Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

86. To ask the Minister for Justice and Equality if she will make concerns regarding the potential effect of President Trump's executive order (details supplied) on the privacy of Irish and EU citizens' data known to the US Administration; the steps she will take to ensure that the data privacy of Irish persons is protected notwithstanding the order; and if she will make a statement on the matter. [6720/17]

Frances Fitzgerald (Dublin Mid West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The position is that the Data Protection Act 1988, as amended by the Data Protection (Amendment) Act 2003, which gives effect to the 1995 EU Data Protection Directive, contains provisions which govern the transfer of personal data to third countries, including the US. Section 11 of the 1988 Act, which gives effect to Chapter 4 (Transfer of Personal Data to Third Countries) of the Directive, generally prohibits such transfers unless the third country concerned ensures an adequate level of data protection. Article 25 of the 1995 Directive provides that the European Commission may, following an examination of the applicable standards and safeguards, adopt a decision to the effect that a third country ensures an adequate level of protection by reason of its domestic law or international commitments that it has entered into. Member States are required to comply with such a decision.

On 12 July 2016, the European Commission adopted Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield. This means that the Privacy Shield's data protection standards and safeguards are recognised as adequate for the purposes of facilitating transfers of personal data to US organisations which have signed up to it. Article 4 of the Decision states that the European Commission will continuously monitor the functioning of the EU-US Privacy Shield with a view to assessing whether the United States continues to ensure an adequate level of protection of personal data transferred thereunder from the EU to organisations in the US. It also provides for an annual review of its operation. The importance of ongoing and continuous monitoring is, therefore, fully recognised and the European Commission is required to report to the Member States on any shortcomings or deficiencies that may emerge. Apart from the Privacy Shield, transfers of personal data to the US may take place on the basis of standard contractual clauses approved by the European Commission. The adequacy of protection levels afforded by such clauses is currently the subject of proceedings before the Irish High Court.