Dáil Éireann Debate, Tuesday - 24 July 2018
623. Deputy Louise O'Reilly asked the Minister for Justice and Equality his plans to amend section 30 of the Data Protection Act 2018 to bring it in compliance with GDPR, Article 38.1 of the Constitution and Article 7 of the European Convention on Human Rights; and if he will make a statement on the matter. [32475/18]
View answer628. Deputy Louise O'Reilly asked the Minister for Justice and Equality the action he will take to amend section 30 of the Data Protection Act 2018 in order that profiling is prohibited in law and that the section can be commenced (details supplied); and if he will make a statement on the matter. [32481/18]
View answerI propose to take Questions Nos. 623 and 628 together.
As I have explained in responses to earlier parliamentary questions on this issue, the processing of personal data for marketing and profiling purposes takes place under the so-called “legitimate interests” ground in Article 6.1(f) of the GDPR and the Court of Justice has already addressed the question of whether national law can impose additional conditions on processing carried on under the corresponding provision of the 1995 Data Protection Directive. In its ruling in Cases C-468/10 and C-469/10, the Court of Justice underlined the importance of free movement of personal data under the 1995 Directive and concluded that Member States were not permitted to impose additional conditions that would have the effect of amending the scope of any of the grounds in Article 7 of the Directive. Those grounds, including the "legitimate interests" ground, are now set out in Article 6.1 of the GDPR.
The Office of the Attorney General has advised my Department that insofar as section 30 purports to make it an offence for any company or corporate body to process the personal data of a child for the purposes of direct marketing or profiling, such a prohibition appears to go beyond the margin of discretion afforded to Member States in giving further effect to the GDPR and would conflict with Article 6(1)(f) when read together with Recital (47).
In the meantime, the European Commission has confirmed that processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest and that Article 6(1)(f) of the GDPR does not exclude processing for such purposes in relation to a child. However, it stresses the importance of balancing the legitimate interest of the controller with the interests and fundamental rights and freedoms of the data subject, in particular where the data subject is a child. The reference to a child in Article 6(1)(f) and recital (47) underlines that such an assessment must be performed with particular care where personal data of children are processed. The European Commission has pointed out that the processing of personal data of children for the purposes of direct marketing is therefore not as such unlawful and that, subject to Article 22 (automated decision-making), the processing of personal data of children for the purposes of profiling is not generally prohibited. However, such processing must take into account that children merit specific protection, as underlined in recital (38). The European Commission has also pointed out that the term "micro-targeting" is not mentioned in the GDPR and that it is a concept unknown to the GDPR.
It is clear from the foregoing that commencement of section 30 would give rise to a substantial risk of infringement proceedings against the State pursuant to Article 258 of the Treaty on the Functioning of the European Union, and exposure of the State to sanctions.
I would, however, draw the Deputy's attention to Article 58 of the GDPR which already confers a power on supervisory authorities such as the Data Protection Commission to order controllers and processors to bring processing operations into compliance with the GDPR's provisions, including the standards and safeguards applicable to the processing of children's personal data. Article 58 also confers powers on the Commission to impose a temporary or definitive limitation, including a ban, on such processing and to impose an administrative fine pursuant to Article 83 in the case of infringements. This means that the possibility of imposing administrative fines in cases of unlawful processing of children's personal data already exists without the commencement of, or any amendments to, section 30 of the Data Protection Act 2018.
