State bodies exempt from fines for misusing personal data

Government departments and State bodies will be exempt from sanctions and fines for misusing someone’s personal information under new Europe-wide laws set to come into force later this year.

Justice Minister Charlie Flanagan and department officials have confirmed that while private companies will face fines of up to €20m or 4% of a company’s income for misusing personal information under the new rules, the same standards will not apply to the public sector.

Under new laws set to be enacted in early summer, data protection rights in Ireland and other countries will be significantly increased in order to protect the general public from having their information stolen, resold without their knowledge, or misused online.

The new law, which will be included in the Data Protection Bill 2018 and is linked to the recently announced EU general data protection regulation, is designed to help ensure an individual’s personal information remains safe online.

Speaking to reporters at Government Buildings yesterday, Mr Flanagan and Department of Justice officials said the new rules will allow the Data Protection Commissioner to impose fines of up to €20m or 4% of income on companies which misuse someone’s information without their consent.

However, despite the commissioner, Helen Dixon, specifically telling the Oireachtas communications committee last June she wanted this sanction to be extended to Government as well, it was confirmed last night the same standards will not apply to State bodies.

“This will be a matter of debate across the houses starting in the next couple of weeks,” Mr Flanagan told reporters yesterday.

“We are updating a 30-year old law here. There is provision for private sector fines but as far as the public sector is concerned, there will be further engagement as the debate proceeds.”

A spokesperson for the justice minister later confirmed the situation to the Irish Examiner, saying the argument for not including State bodies in the new rule is that they are already obliged to ensure someone’s information is protected and that imposing a fine on them will only mean money is taken from public funds.

However, despite the defence, the news is likely to be criticised by independent transparency and data protection bodies, with the Ms Dixon last June specifically telling the Oireachtas communications committee state bodies should be included in any new rules.