Data protection issues in regulatory investigations Colin Rooney Partner, Technology and Innovation Group 20 October 2017

Introduction Law enforcement, regulators & courts voracious appetite for access to personal data Sometimes such data not held / controlled in same jurisdiction as regulator requesting it cross border issues Regulatory requests must navigate legal minefield

Compliance risk Compliance with request from regulatory authority for personal data could lead to breach of data protection rules Must assess sanctions for: breaching relevant data protection laws Against failing to comply with a request received from a regulatory authority Some thoughts on this follow…

Cross-border issues Foreign authorities requesting information held overseas Example: Microsoft Case Increasingly organisations resist exercise of extraterritorial jurisdiction by foreign courts and law enforcement agencies

Legal framework Europe Ireland General Data Protection Regulation (the “GDPR”) (date of implementation: 25 May 2018) Heads of Bill (General Scheme) DP Directive 95/46/EC Data Protection Acts 1988 and 2003

Relevant Laws Data Protection Acts 1988 and 2003 (“DPA”) Section 2(1) (c) of the DPA data controller shall not further process personal data (which includes disclosure to a third party) except in ways that are compatible with the purpose for which the data were obtained Section 8 of the DPA lifts the restriction on disclosure in certain circumstances individual's right to privacy is balanced against needs of civil society

Disclosures Section 8 of the Data Protection Acts 1988 and 2003 Section 8(a) "in the opinion of the Garda Siochana not below the rank of chief superintendent or an officer of the Permanent Defence Forces who holds an army rank not below colonel and is designated by the Minister for Defence under this paragraph, required for the purpose of safeguarding the security of the State" Section 8(b) "required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid" Section 8(c) "required in the interests of protecting the international relations of the State" Section 8(d) "required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property" Section 8(e) "required by or under any enactment or by a rule of law or order of a court" Section 8(f) "required for the purposes of obtaining legal advice or for the purposes of, or in the course of, legal proceedings in which the person making the disclosure is a party or a witness" Section 8(h) "made at the request or with the consent of the data subject or to a person acting on his behalf"

Guidance from Data Protection Commissioner’s Office Section 8(b) "required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax, duty or other moneys owed or payable to the State, a local authority or a health board, in any case in which the application of those restrictions would be likely to prejudice any of the matters aforesaid“ DPC Guidance: The individual's right to privacy must be balanced against the need to investigate offences and collect taxes effectively. If a data controller is approached by a law enforcement authority or by a tax collecting authority, which seeks to have personal data disclosed to it under this section of the Data Protection Act, it is a matter for the data controller: (i) to satisfy itself that the provisions of this section are met, for example by establishing the bona fides of the authority and by obtaining assurances that the disclosure is actually necessary, and not merely of side interest, for the investigation of an offence; and (ii) to decide whether or not to comply with the request for disclosure. While this section of the Data Protection Act lifts the restrictions on disclosure by a data controller to a law enforcement authority or to a tax collecting authority, this section does not impose any obligation on a data controller to comply with the request for disclosure. Section 8(e) "required by or under any enactment or by a rule of law or order of a court“ DPC Guidance: If you are under a legal obligation to disclose personal data, then this obligation takes precedence over the Data Protection Act's prohibition on disclosure. However, if you have a statutory discretion to make information available, matters are not so clear-cut. The Data Protection Commissioner has found, in the past, that a statutory discretion to make information available did not come within the scope of section 8(e) of the Data Protection Act, and that accordingly the restriction on disclosure of personal data remained in force.

Data protection issues to consider on receipt of a regulatory request

Further information Evaluate purpose of the request Seek further information from requesting regulatory authority

Powers Binding legal obligation to answer request? If so, to what extent binding? Legal ability to compel disclosure? If so, have the correct procedures been followed to make a binding demand? Necessary to ask the regulator / law enforcement authority to make a binding request?

Scope of the request Negotiate scope of request?   Sometimes regulators / law enforcement authorities will agree to narrow broadly defined requests so as to target specific information required for purposes of their investigations…

Anonymization and minimisation Limit data disclosed to that which is necessary for purpose (NB for GDPR) Redact personal data from documents before they are disclosed?

International disclosure Can data be transferred via a domestic authority? Can domestic court compel disclosure of documents pursuant to Hague Convention?

Data processing agreement Is recipient acting as a data processor? Is it necessary to put in place a data processing agreement? only to process data in accordance with the instructions of the company (as data controller)   implement sufficient technical and organisational security measures to protect the personal data.

Thank you for your time today. colin.rooney@arthurcox.com 20 October 2017