Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 24th November, 2020.

I, PASCHAL DONOHOE, Minister for Finance, in exercise of the powers conferred on me by section 60 (6) of the Data Protection Act 2018 (No. 7 of 2018), and having duly complied with subsections (9)(b) and (10) of section 60 of that Act, hereby make the following regulations with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House:

Citation and commencement

1. (1) These Regulations may be cited as the Data Protection Act 2018 (section 60(6)) (Central Bank of Ireland) Regulations 2020.

(2) These Regulations come into operation on 20 November 2020.

Definitions

2. In these Regulations—

“Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018);

“Act of 1942” means the Central Bank Act 1942 (No. 22 of 1942);

“Article 10 data” has the same meaning as it has in section 55 of the Act of 2018;

“Bank” means Central Bank of Ireland;

“deposit guarantee scheme” has the same meaning as it has in the European Union (Deposit Guarantee Schemes) Regulations 2015 ( S.I. No. 516 of 2015 );

“enactment” has the same meaning as it has in the Interpretation Act 2005 (No. 23 of 2005);

“financial service provider” has the same meaning as it has in the Act of 1942;

“financial services legislation” has the same meaning as it has in the Central Bank (Supervision and Enforcement) Act 2013 (No. 26 of 2013);

“regulated financial service provider” has the same meaning as it has in the Act of 1942;

“relevant function” shall be construed in accordance with Regulation 3;

“relevant objective” shall be construed in accordance with Regulation 4.

Relevant function - meaning

3. In these Regulations, “relevant function” means a function of the Bank under—

(a) financial services legislation,

(b) the Treaty on the Functioning of the European Union, or

(c) the Statute of the European System of Central Banks and of the European Central Bank,

which relates directly or indirectly to one or more of the following:

(i) monetary policy;

(ii) contributing to the stability of the financial system;

(iii) protecting the best interests of consumers of financial services;

(iv) regulating financial service providers;

(v) regulating financial markets;

(vi) supervising compliance with financial services legislation;

(vii) enforcing compliance with financial services legislation;

(viii) collecting information for analysis or statistical purposes;

(ix) resolution of regulated financial service providers;

(x) operating a deposit guarantee scheme or other compensation or customer protection scheme;

(xi) operating the Central Credit Register.

Relevant objective – meaning

4. In these Regulations, “relevant objective” means an objective—

(a) referred to in paragraph (b), (c), (d), (e), (f), (g), (i), (j), (k), (l) or (m) of section 60(7) of the Act of 2018, and

(b) pursued by the Bank in exercising a relevant function.

Scope: categories of personal data

5. These Regulations apply to personal data (including special categories of personal data and Article 10 data), in respect of which the Bank is the controller, processed by the Bank.

Scope: purpose of processing

6. These Regulations apply to the processing by the Bank of personal data to which these Regulations apply in the pursuit of a relevant objective.

Restriction

7. (1) The rights and obligations provided for in Articles 12 to 22 and Article 34, and Article 5 (in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22), of the Data Protection Regulation, in respect of processing to which these Regulations apply, are restricted to the extent that such a restriction is—

(a) necessary to safeguard a relevant objective, and

(b) proportionate to the need to safeguard that relevant objective,

including, but not limited to, where the exercise of the right or compliance with the obligation, as the case may be—

(i) may interfere with—

(I) the prevention, detection or investigation of breaches of, or enforcement of, financial services legislation,

(II) a process, procedure, investigation, inquiry, assessment, scheme, application or settlement being undertaken by the Bank, or

(III) proceedings pending or due before a court,

(ii) would disclose that the Bank is exercising a function in pursuit of a relevant objective, in a case in which such disclosure may prejudice the achievement of the relevant objective, or

(iii) would prevent the Bank processing personal data for a period of time, in a case in which any delay to the processing may prejudice the achievement of a relevant objective.

(2) Matters which are relevant, for the purposes of paragraph (1), in determining whether a restriction of a right or obligation is—

(a) necessary to safeguard a relevant objective, and

(b) proportionate to the need to safeguard that relevant objective,

include—

(i) the extent to which the exercise of the right or compliance with the obligation would prejudice the achievement by the Bank of that relevant objective,

(ii) the essence of the right to data protection of the data subject, and

(iii) the risks to the rights and freedoms of the data subject which may result from such a restriction.

Information to be provided where a right is restricted

8. (1) Where a right or obligation referred to in paragraph (1) of Regulation 7 is restricted in accordance with that paragraph, the Bank shall notify the data subject concerned in writing in a timely manner, unless so notifying the data subject may prejudice the achievement of a relevant objective.

