Strengthening data subjects’ rights, facilitating the exercise of rights, and improving oversight and enforcement, are central to the objectives of the General Data Protection Regulation (GDPR). Article 23 of the GDPR recognises the need for restrictions on the exercise of data subject rights for certain public interest purposes. Guidance from the European Data Protection Board has highlighted that any such restrictions should be interpreted narrowly, only be applied in specifically provided circumstances, and only when certain conditions are met.
To be lawful, restrictions must be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations which are listed in Article 23, and respect the essence of the fundamental rights and freedoms at issue. The restrictions must also amount to a necessary and proportionate measure in a democratic society while safeguarding one of the grounds set out in Article 23(1) GDPR.
Section 60 of the Data Protection Act of 2018 Act gives effect to Article 23 and section 60 (6) provides for the making of regulations to restrict certain rights and obligations where such restrictions are necessary for the purposes of safeguarding important objectives of general public interest as outlined in section 60(7). In accordance with Section 60(9), any Minister may make such regulations following consultation with the Minister for Justice.
Therefore, having regard to the need to regulate for such restrictions in very specific terms, and that the power to regulate is conferred on any Minister, any regulations relating to the prevention, investigation, detection and prosecution of breaches of ethics for a regulated profession, would be a matter for the Minister responsible for the regulation of the profession or sector in question.
A number of regulations have been made to date under s60 of the 2018 Act.
