The European Commission has described as “unfounded” claims that it does not collect sufficient information to monitor the implementation of data protection rules in Ireland.
It has also called on data authorities to ramp up and amplify their enforcement actions in the coming months and years.
The Commission has issued a reply to the office of the EU Ombudsman after it opened an inquiry into the monitoring of Ireland’s application of the General Data Protection Regulation (GDPR).
GDPR is an EU regulation that came into effect in May 2018 which imposes strict requirements on the collection, use and storage of personal data.
EU Ombudsman Emily O’Reilly (pictured below) launched the investigation in February following a complaint to her office from Dr Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties.
He had expressed concerns about the Commission’s monitoring of Ireland’s application of GDPR.
“Public bodies, along with civil society organisations, report that the application of the GDPR in Ireland is inadequate, whereas the commission’s recent reply to the complainant in this case appears to suggest that there is no evidence of this,” Ms O’Reilly said in a letter to European Commission President Ursula von der Leyen when she launched her inquiry.
Ms O’Reilly said that questions were bound to arise in the minds of citizens if different factual accounts were circulating regarding the implementation of GDPR.
In its response today, the European Commission said it attaches particular importance to the proper implementation of the EU’s regulations in all member states.
“Since the entry into force of the GDPR, the Commission has maintained close contacts with the various actors and stakeholders involved in the GDPR,” EU Commissioner Didier Reynders said in his reply to the EU Ombudsman.
The Commission said it agreed with the complainant that enforcement by data protection authorities, notably by that of Ireland, is essential and that this is why it has consistently called on data protection authorities to ramp up their enforcement actions.
“The positive trend seen in 2021, with several high-profile cases resulting in significant fines, has to be pursued and amplified in the coming months and years,” Mr Reynders wrote.
The Commission said if it came to the conclusion that members states were not properly implementing their obligations then it would take all necessary measures, including launching infringement procedures, which it has done in the past.
The complainant, Dr Ryan, issued a response to the Commission’s reply, saying its presentation of the facts was manifestly wrong and that the information sources it cited were irrelevant or inadequate.
“The Commission has not taken adequate steps to collect the necessary information, or to examine the information it receives,” Dr Ryan wrote in his reply.
The EU Ombudsman’s office will now begin its own analysis of the European Commission’s response before deciding on the next steps in the inquiry.