Enacted on 21st July 2022 and intended to amend existing data retention law to address the impact of recent EU case law specific to the general and indiscriminate retention of data.
What are the main changes?
The 2022 (Amendment) Act overhauls the scope and application of the retention and access regime in the Communications (Retention of Data) Act 2011 (2011 Act). The commencement date has not been published. In summary, the changes:
Introduces two new separate categories of data - user data and internet source data - data relating to the civil identity of users’ and ‘IP addresses assigned to the source of an internet connection’. These are less sensitive categories of data and their retention for both national security and other purposes is not precluded by the Court of Justice rulings. The categories of traffic and location data contained in Schedule 2 of the 2011 Act (Schedule 2 data) are unchanged.
Obligates the general and indiscriminate retention of user data (previously subscriber data) and internet source data for a default period of 1 year. The Minister may order a different period of up to two years on the basis of combatting crime, safeguarding State security, protecting life and safety of persons or locating missing persons.
Provides for the Minister to apply to the High Court, on the basis of a threat to State security (which is deemed to be serious and genuine, present or foreseeable), for an order requiring the general and indiscriminate retention of Schedule 2 data for up to 12 months.
Sets out new measures by which applications are to be made by An Garda Síochána and other competent authorities to a District Court judge for orders to disclose Schedule 2 data and internet source data. There is no obligation to apply to the District Court for the disclosure of user data.
Provides for An Garda Síochána and other competent bodies to apply to a District Court Judge for preservation and production orders regarding certain Schedule 2 data on the basis of combatting serious crime, safeguarding State security, protecting life and safety of persons or locating missing persons.
Makes provision for cases of urgency, where applications can be made to the District Court after temporary orders have been issued.
Introduces, for the first time, offences for non-compliance, with penalties of up to €500k and 5 years imprisonment and notification of data subjects (serious crime only), a notice in writing informing him or her of the disclosure of the data concerned.
What next
The Minister will make commencement orders in relation to the 2022 Act and has also indicated her intention to bring forward a more comprehensive proposal later in the year to address wider reforms and a more consolidated legal framework in this area, without giving further details.
Read more here.
For guidance on preparing for compliance, please contact our expert team @ privacy@itrustethics.ie to learn more about our 8-Step Preparedness Plan.
The content of this insight is provided for information purposes only and does not constitute legal or other advice.