(2) A notification under paragraph (1) shall inform the data subject concerned of the following:

(a) the right or obligation referred to in Regulation 7(1) affected by the restriction;

(b) whether the right or obligation concerned has been restricted in whole or in part;

(c) the reasons for the restriction, unless informing the data subject concerned of the reasons may prejudice the achievement of a relevant objective;

(d) that the data subject concerned may lodge a complaint with the Commission pursuant to Article 77(1) of the Data Protection Regulation;

(e) that the right referred to in subparagraph (d) is without prejudice to any other rights or remedies which the data subject concerned may have in relation to the Bank, including, but not limited to—

(i) judicial review of a decision of the Bank, and

(ii) the right to appeal a decision of the Bank pursuant to Part VIIA of the Act of 1942.

(3) Where requested by a data subject notified in accordance with paragraph (1), the Bank shall provide information on the policies and procedures referred to in Regulation 10(1) to the data subject.

Communication with data subject

9. The Bank shall ensure that all information provided to a data subject under or in relation to these Regulations is provided in a concise, intelligible and easily accessible form using clear and plain language.

Safeguards

10. (1) The Bank shall prepare and implement policies and procedures to provide for the matters referred to in Article 23(2)(d) and (f) of the Data Protection Regulation.

(2) Without prejudice to the generality of paragraph (1), the policies and procedures of the Bank referred to in that paragraph shall provide for the following:

(a) the use of secure storage, passwords, encryption and other methods to ensure personal data can only be accessed by persons authorised by the Bank to access that personal data;

(b) the use of controls to ensure that personal data is only disclosed to persons authorised by the Bank, or entitled or permitted by law, to receive that personal data;

(c) the determination of appropriate storage periods for personal data or classes of personal data;

(d) the treatment of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (c);

(e) data minimisation, including the use of anonymisation and pseudonymisation.

(3) The policies and procedures referred to in paragraph (1) shall be reviewed by the Bank on a regular basis and updated where the Bank considers it appropriate to do so.

Interaction with other law

11. The restriction referred to in paragraph (1) of Regulation 7 is in addition to and not in substitution for any restriction of the rights and obligations referred to in that paragraph under any other enactment or law of the European Union in operation.

Revocation

12. The Data Protection Act 2018 (section 60(6)) (Central Bank of Ireland) Regulations 2019 ( S.I. No. 537 of 2019 ) are revoked.

GIVEN under my Official Seal,

19 November, 2020.

PASCHAL DONOHOE,

Minister for Finance.

EXPLANATORY NOTE

(This note does not form part of the Instrument and does not purport to be a legal interpretation.)

These Regulations made under section 60(6) of the Data Protection Act 2018 , restrict in limited circumstances, the rights and obligations provided for in specific provisions of the General Data Protection Regulation (GDPR). These restrictions apply only where necessary, and proportionate to the need, to safeguard specified important objectives of general public interest pursued by the Central Bank of Ireland (“relevant objectives”) set out in these Regulations.

These relevant objectives include, for example, regulating financial service providers and markets, protecting the best interests of consumers of financial services, supervising or enforcing compliance with financial services legislation, carrying out monetary policy functions and contributing to the stability of the financial system.

By way of example, these restrictions could apply where the exercise of the right may interfere with the prevention, detection or investigation of breaches of, or the enforcement of compliance with, financial services legislation. The restrictions could also apply where, for example, the exercise of the right would disclose that the Central Bank of Ireland is carrying out certain tasks and such disclosure may prejudice the achievement of a relevant objective.

The essence of the right to data protection of data subjects and the risks to the rights and freedoms of data subjects that may result from a restriction are matters that are relevant in determining whether a restriction is necessary, and proportionate to the need, to safeguard a relevant objective. Furthermore, whether a restriction will apply will be considered on a case-by-case basis following an assessment of the relevant circumstances. Whether it is necessary and proportionate to restrict the right as a whole, or whether a partial restriction would suffice to safeguard a relevant objective, will also be considered.

Where a right or obligation is restricted in accordance with these Regulations, the Central Bank of Ireland is obliged to notify the data subject and provide the reasons for the restriction, unless to do so may prejudice the achievement of a relevant objective. A notification must inform the data subject of the right or obligation affected by the restriction, whether the restriction applies in whole or in part, the data subject’s statutory right to lodge a complaint with the Data Protection Commission and that such right is without prejudice to other specific rights or remedies which the data subject may have in relation to the Central Bank of Ireland.

These Regulations require the Central Bank of Ireland to have in place certain policies and procedures relating to safeguards to prevent abuse or unlawful access or transfer and the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing.

These Regulations also require the Central Bank of Ireland to ensure that all information provided in relation to these Regulations is provided in a clear, concise and accessible manner. In light of Article 38 and 39 of the GDPR (which relate to the position and tasks of data protection officers), the data protection officer of the Central Bank of Ireland will be involved in the operation of matters of relevance to the Central Bank of Ireland arising from these Regulations, including being consulted on the development and review of relevant policies and procedures.