Transferring Personal Data Abroad

Schools/ETBs do not frequently engage in transferring personal data abroad. However they do need to consider this, for example, where a school contracts an external company to store archived records electronically.

Section 11 of the Data Protection Acts 1988 and 2003 specify conditions that must be met before personal data may be transferred to third countries. Organisations that transfer personal data from Ireland to third countries – i.e. places outside of the European Economic Area (EEA) – will need to ensure that the country in question provides an adequate level of data protection. Some third countries have been approved for this purpose by the EU Commission.
The adequacy decision of the European Commission which underpinned the US 'Safe Harbour' arrangement has now been invalidated by a decision of the Court of Justice of the European Union of 06 October 2015 (Case C-362/14). Consequently, it is no longer lawful to make transfers on the basis of the EU-US Safe Harbour framework.

Section 11 of the Data Protection Acts 1988 and 2003 specify conditions that must be met before personal data may be transferred to ‘third countries’. A "third country" is a country outside of the European Economic Area (EEA).