COMHAIRLE CONTAE ÁTHA CLIATH THEAS
SOUTH DUBLIN COUNTY COUNCIL
MEETING OF SOUTH DUBLIN COUNTY COUNCIL
Monday, June 11, 2018
HEADED ITEM NO. 12
HEADED ITEM: C. Performance and Change Management Directorate
DATA PROTECTION ACT 2018 AND RESPONSIBILITIES OF ELECTED REPRESENTATIVES
REPORT:
The Data Protection Act 2018 Data Protection Act 2018 – No. 7 of 2018 – Houses of the Oireachtas establishes the Data Protection Commission and inter alia gives further effect to Regulation (EU) 2016/679 of the European Parliament and Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Section 40 of the Data Protection Act 2018 sets out the legal requirements in relation to processing of personal data and special categories of personal data by elected representatives as follows,
‘S. 40 (1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.
(2)A person may make a request or representation on behalf of a data subject where the data subject-
(a) has given his or her consent to the making of the request or representation, as the case may be, or
(b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.
(3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.
(4) For the purpose referred to in subsection(1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation
(5) In this section, “elected representative” means-
(a) a member of either House of the Oireachtas,
(b) a member of the European Parliament
(c) a member of a local authority.’
Elected representatives making representations on behalf of a constituent should be fully satisfied that the full consent of the constituent has been given to the elected representative to make the representation and to obtain and process data, which may include personal data, on behalf of the constituent which relates specifically to the subject matter of the representation.
In situations where a request or representation is made to an elected representative on behalf of a data subject (for example another family member) the elected representative should be fully satisfied that the data subject has given his or full consent to the making of the request or representation, as the case may be, on his or her behalf or is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.
Elected representatives should put in place appropriate measures to ensure that personal data being processed by them is held securely at all times.
The Data Protection Commission has indicated that Guidelines will issue later in 2018 in relation to the application of the Act insofar as it relates to representations by elected representatives and these Guidelines will be circulated to the Members once received.
The Members attention is also drawn to sections 39, 48, 58 and 59 of the Act which relate to processing of personal data in connection with electoral activities. With the measures that will be in the Act now confirmed, training will be arranged for all Councillors in SDCC.
A circular has issued from the Department of Housing, Planning and Local Government dated June 1 2018 and is attached under this item for the information of all elected members.