The final draft exempts processing of personal data from the provisions of the Bill where processing:
· Relates to a purely personal or household activity.
· Is necessary for national security or public order or
· Disclosure is required under law or by court order.
· Relates to journalism, literature or art provide the processing complies with self-regulatory or professional codes of ethics relevant to the publication in question.
· Research, history and statistics as longs as data in the final publication is anonymised.
· Any other instance exempted in writing by the Data Protection Commissioner.
Office of the Data Protection
The 2019 draft requires that the Data Protection Commissioner be recruited by the Public Service Commission through a competitive, open and transparent process. The PSC is to forward three names of qualified candidates in order of merit to the Cabinet Secretary. The Cabinet Secretary is then required to appoint one of the three within 7 days of receipt of the names. The Data Protection Commissioner is only eligible for one term of 6 years.
The final draft expands the functions of the office of the Data Protection Commissioner to include:
· Oversee data processing operations within the Republic.
· Conduct assessments of any public or private body to ascertain compliance with the Act.
· Promote international co-operation in matters relating to data protection.
· Impose administrative fines for failures to comply with the Act.
The Final Bill permits the Data Commissioner to delegate powers subject to any necessary conditions to a regulator established under an Act of Parliament. The Data Commissioner is not allowed to delegate power to an employee of the Data Commissioner’s Office or a recognized self-regulatory body as provided in the 2018 draft Bill.
