I propose to take Questions Nos. 97, 99, 100 and 101 together.
I share the Deputies' concerns about recent allegations concerning potential breaches of the GDPR in relation to the selling of personal data by data brokers.
The General Data Protection Regulation (GDPR) provides comprehensive EU wide protections for the personal data of EU citizens, including what constitutes the lawful processing of personal data based on the consent of individuals or other legal grounds. Given the cross-border nature of digital data flows, often involving organisations based in multiple EU and non-EU jurisdictions, regulation at EU level provides more robust safeguards. I am advised that, at this juncture, there is no indication that additional legislation is required to deal with the issues raised. This will be kept under review.
My Department officials have met with the Data Protection Commission (DPC) in relation to the serious issues raised and will continue to engage on this important matter. I understand that the DPC is treating this matter very seriously and is currently engaging with RTE to establish the identity of the data broker(s) concerned, critical information which will inform the further actions to be undertaken by the DPC. I would encourage anyone with evidence in relation to the sale of precise location data of individuals to contact the Data Protection Commission.
In addition to the DPC’s investigation, I am informed that the DPC are reviewing what further guidance they can publish on the protection of personal data in the circumstances concerned.