Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I remind members that all mobile phones must be switched off as they interfere with the recording and broadcasting equipment.

We are resuming consideration of Committee Stage of the Data Protection Bill 2018. I welcome the Minister for Justice and Equality, Deputy Charles Flanagan, and his officials. We will endeavour to conclude Committee Stage this evening, if at all possible.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 50, 51 and 65 are related and may be discussed together.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 50:

In page 28, between lines 35 and 36, to insert the following:“Communication with data subjects by political parties, candidates for and holders of certain elective political offices

38. (1) A specified person may, in the course of that person’s electoral activities in the State, use the personal data of a data subject for the purpose of communicating in writing (including by way of newsletter or circular) with the data subject.

(2) Communicating in accordance with subsection (1) shall, for the purposes of Article 6(1)(e), be considered to be the performance of a task carried out in the public interest.

(3) In this section, “specified person” means—

(a) a political party,

(b) a member of either House of the Oireachtas, the European Parliament or a local authority, or

(c) a candidate for election to the office of President of Ireland or for membership of either House of the Oireachtas, the European Parliament or a local authority.

(4) In this section and in sections 45, 55 and 56, “electoral activities” includes the dissemination of information, including information as to a person’s activities and policies, that might reasonably be of interest to electors.”.

During the debate on Second Stage I stated that I was minded to introduce new provisions to put in place a robust legal basis for the making of representations by Members of the Houses of the Oireachtas and members of local authorities. Assisting constituents by making representations and requests on their behalf is a valuable as well as a time-honoured aspect of our democratic system. Amendment No. 50 introduces a new section that will facilitate specified persons in using personal data in the course of their electoral activities in the State for the purpose of communicating with data subjects. Under subsection (2), such communication is considered to be the performance of a task being carried out in the public interest.

Amendment No. 51 introduces a new section that will provide a robust legal basis for the making of representations on behalf of individuals. Where special categories of personal data are involved, subsection (3) will require that measures to limit access to the data be taken in order to prevent unauthorised consultation, alteration, disclosure or even erasure of data. Subsection (4) establishes a legal basis for responding to representations and requests received by public authorities and public bodies from elected representatives on behalf of data subjects.

The amendments cover the subject matter of amendment No. 65 tabled by Deputy Jim O'Callaghan. An issue that remains under consideration in my Department and the Department of Housing, Planning and Local Government is the extent to which the Electoral Acts may need to be looked at and tweaked. If necessary, I will table an appropriate amendment on Report Stage in that regard. I am in consultation with the Department of Housing, Planning and Local Government.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

These amendments are a sop to politicians who are freaked out by the potential implications of the GDPR and are overstating them. Under the GDPR, the legitimate interest of communicating with constituents is covered but we are trying to say that any communication by a politician is in the public interest, which is a stretch, given some of the bile that is foisted on householders by politicians claiming that it is in the public interest. It is not necessary. The British authorities had something like amendment No. 50. I will not make a big deal about it here. My point is that political work is covered by "legitimate interest" and we do not need this extra clause. It is a stretch to say that some of the stuff that is sent out by politicians or would-be politicians is in the public interest because it is only in the interests of them getting re-elected.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I will not repeat that. That is exactly what I was going to say. The GDPR covers this. I do not know if this is necessary but it may not do any great harm. If people accept and consent to their data being used, provided it is stored safely and securely, that seems to be in compliance with the GDPR.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I welcome what Deputies have said. I take Deputy Daly's point though I do not particularly agree with it. She says she does not agree with it but feels it is not necessary. That is the point raised by Deputy Ó Laoghaire too. I make the point, which the amendment covers, regarding the need to ensure that public representatives continue to do what is an important part of our duty. It is fair to say that it is within the public interest to make representations but I wonder about the respondent - the person or body to which the representation is made - and whether that might be regarded in the same way as we would. The amendment is important. I acknowledge what Deputy O'Callaghan said. If there are further issues which are not immediately apparent now that might be covered in amendment No. 65, then it is open to us all to come back on Report Stage. I acknowledge the importance of these amendments and welcome, if not the support, then the lack of opposition.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 51:

In page 28, between lines 35 and 36, to insert the following:“Processing of personal data and special categories of personal data by elected representatives

38.(1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.

