Ireland

[IE] Data Protection Regulations

IRIS 2002-4:1/32

Marie McGonagle

School of Law, National University of Ireland, Galway

Ireland's current Data Protection Act was passed in 1988, when the Internet and international data transfers were much more limited than today. At the end of 2001, the Minister for Justice signed the European Communities (Data Protection) Regulations, 2001. The regulations implement certain provisions of the EU Data Protection Directive (95/46/EC) and are due to come into effect on 1 April 2002. Under the new regulations, transfers of data to countries outside the European Economic Area (EEA) cannot take place unless one of a number of clear conditions designed to protect people's privacy rights are met. These include: approved contractual safeguards, the clear consent of data subjects, or the approval of such a country for such purposes by the EU. The Data Protection Commissioner has said that the new regulations should make life a lot easier for responsible organisations whose business involves the transfer of personal data overseas.

In addition to the Regulations, the Minister published the Data Protection (Amendment) Bill 2002 on 25 February. The Bill, when enacted, will amend the 1988 Act and will implement the EC Directive of 1995. The main changes to the 1988 Act relate to definitions, new rights for data subjects, new responsibilities for data controllers, new rules regulating the registration process and new powers and functions of the Data Protection Commissioner. The Bill includes both automated and manual data. It also contains the right to be informed, improved rights of access, employment rights, the right to object, to block certain uses of data and freedom from automated decision-making. It clarifies or makes firmer the responsibilities related to the handling of personal data and contains special exemptions for journalistic, artistic and literary processing.