Eamon Ryan (Dublin Bay South, Green Party) | Oireachtas source

This is a small, but important, amendment to improve data protection with regard to traffic cameras and other devices. Subsection 8 of the new section 77A that is being inserted into the Roads Act 1993 relates to data-sharing agreements when data from the cameras and devices in question are to be shared. Section 77A(8) lists matters which may be specified in a data-sharing agreement. One of these matters is that a data protection impact assessment, DPIA, should be conducted under section 84 of the Data Protection Act 2018. That section of the Act deals with DPIAs carried out with regard to processing of personal data for law enforcement purposes.

The House will be aware that European data protection law is based on two European legal instruments, EU Regulations Nos. 679 and 680 of 2016. EU Regulation No. 680 deals with data protection in the sphere of law enforcement and is widely referred to as the law enforcement directive. This is reflected, as far as DPIAs are concerned, in section 84 of the 2018 Act. EU Regulation No. 679 is the general data protection regulation, GDPR, which deals with all other aspects of data sharing and processing. A DPIA can be carried out under either but, at present, section 77A(8) refers only to a DPIA under section 84 of our Data Protection Act, which means it only covers a DPIA under the law enforcement directive. I therefore propose amendment No. 33 to add a reference to a DPIA under EU Regulation No. 679 in order that the DPIA in question could be a DPIA for any purposes and not just for law enforcement. This is necessary in the interests of data protection. If we do not do this, it will mean data-sharing agreements under section 77A(8) will include a DPIA only if they come under the law enforcement directive and not if they come under GDPR.