Michael McGrath (Cork South Central, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

468. To ask the Tánaiste and Minister for Justice and Equality the position in relation to the application of data protection legislation in respect of data including personal information held or processed abroad by or on behalf of financial institutions regulated by the Central Bank; and if he will make a statement on the matter. [54969/17]

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The Deputy will appreciate that I am not in a position to provide advice in relation to specific data protection matters in my capacity as Minister for Justice and Equality. Responsibility for oversight and enforcement of data protection law is a matter for the Data Protection Commissioner who is independent in the performance of her functions and exercise of her powers under the Data Protection Acts.  Determination of the applicable law in any particular case will therefore be a matter for the Commissioner.

The general position in relation to the application of data protection law in the State is set out in section 1(3B) of the Data Protection Act 1988 (as amended by the Data Protection (Amendment) Act 2003). It provides that the Act's provisions apply to data controllers in respect of their processing of personal data only if -

(i) the data controller is established in the State and the data are processed in the context of that establishment, or

(ii) the data controller is established neither in the State nor in any other state that is a contracting party to the Agreement on the European Economic Area but makes use of equipment in the State for processing of the data otherwise than for the purpose of transit through the territory of the State.

For these purposes, each of the following shall be treated as established in the State:

(i)an individual who is normally resident in the State,

(ii)  a body incorporated under the law of the State,

(iii) a partnership or other unincorporated association formed under the law of the State, and

(iv) a person who does not fall within subparagraphs (i), (ii) or (iii) of this paragraph, but maintains in the State —

(I)an office, branch or agency through which he or she carries on any activity, or

(II) a regular practice,

and the reference to establishment in any other state that is a contracting party to the EEA Agreement shall be construed accordingly.

As the Deputy will be aware, the General Data Protection Regulation will apply with effect from 25 May next across the EU and will replace the national law provisions of the Member States.