(2) A person may make a request or representation on behalf of a data subject where the data subject—

(a) has given his or her consent to the making of the request or representation, as the case may be, or

(b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

(3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

(4) For the purpose referred to in subsection (1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation.

(5) In this section, “elected representative” means—

(a) a member of either House of the Oireachtas,

(b) a member of the European Parliament,

(c) a member of a local authority.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 52 to 56, inclusive, are being taken together. I invite Deputies Daly and Wallace to address these amendments.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 52:

In page 29, line 2, to delete “and special categories of personal data”.

Much of the wording of section 38 is taken directly from the GDPR. I still think we have reason to be concerned about what the section might permit. Article 23 of the GDPR is the relevant part. It does not make an explicit distinction between the processing of personal and special categories of data but, throughout the GDPR, we are told that special categories of data should be treated with special care, hence we are attempting to separate it in amendment No. 56 and in the related amendments, for example, amendment No. 52, separating the two categories of data, personal data and "special categories of personal data".

I accept that Article 23 of the GDPR refers to the prevention, investigation, detection and prosecution of criminal offences, which is inserted in the Bill in section 38(b). The problem these amendments try to address relates to the scope the word "preventing" introduces with regard to criminal offences, particularly relating to special categories of personal data, such as religious beliefs, political opinion, ethnicity and so on. Section 38 of the Bill is not part of Part 5 of the Bill, which relates to processing of personal data for law enforcement purposes. The processing of data referred to in section 38 does not apply to An Garda Síochána, for example. The kind of processing proposed in section 38 might well be done by private companies. Section 38 essentially permits racial profiling if we include the processing of special categories of data. A body other than the Garda, for example, can profile a person based on ethnicity, religion and political opinions in the name of preventing, in the broadest sense, a criminal offence.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

The last amendment is listed as being in section 39. It is actually section 38, as the line numbers would indicate. Under the GDPR in general, processing of personal data for purposes other than that for which it was initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were collected in the first place. In other words, if one gives Twitter one's phone number to verify when one is connecting from a different device, it cannot start ringing that person about other stuff. That is straightforward but there is some wriggle room according to Recital 50, on processing for purposes which are incompatible with the basis on which the data were initially collected. That can be allowed in two circumstances. First, where somebody gives consent for that to happen and, second, when the "processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest".

Section 38 tries to give effect to this wriggle room but it goes a little too far because it allows for the processing of both sensitive categories of data, including the serious stuff about political opinions, sexual orientation and so on, and the general personal data, for reasons other than the purposes for which it was collected, in order to prevent a threat to national security, to prevent, investigate or prosecute crimes and for getting legal advice and legal proceedings.

In amendments Nos. 52, 53 and 55, we are proposing that further processing of personal data would be lawful for all of those reasons with the tweak that, rather than it being for preventing crime, we would use the tighter wording of "avoiding prejudicing the prevention" of crime. There is a further small tweak in amendment No. 53, that further processing would be allowed only if "having regard to the fundamental rights and legitimate interests of the data subject". It is necessary and proportionate for various crime and terror-fighting purposes.

The wording for our first amendment is taken from the British wording and our second amendment is a balancing requirement.

In amendment No. 56 we propose that further processing of very sensitive data would be permitted for all of the aforementioned except the prevention for crime. Our reason is that the GDPR does not apply to competent authorities like the Garda. What section 38 asks us to prove is a right for public bodies or companies to collect or compile databases on things like people's political opinions, trade union membership, religious beliefs and so on for the purposes of preventing crime, which is a bit broad.

