section 91(1). I have a question around that and section 95. I refer to a country in respect of which a decision has not been made in the context of the European Commission - for example, where the EU does not have a relationship in respect of data processing with that third country.

There is a bar here, namely, section 91(1)(a) and (b). Data can be transferred to a country with which the European Commission does not have an agreement and where there is a legally binding instrument that applies to the transfer with appropriate safeguards or the controller transferring the personal data, or on whose behalf the personal data are being prepared, has assessed all the circumstances relating to the transfer and is satisfied that appropriate safeguards exist with regard to the personal data.

My amendment is a strengthening of this. I suggest we should satisfy both criterion and change the word "or" at the end of section 91(1)(a) to the word "and", partly because I am concerned that section 91(1)(b) on its own, which can stand even in the absence of any legal instrument, might be a little weak. It may leave large discretionary decision-making to a data controller who is transferring data. I refer to him or her having assessed the circumstances and being satisfied safeguards exist. I am concerned about that and seek to strengthen it by attaching it to section 91(1)(a). Perhaps the Minister can indicate if there is a reason not to do that.