Tánaiste, Leo Varadkar TD, Department of Enterprise, Trade and Employment, Kildare Street, 2

24 September 2020

Ref: Schrems II ruling puts recovery at risk

Dear Tánaiste, I am writing to you regarding recent developments within the field of international data transfers following the Schrems II judgement1. Ibec members are concerned that the consequences of the Schrems II ruling of the European Court of Justice (ECJ) will have a significant negative impact on the Irish economy and add to the business sector’s concerns pre-.

In its judgement of 16 July, 2020, the ECJ declared the EU Commission’s adequacy decision on the transfer of personal data to the USA (EU-US Privacy Shield) invalid. Since then, the situation has become even more urgent as a result of recent developments which have raised questions about the validity of Standard Contractual Clauses (SCCs).

This is not just an issue for the digital sector – data is helping to boost competitiveness and deliver services across a range of industries from manufacturing to healthcare. Data flows are as vital to our digital-driven economy as electricity. Being able to effectively comply with the ruling is of critical importance to Ibec members. However, the ruling’s legal, organisational, and technological implications and a lack of sufficient guidance make it difficult, at present, for companies to have absolute confidence that efforts to comply will be sufficient.

As a result, there is a significant legal risk for companies, both large and small – either controllers or processors who are dependent on data transfers to the USA. The same applies to data transmission to other third countries for which there are no adequacy decisions (e.g. India). In addition, the UK would also be considered a third country post Brexit and this adds further disruption to Ibec member companies at an already difficult time.

To eliminate the existing legal uncertainty and to ensure that Irish businesses that rely on international data transfers can continue to operate, we recommend:

• The Irish Government take a public leadership position on this issue at European Council level and work with the EU Commission to negotiate an effective follow-up instrument to the Privacy Shield with the US authorities as quickly as possible and to identify interim solutions which will allow companies to continue to transfer data until such an instrument is in place.

1 Case C-311/18 - Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems

• To acknowledge the importance for Standard Contractual Clauses to remain valid and to engage with all efforts to secure harmonised guidelines on supplementary measures from the European Data Protection Board.

• The formation of an Irish ‘Digital and Data Forum’ coordinated through your office which would bring together all stakeholders to engage on this and other such related issues in a timely manner.

In view of the considerable legal uncertainty, we ask you to act quickly and remain at your disposal to discuss in more detail.

Kind regards,

______Danny McCoy Ibec CEO

Cc: Minister for Justice, Helen McEntee