S.I. No. 734/2024 - European Union (Data Governance Act) (No. 2) Regulations 2024

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 31st December, 2024.

The Minister for the Environment, Climate and Communications, in exercise of the powers conferred on him by section 3 of the European Communities Act 1972 (No. 27 of 1972) and for the purposes of giving full effect to Chapters III, IV, V, VII and IX of Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022¹ , hereby make the following regulations:

Citation

1.

Definitions

2.

“Act of 2014” means the Competition and Consumer Protection Act 2014 (No. 29 of 2014);

“authorised officer” has the same meaning as it has in the Act of 2014;

“competent authority” means the body designated as the competent authority under Regulation 3;

“contravention notice” means a notice under Regulation 10(1);

“EU Regulation” means Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act)¹ ;

“information notice” means a notice under Regulation 9(1);

“register” means the register established pursuant to Regulation 6(1).

• (2) A word or expression used in these Regulations and which is also used in the EU Regulation has, unless the context otherwise requires, the same meaning in these Regulations as it has in the EU Regulation.

Competent authority

3.

• (a) data intermediation services, and

• (b) the registration of data altruism organisations.

Legal representative

4.

• (2) The competent authority may address the legal representative in addition to or instead of the data intermediation services provider or the entity concerned for the purposes of monitoring and ensuring compliance with the EU Regulation and these Regulations, including for the purpose of initiating proceedings under these Regulations.

Notification for data intermediation services

5.

• (2) If the notification under paragraph (1) does not contain the information specified in Article 11(6) of the EU Regulation, the competent authority may request the applicant to submit such additional information, as the competent authority considers necessary, within the period and in the manner specified by the competent authority.

Register for recognised data altruism organisations

6.

• (2) An entity that meets the requirements of Article 18 of the EU Regulation may submit an application to the competent authority for entry in the register.

• (3) An application referred to in paragraph (2) shall contain the information specified in Article 19(4) of the EU Regulation and be in such form and manner as the competent authority may specify.

• (4) If an application for entry in the register does not contain the information referred to in Article 19(4) of the EU Regulation or if further documentation is required to demonstrate that the requirements of Article 18 of the EU Regulation are satisfied, the competent authority may request the applicant to submit such additional information, as the competent authority considers necessary, within the period and in the manner specified by the competent authority.

• (5) The competent authority shall, no later than 12 weeks after the date of receipt of an application under paragraph (2) or the date of receipt of additional information pursuant to a request under paragraph (4), whichever occurs later, give notice to the applicant of its decision to –

• (a) enter the data altruism organisation in the register where it satisfies the requirements of Article 18 of the EU Regulation, or

• (b) refuse the application for entry in the register.

• (6) Where the competent authority makes a decision under paragraph (5)(b), the notice shall inform the person of –

• (a) the reason for the refusal, and

• (b) the right to appeal the notice under Regulation 12.

• (7) The register shall be published on a website maintained by or on behalf of the competent authority.

• (8) A recognised data altruism organisation shall, not later than 30 June each year, prepare and furnish an annual activity report in accordance with Article 20(2) of the EU Regulation to the competent authority in respect of the previous year.

Objectives of general interest

7.

• (a) the improvement of health, whether of the population as a whole or of any part of the population;

• (b) the promotion of environmental sustainability, combating or adapting to climate change or conserving or enhancing the natural environment;

• (c) the improvement of transport or mobility of people and goods;

• (d) the development of official statistics (within the meaning of the Statistics Act 1993 (No. 21 of 1993));

• (e) the improvement of public services;

• (f) the advancement of the arts, culture, heritage or science, including scientific research;

• (g) the advancement of community development and welfare, including education, social cohesion and support of those with needs associated with youth, older age, migration status, ill-health or disability;

• (h) any other objective that is of benefit to the community, society or the natural or physical environment.

Construction of references

8.

Information notice

9.

