European Union (Enforcement of data subjectsâ rights on transfer of personal data outside the European Union) Regulations 2021.
Statutory Instruments
Source: Statutory Instruments

num: 1
paragraphs: These Regulations may be cited as the European Union (Enforcement of data subjects’ rights on transfer of personal data outside the European Union) Regulations 2021.
num: 2
paragraphs: The Data Protection Act 2018 (No. 7 of 2018) is amended by the insertion of the following section after section 117:
117A. (1) This section applies to a transfer of personal data by a controller or processor to a third country or an international organisation pursuant to Article 46 where the transfer is subject to appropriate safeguards provided for in the rules or clauses (in this section referred to as “relevant instruments”) set out in subsection (5).
(2) Without prejudice to any other remedy available to him or her, including his or her right to bring an action under section 117 or to lodge a complaint, a data subject whose personal data is included in a transfer referred to in subsection (1) may, where the transfer is subject to appropriate safeguards set out in a relevant instrument, enforce-
(a) any rights (whether described as third party beneficiary rights or otherwise) conferred on data subjects by, or any clauses or rules expressed to be for the benefit of data subjects in, the instrument concerned, and
(b) where that transfer is subject to any additional safeguards conferring rights on data subjects, those rights.
(3) An action to enforce any rights conferred on data subjects or any clauses or rules expressed to be for the benefit of data subjects referred to in subsection (2) shall be deemed to be an action founded on contract.
(4) Subsections (3) to (10) of section 117 shall apply to an action taken by a data subject under this section subject to the following modifications:
(a) a reference in those subsections to a data protection action shall be taken to be a reference to an action under this section,
(b) the reference in subsection (5) to the limit of that court’s jurisdiction in tort shall be taken to be a reference to the limit of that court’s jurisdiction in contract, and
(c) the reference in subsections (4)(b) and (8)(b) to compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment shall be taken to be a reference to compensation for damage suffered by the plaintiff as a result of the infringement of the relevant instrument.
(5) The relevant instruments are:
(a) binding corporate rules approved in accordance with Article 47;
(b) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
(c) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
(d) contractual clauses authorised by a supervisory authority pursuant to Article 46(3)(a);
(e) standard contractual clauses which are the subject of a decision adopted by the Commission in accordance with Article 26(4) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 19952 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.”.