For example, the Irish Naturalisation and Immigration Service, INIS, has loads of documentation and data about people. Let us say the Garda says there is crime afoot, they think it is linked to an area where there is a higher concentration of immigrants, for example, and want to hoover up all of the data, closed circuit television, CCTV, surveillance and so on that is linked to an immigrant community in a particular area. That is racial profiling. It is very hard to see how information held by private companies or public bodies would be so important to prevent a crime yet outweigh the balance of people's individual rights and so on. That is where my colleague and I are coming from.

On balance, other information about political opinions could be important. Let us say there was an urgent situation to prevent a threat to public security and a bunch of neo-Nazis threatened to set off a bomb in Dublin and the Garda needed to get information from a social media site, such a situation would not be hampered by our amendments. I wish to stress that our amendments do not prevent the reuse of personal data in general, just special category data. Names, phone numbers, addresses, emails and all of that can still be reused for a crime prevention aim. We do not seek to stop that but we want to prevent the more personal and sensitive information being abused.

We think the terminology “avoiding prejudicing the prevention, investigation or prosecution of” is stronger. Again, our amendment is based on the British wording. Anybody can say something is for the prevention of crime. A controversial CCTV scheme is being introduced on that basis even though there is no evidence that extra crime has taken place in that area. If there is an immediate incident of a likelihood of crime, then that is a different situation. I have outlined our motivation for tabling our amendments.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 54 is a ministerial amendment and all of the other amendments were tabled by Deputies Clare Daly and Mick Wallace. I wish to advise everyone that if the question on amendment No. 54 is agreed, then amendment No. 55 cannot be moved as one is an alternative to the other.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Amendment No. 54 is merely a drafting amendment that seeks to insert the word "detecting" after the word "preventing", which will have the effect of bringing the wording into line with provisions elsewhere in the Bill. I note the point made by the Chairman regarding amendments Nos. 54 and 55. In any event, I am unable to accept amendments Nos. 52, 53, 55 and 56 and I shall give my reasons.

Amendment No. 53, in section 38, has a provision for the processing of personal data for certain public interest purposes for which the data were originally collected but only to the extent that such processing is necessary for and proportionate to the purpose, and that acts very much as a restrictor. The position is as follows. Statutory provisions that permit, or require, further notification or disclosure of personal data are to be found right across the Acts of the Oireachtas.

Let me give a brief example. Section 42 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 refers to a range of designated persons such as financial institutions, auditors and property service providers who know, may suspect or may have reasonable grounds to suspect, on the basis of information that they have that another person has been or is engaged in an offence of money laundering or terrorist financing. Of course there is an obligation that such knowledge or suspicion on those grounds be reported not only to the Garda but also to Revenue.

Under sections 2 and 3 of the Criminal Justice (Withholding of Information on Offences against Children and Vulnerable Persons) Act 2012, it is an offence to withhold any information on offences referred to in that Act. The Children First Act 2015 requires a range of mandated persons, including health practitioners, teachers and youth workers, who know, believe or suspect that a child has been harmed, is being harmed or, indeed, is at risk of being harmed, to report that to Tusla.

I am sure that committee members would agree that the public interest in such cases should not in any way be jeopardised or compromised. This section provides an effective and appropriate safeguard in the words "necessary and proportionate". I cannot accept the proposals in amendments Nos. 52 and 56 to remove the reference to special categories of personal data in section 38 and add a new section. Neither can I accept insertion of the words “having regard to the fundamental rights and legitimate interests of the data subject” as an addition in amendment No. 54, because this would place an additional burden on, for example, a youth worker reporting suspected harm to a child or perhaps even a bank official reporting his or her suspicion that certain transactions may from time to time be linked to money laundering or illegal activity.