• (2) An information notice shall –

• (a) state the reason for the notice,

• (b) inform the person of the right to appeal the notice under Regulation 12,

• (c) state that if the person to whom it is given fails to comply with the notice, that person commits an offence, and

• (d) be signed and dated by the authorised officer.

• (3) A person to whom an information notice is given may appeal the notice under Regulation 12.

• (4) The authorised officer may –

• (a) withdraw or amend an information notice at any time, or

• (b) where no appeal is made or pending under Regulation 12, extend the period specified under paragraph (1).

• (5) Where an appeal under Regulation 12 is made, and the information notice is not cancelled, the notice as confirmed or varied shall take effect on the later of –

• (a) the day next following the day on which the notice is confirmed or varied on appeal or the appeal is withdrawn, or

• (b) the day specified in the notice.

• (6) Where there is no appeal under Regulation 12, the information notice shall take effect on the later of –

• (a) the expiration of the period for making an appeal, or

• (b) the day specified in the notice.

Contravention notice

10.

• (2) Subject to paragraph (10), an authorised officer shall, before giving the contravention notice, give notice of the proposal to the person and that notice shall contain a statement in summary form of the opinion of the authorised officer and a statement that the person may, within 30 days of receipt of the notice, make representations in writing to the authorised officer in relation to the proposal, and any such representations within that period shall be considered by the authorised officer in deciding whether to give the contravention notice.

• (3) A contravention notice shall –

• (a) state the reason for the opinion referred to in paragraph (1),

• (b) identify the provision of the EU Regulation or these Regulations in respect of which the opinion is held,

• (c) direct the person to remedy the contravention by a date specified in the notice that shall not be earlier than the expiration of the period for making an appeal under Regulation 12,

• (d) inform the person of the requirement to confirm compliance with the contravention notice in accordance with paragraph (6),

• (e) inform the person of the right to appeal the contravention notice under Regulation 12,

• (f) include any other requirement that the competent authority considers appropriate in order to remedy the contravention,

• (g) be signed and dated by the authorised officer,

• (h) state that if the person to whom it is given fails to comply with the contravention notice, that person commits an offence, and

• (i) state, where the person to whom it is given is a recognised data altruism organisation, that if he or she fails to comply with the contravention notice, the competent authority may take the action specified in Regulation 11(1).

• (4) A contravention notice may, in the case that it is given to a data intermediation services provider, include a direction to –

• (a) postpone the commencement of the provision of the data intermediation service,

• (b) suspend the provision of the data intermediation service, or

• (c) cease the provision of the data intermediation service in the case of a serious contravention or where the provider has failed to comply with an earlier contravention notice.

• (5) A person to whom a contravention notice is given shall comply with the notice.

• (6) A person to whom a contravention notice is given who is of the opinion that the contravention notice has been complied with shall confirm such compliance in writing to the authorised officer concerned.

• (7) Where a person to whom a contravention notice is given confirms compliance in accordance with paragraph (6), the authorised officer, on being satisfied that the person has complied with the notice, shall within one month of receipt of such confirmation, give notice to the person of compliance with the contravention notice.

• (8) A person to whom a contravention notice is given may appeal the notice under Regulation 12.

• (9) An authorised officer may –

• (a) withdraw or amend a contravention notice at any time, or

• (b) where no appeal is made or pending under Regulation 12, extend the period specified under paragraph (3)(c).

• (10) Where in the opinion of the authorised officer immediate action is necessary because of the gravity of the contravention with the requirements of the EU Regulation or these Regulations, the authorised officer may, notwithstanding paragraph (2), proceed to give the contravention notice to the person concerned.

• (11) Where an appeal under Regulation 12 is made, and the contravention notice is not cancelled, the notice as confirmed or varied shall take effect on the later of –

• (a) the day next following the day on which the notice is confirmed or varied on appeal or the appeal is withdrawn, or

• (b) the day specified in the notice.

• (12) Where there is no appeal under Regulation 12, the contravention notice shall take effect on the later of –

• (a) the expiration of the period for making an appeal, or

• (b) the day specified in the notice.

