Data protection: The State cannot be allowed to exempt itself from GDPR fines

Rape Crisis Network Ireland (RCNI) today (14th June 2017) welcome the statement at the Oireachtas Committee on Justice and Equality by Data Protection Commissioner Helen Dixon, that a proposal to exempt Public bodies from fines under the EU General Data Protection Regulation (GDPR) is of concern.

Clíona Saidléar, RCNI Executive Director said, ‘RCNI agree with the Commissioner that we should expect the highest standard of data protection from public bodies. RCNI would add that the capacity of civil society and the charity sector to hold the State to those highest standards of data protection, particularly in relation to the very significant amount of sensitive personal data we control, needs to be ensured by government.

‘For many charities providing services the principal risk to our beneficiaries is from the very State that has not secured our capacity to guard against the State itself. That that State now suggests it exempt itself from fines under GDPR should be cause for grave concern and cannot be allowed to stand.

‘To hold public bodies accountable, civil society must be empowered through capacity, resources and mechanisms that give us and our Data Protection Officers the independence to act robustly as data controllers as appropriate.

‘The Committee discussed the increased demands on the Data Protection Commissioner’s Office and the Courts in investigating and vindicating the rights of individuals and the need for resources for same. It is critical we bear in mind that the charity sector is also a key actor in protecting people’s data. We must reflect on how the charity sector will meet its obligations and how that will be structured into the government’s allocation of budgets and supporting the necessary structures.

‘Currently no independent funding stream exists from government for charities, particularly those funded by the State to provide services, to draw upon to fulfil their obligations as outlined in the regulation.’