I see where Deputy Daly is coming from but I think there are adequate safeguards. If I were to accept her amendments, I would be jeopardising long-standing obligations on persons.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 53:

In page 29, line 4, after “that” to insert “, having regard to the fundamental rights and legitimate interests of the data subject,”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 54:

In page 29, line 6, to delete “preventing, investigating” and substitute “preventing, detecting, investigating”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

As amendment No. 54 has been passed, amendment No. 55 cannot be moved.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 56:

In page 29, between lines 7 and 8, to insert the following:“Processing of special categories of personal data

39. Without prejudice to the processing of personal data for a purpose other than the purpose for which the data has been collected which is lawful under the Data Protection Regulation, the processing of special categories of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing is, having regard to the fundamental rights and legitimate interests of the data subject, necessary and proportionate for the purposes—

(a) of preventing a substantial threat to national security, defence, or public security,

(b) of avoiding prejudicing the investigation or prosecution of criminal offences,

(c) set out in paragraphs (a) or (b) of section 44.”.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 57:

In page 30, between lines 2 and 3, to insert the following:"Application to access data

41.(1) No application to access data processed for journalistic purposes may be made by any party, including, for the avoidance of doubt, an authorised officer, An Garda Síochána, the Garda Síochána Ombudsman Commissioner, the Revenue Commissioners or the Defence Forces, except by way of application to the High Court by motion and affidavit and on notice to the journalist data processor.

(2) In determining whether to allow access to data processed for journalistic purposes, the High Court shall have regard to the importance of freedom of expression in a democratic society and to the importance of confidential sources of information to the right of freedom of expression.

(3) The High Court may permit access to data processed for journalistic purposes, including for the purpose of identifying confidential sources of information, only where the journalist processor whose data is sought is the subject of investigation for suspected commission of a serious criminal offence or for unlawful activity which poses a serious threat to the security of the State.

(4) (a) In exceptional cases, where the security of the State is under immediate threat or where it is suspected that a serious criminal offence is likely to be committed in the immediate future, an application may be madeex parteto the High Court for access to data processed for journalistic purposes.

(b) Where an ex parteapplication under this section is made, the journalist processor whose data is the subject of the application shall be notified of the application by, and given the opportunity to make representations before, the High Court as soon as practicable.

(5) An appeal shall, by leave of the High Court, lie from a determination of that Court under this section on a question of law to the Court of Appeal.".

This is a matter of concern for several organisations such as the Irish chapter of the National Union of Journalists, NUJ, and the Irish Council of Civil Liberties, ICCL. The committee had a lengthy discussion recently on the importance of independent journalism, journalists' sources and their importance for the functioning of a democratic society. There are many discussions in the public domain about recent data breaches in significant media outlets in this State that have caused a lot of concern about potential interference with journalists and what they do. That is wrong. It is a matter of concern for free media and democracy in this country, so it is vitally important that journalists and their sources are protected. They are integral to a functioning democracy that holds Government, Opposition and public institutions to account.

I do not believe the Bill adequately provides for this. That is a view shared by others. I will be pressing the amendment.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

We had considerable debate on this in the Seanad. The text of Deputy Ó Laoghaire's new section seems to be inspired by the recommendation of this committee arising from the pre-legislative scrutiny of the communications (retention of data) Bill 2017.

The joint committee's report was issued recently but the Government, and more importantly the Attorney General, have not yet had the opportunity to examine the recommendations in the detail this deserves. I have doubts as to whether this is the correct location for a far-reaching statutory provision of this kind. I ask Deputies to appreciate that the potentially far-reaching nature of this amendment, and the provision of proposed subsection (3) whereby the High Court could permit identification of confidential sources of information where a journalist is the subject of investigation for suspected commission of a serious criminal offence, raise several important issues, not least what is meant by a serious offence. Does it cover dangerous driving or domestic violence? There is no definition of any kind and the result is that journalistic privilege may in effect be put at risk rather than be safeguarded.