Removal from register

11.

• (a) revoke the organisation’s right to refer to itself as a recognised data altruism organisation in any communication from a date specified in the notice, and

• (b) remove the organisation from the register on a date specified in the notice.

• (2) The competent authority shall publish a decision made by it pursuant to paragraph (1)(a) on a website maintained by or on behalf of the competent authority.

Appeal

12.

• (a) a notice under Regulation 6(5)(b),

• (b) an information notice, or

• (c) a contravention notice,

may, within 21 days beginning on the day on which the notice is given, appeal against the notice to a judge of the Circuit Court and in determining the appeal the judge may, if he or she is satisfied that it is reasonable to do so, confirm, vary or cancel the notice.

• (2) A person who appeals under paragraph (1) shall, at the same time, give notice to the competent authority of the appeal and the grounds for the appeal and the competent authority shall be entitled to appear, be heard and adduce evidence at the hearing of the appeal.

• (3) A decision of the Circuit Court under paragraph (1) shall be final, save that, by leave of the High Court, an appeal from the decision shall lie to the High Court on a specified question of law.

Order of High Court to direct compliance with contravention notice

13.

• (2) The High Court may, upon an application under this Regulation, if satisfied that the person to whom the contravention notice is given has failed to comply with the notice, grant the order referred to in paragraph (1).

Complaints

14.

• (2) The competent authority shall consider a complaint made in accordance with paragraph (1) and may appoint an authorised officer to investigate the complaint.

• (3) An authorised officer may request a complainant to provide such additional information in relation to the complaint, within the period and in the manner specified in the request.

• (4) The competent authority shall by notice in writing inform the complainant –

• (a) of its decision in respect of the complaint and its actions, if any, taken in relation to the complaint, and

• (b) of the right to appeal under paragraph (6).

• (5) The competent authority may decide to reject a complaint where it believes on reasonable grounds that –

• (a) the complaint is frivolous or vexatious or was not made in good faith,

• (b) the subject matter of the complaint is trivial, or

• (c) the complainant has failed to respond to a request for additional information under paragraph (3).

• (6) The complainant may, within 21 days beginning on the day on which a notice is given under paragraph (4), appeal against the notice to a judge of the Circuit Court, on notice to the competent authority.

• (7) A decision of the Circuit Court under paragraph (6) shall be final, save that, by leave of the High Court, an appeal from the decision shall lie to the High Court on a specified question of law.

Co-operation agreements

15.

• (2) A co-operation agreement shall include provisions enabling each party to furnish to the other party information, including personal data (within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016² ), in its possession if the information is required by that other party for the purposes of the performance by it of any of its functions.

• (3) If the competent authority enters into an agreement under this Regulation, the competent authority –

• (a) shall provide a copy of the agreement to the Minister for the Environment, Climate and Communications and the Minister for Enterprise, Trade and Employment, and

• (b) may publish the agreement on a website maintained by or on behalf of the competent authority, with the consent of all parties to the agreement and subject to such redaction as may be agreed between them.

• (4) In this regulation, “body” means each of the following:

• (a) the Data Protection Commission;

• (b) the National Cyber Security Centre (within the Department of Environment, Climate and Communications);

• (c) a body designated as competent authority in another Member State for the purposes of the EU Regulation.

Service of notices

16.

• (a) by delivering it to the person;

• (b) by leaving it at the address at which the person carries on business or ordinarily resides or, in a case in which an address for service has been furnished, at that address;

• (c) by sending it by post in a prepaid registered letter to the address at which the person carries on business or ordinarily resides or, in a case in which an address for service has been furnished, to that address;

• (d) by electronic means, in a case in which the person has given notice in writing to the person giving the notice concerned of his or her consent to the notice (or notices of a class to which the notice belongs) being given to him or her in that manner.

• (2) For the purposes of this Regulation, a company formed and registered under the Companies Act 2014 or an existing company within the meaning of that Act shall be deemed to be ordinarily resident at its registered office and every other body corporate and every unincorporated body of persons shall be deemed to be ordinarily resident at its principal office or place of business.

