Dáil Éireann Debate, Tuesday - 29 September 2020
745. Deputy Denise Mitchell asked the Minister for Justice her plans to amend the Data Protection Act 2018 to prevent the use of children's data for the purposes of advertising; and if she will make a statement on the matter. [27296/20]
Amharc ar fhreagraRegulation of the processing of personal data for advertising, marketing and profiling purposes takes place under the “legitimate interests” ground in Article 6.1(f) of the General Data Protection Regulation (GDPR).
The European Court of Justice has already addressed the issue of whether national law could impose additional conditions on processing carried on under the corresponding provision of the 1995 Data Protection Directive in Joined Cases C-468/10 and C-469/10. In its ruling, the Court underlined the importance of free movement of personal data under the 1995 Directive and concluded that Member States were not permitted to impose additional conditions that would have the effect of amending the scope of any of the grounds in Article 7 of the Directive. Those grounds are now set out in Article 6.1 of the GDPR.
The Office of the Attorney General has previously advised my Department that prohibiting or providing for an offence for any company or corporate body to process the personal data of a child for the purposes of advertising, direct marketing or profiling, appears to go beyond the margin of discretion afforded to member states in giving further effect to the GDPR and would conflict with Article 6(1)(f), read in conjunction with Recital (47). Put simply, it is not an option for a member state to unilaterally prohibit a category of processing activities which might otherwise be lawful under Article 6.1(f). Any measure such as the one proposed by the Deputy would give rise to a substantial risk of infringement proceedings against the State pursuant to Article 258 of the Treaty on the Functioning of the European Union, and would expose the State to sanctions.
The European Commission have confirmed that processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest and that Article 6(1)(f) of the GDPR does not exclude processing for such purposes in relation to a child, but stresses the importance of balancing the legitimate interest of the controller with the interests and fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. The reference to a child in Article 6(1)(f) and recital (47) underlines that such assessments must be performed with particular care where personal data of a child is processed. The Commission has pointed out that the processing of personal data of a child for the purposes of direct marketing is therefore not as such unlawful. They have also indicated that subject to Article 22 (automated decision-making), processing of personal data of a child for the purposes of profiling is not generally prohibited, albeit the processing must take into account that children merit specific protection as clarified in recital (38).
In addition to the above, in June of this year, the European Commission published its first evaluation and review of the GDPR pursuant to Article 97 GDPR. In its report, the Commission did not recommend any substantive amendments to the Regulation, but did commit to providing tools to clarify / support the application of data protection rules to children.
Furthermore, the Commission recommended that the European Data Protection Board adopt guidelines which are practical, easily understandable, and which provide clear answers and avoid ambiguities on issues related to the application of the GDPR, particularly in relation to the processing of children’s data.
The Deputy will appreciate that the GDPR is an EU wide instrument agreed by all the member states of the European Union and one State cannot unilaterally change it, nor can we deviate from its provisions.