Balancing the rights of journalists to protect their sources with other sources is rightly a matter for the courts. For example, the European Court of Human Rights has underlined that protection of confidential sources is an essential means of enabling the press to perform its important function as a public watchdog. That should not be interfered with except in the most exceptional of circumstances where some vital public or individual interests may be at stake. I do not disagree with the points raised by Deputy Ó Laoghaire but I am very concerned about the imported consequences of the amendment in the form of the text as it is. This is an issue that deserves the fullest of consideration. I do not believe we should decide it in the context of this Bill. Therefore I will not accept the amendment now.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I find myself in the frightening position of agreeing with the Minister. The amendment raises very important issues that go beyond the data protection measures, the general data protection regulation, GDPR, and this legislation. The Minister's point about what is a serious offence involves a balancing of rights which are adjudicated by the courts, and as Deputy Wallace just said to me, if at some stage we did have a crusading independent media and journalist corps, it would be nice to have their interests protected, but we are a long way from that given the conduct of many journalists in front of the Charleton tribunal. That is another story.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thought that the Minister looked decidedly more uncomfortable than Deputy Daly during that.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I invite Deputy Daly to feel more comfortable when agreeing with the Minister.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

The Minister should beware.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I expect that Deputy Wallace will say something similar.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I will withdraw the amendment, not so much because of its location, because this is a data protection Bill and data retention is relevant as well, but on the basis of the text.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I had better say something or the Minister will be disappointed. Deputy Daly and the Minister would make a lovely couple.

Deputy Ó Laoghaire is right that journalism has a powerful role to play in democracy and in helping to ensure that we have a fair society, but sadly we do not have that yet in this country. We long for the day. I would defend the Minister's position on this.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thank the Deputy for that insightful contribution.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

We are moving on to the grouping of amendments Nos. 58 to 62, inclusive. If amendment No. 58 is agreed, amendment No. 60 in the name of Deputy O'Callaghan cannot be moved. Amendments Nos. 59 and 60 are physical alternatives to amendment No. 58.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 58:

In page 30, to delete lines 4 to 6 and substitute the following:"41.(1) For the purposes of Article 86, personal data may be disclosed where a request for access to a record is granted under and in accordance with the Act of 2014 pursuant to an FOI request, a request for access to environmental information is granted under and in accordance with the Regulations of 2007 pursuant to a request for environmental information or a request to release documents for re-use is granted under and in accordance with the Regulations of 2005 pursuant to a request.".

The amendment is intended to put the access to information regimes on an equal footing with freedom of information regimes. These include the right to access environmental information under the European Communities (Access to Information on the Environment) Regulations 2007 to 2014 and the European Communities (Re-Use of Public Sector Information) Regulations 2005 to 2015. There is no good reason to refer in the Data Protection Bill 2018 only to freedom of information without also including the other major regimes accessed under those regulations. This amendment can correct that and would be a useful addition to the Bill.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

On amendment No. 59, I am concerned about the proposed deletion of the words "contained in a record" as the concept of a record is integral to the operation of the Freedom of Information Act. Section 2 contains a comprehensive definition of the term. Access rights under the Act include access to records. Section 11 provides that every person has a right to and shall, on request, be offered access to any record held by any freedom of information body. Section 12 also references a record. Therefore, reference to a record appears to be right and proper.

On amendments Nos. 58 and 60 to 62, inclusive, I accept, subject to the advice of the Attorney General, the principle of extending the scope of the section to include the regulations of 2005 and 2007. I have asked my officials to consult the Office of the Parliamentary Counsel with a view to ensuring the text is appropriate and does not in any way conflict with other sections. In short, if Deputies withdraw their amendments, I will give a commitment to table an appropriate amendment on the subject on Report Stage with which I will certainly attempt to meet concerns.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I will come first to Deputy Donnchadh Ó Laoghaire and then to Deputy Jim O'Callaghan to respond to the Minister's invitation, for want of any other word.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

In the light of what the Minister has said and with a view to retabling the amendments on Report Stage if there is nothing forthcoming, I will withdraw amendment No. 58.

On amendment No. 59, there is a definition and the Act was referenced. I do not have it to hand, but I am not necessarily clear on what harm would be done if the words "contained in a record" were not included or there was a broader view on the information on a person that might be owned by a data processor or any organisation. For the avoidance of doubt, it seems that there is sense in simply stating all information, whether in what might be defined as a record or not, will be contained. I will consider it, but I am happy to withdraw amendment No. 58.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The Deputy also wishes to be involved.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

We will call it as we see it.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

The next Government might be about three parties, rather than two.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

There could also be room for Independents.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I do not think so. Fine Gael might have had its fill of them this time.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Let us keep doing well

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 59:

In page 30, line 4, to delete "contained in a record".