Offences and penalties

17.

• (a) paragraphs (1), (3), (12) or (13) of Article 11 of the EU Regulation;

• (b) Article 12 of the EU Regulation;

• (c) Article 18 of the EU Regulation;

• (d) paragraphs (3) or (7) of Article 19 of the EU Regulation;

• (e) Article 20(1) of the EU Regulation;

• (f) any paragraph of Article 21 of the EU Regulation;

• (g) paragraphs (1), (3), (4) or (5) of Article 31 of the EU Regulation in so far as it relates to a data intermediation services provider or a recognised data altruism organisation;

• (h) an information notice within the period specified in the notice;

• (i) a contravention notice within the period specified in the notice.

• (2) Where the Commission has established a rulebook pursuant to Article 22 of the EU Regulation by delegated act, a person who contravenes the requirements of that rulebook shall be guilty of an offence.

• (3) A recognised data altruism organisation that fails to comply with Regulation 6(8) shall be guilty of an offence.

• (4) It shall be an offence for an organisation that is not a recognised data altruism organisation to refer to itself as such.

• (5) A person who provides to an authorised officer or to the competent authority information which the person knows or ought reasonably to know to be false or misleading (whether on the person’s own behalf or on behalf of another person) in purported compliance with a requirement imposed by these Regulations, commits an offence.

• (6) A person convicted of an offence under paragraph (1), (2), (3), (4) or (5) is liable –

• (a) on summary conviction, to a class A fine, or imprisonment for a term not exceeding 6 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €500,000 or imprisonment for a term not exceeding 3 years or both.

• (7) If the contravention in respect of which a data intermediation services provider is convicted of an offence under paragraph (1)(i) is continued after the conviction, the person shall be guilty of a further offence on every day on which the contravention continues and for each such offence the person shall be liable, on summary conviction, to a class E fine.

• (8) Summary proceedings for an offence under this Regulation may be brought and prosecuted by the competent authority.

• (9) Notwithstanding section 10 (4) of the Petty Sessions (Ireland) Act 1851 , summary proceedings for an offence under this Regulation may be brought –

• (a) within 12 months from the date on which the offence was committed or alleged to have been committed, or

• (b) within 6 months from the date on which evidence first comes to the knowledge of the competent authority that is sufficient, in the opinion of the competent authority, to justify the bringing of the proceedings,

whichever is the later, but no such proceedings shall be instituted later than 2 years from the date on which the offence was committed or alleged to have been committed.

• (10) For the purposes of paragraph (9)(b), a document purporting to have been issued by the competent authority certifying the date on which the evidence described in that paragraph first came to the knowledge of the competent authority –

• (a) is admissible without proof of the signature or official character of the person appearing to have signed the document, and

• (b) in the absence of evidence to the contrary, is proof of the matters certified in the document.

• (11) Where an offence under these Regulations is committed by a body corporate and is proved to have been so committed with the consent or connivance of or to be attributable to any neglect on the part of any person, being a director, manager, secretary or other officer of the body corporate, or a person who was purporting to act in such capacity, that person shall, as well as the body corporate, be guilty of an offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first mentioned offence.

• (12) Where the affairs of a body corporate are managed by its members, paragraph (11) applies in relation to the acts and defaults of a member in connection with his or her functions of management as if he or she were a director or manager of the body corporate.

• (13) Where an offence is committed under these Regulations and there is a legal representative in the State, proceedings may be brought in the area in which the legal representative ordinarily resides or carries on any profession, business or occupation.

GIVEN under the Official Seal of the Minister for the Environment, Climate and Communications,

19 December, 2024.

EAMON RYAN,

Minister for the Environment,

Climate and Communications.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These Regulations give effect to provisions in Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act). In particular, they establish a framework for the registration and oversight of data intermediation services providers described in Article 10 and data altruism organisations described in Article 18 of the EU Regulation.

Footnotes