This is complementary to the last amendment and probably amendment No. 62.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment Nos. 63, 64 and 66 are related and will be discussed together. Acceptance of amendment No. 63 in the Minister's name involves the deletion of section 42.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 63:

In page 30, between lines 13 and 14, to insert the following:“Processing of special categories of personal data

42. Subject to compliance with the Data Protection Regulation and any other relevant enactment or rule of law, the processing of special categories of personal data shall be lawful to the extent the processing is —

(a) authorised by section 38 and sections 43 to 51, or

(b) otherwise authorised by Article 9.”.

This is essentially a drafting amendment and presents section 42 in a clearer format and wording.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 64:

In page 30, line 23, to delete "any right or obligation" and substitute "specific rights or obligations".

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Are the members pressing the amendment?

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Has it been discussed already?

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It was part of a previous grouping and I asked if members wished to speak to it.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I did not address the matter as I thought Deputy Clare Daly might do so.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Yes. Did the grouping contain amendments Nos. 63, 64 and 66?

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

That is correct. We are now deciding on amendment No. 64. The time to address it was before, but nobody indicated at the time.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I am sorry.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

In that case, I will allow the Deputy to speak to it, if she so wishes.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Is the Chairman referring to amendment No. 64 or amendment No. 66?

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

We are dealing with amendment No. 64.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I will be brief. To be honest, I do not know why the amendments have been grouped like this, as they deal with two sections. That probably has caused part of the confusion, about which I am sorry.

Section 43 deals with providing for a general exemption from the prohibition on processing special categories of data imposed on either the controller or the subject by employment or social welfare law. All we are trying to do is change the words "any right or obligation" to "specific rights or obligations", which would be much more in line with Article 9. We have a little concern that it is being left too general and that it would allow special categories to be processed for reasons for which they do not need to be processed. It is a slight change.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

On section 45, there is a degree of concern. Deputy Mick Wallace has an amendment that is much the same on the matter. I will oppose section 45. All of its purposes are covered by Article 9 of the GDPR. In the possible or likely event that the section is agreed to, I still believe it requires amendment. There is a view, which I share, that section 45 creates a loophole in allowing companies from other jurisdictions to operate here. It essentially creates a position where companies not dissimilar to Cambridge Analytica or other organisations which are mining and exploiting data in that way could operate and use data gathered here, provided they did not interfere in electoral activity in the State. That is not covered, but it is the purpose of amendment No. 66. I will oppose the section, but I will also press the amendment.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Deputy Mick Wallace also has his name to the amendment.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I will oppose the section. We might be deemed to be wiser to oppose it and adhere to the GDPR in full, rather than trying to shape the section. My amendment is a fall-back position if the section is not completely opposed. We would like to return to it on Report Stage. Article 9 of the GDPR is very clear that the processing of political opinion is prohibited without the full and informed consent of the data subject, except in certain and very limited circumstances. Section 45 of the Bill is a bizarre attempt to carve out an exception for the processing of political opinion that is simply not provided for in the GDPR. We could write it into Irish law via section 45, but it would simply be superseded in any case by the GDPR. The phrase "subject to suitable and specific measures" appears many times in the Bill and points us back to section 35, to which the Minister referred as a toolbox for processing and protecting the rights of the data subject. Section 35 and the suitable and specific measures therein are extremely important and, in the case of the most important, lifted from various parts of the GDPR. The section does not require explicit consent, which is optional. Ministers do not have to use the toolkit in the section. Section 45 is a bizarre attempt to carve exemptions to the GDPR, particularly in the light of the Cambridge Analytica story and the fundamental threat to democracy that such companies pose.

Removing section 45 would not affect the use of the electoral register or the work of the Referendum Commission.

Article 13 of the GDPR explains the necessary steps we should take in terms of electoral activities such as door to door canvassing to adhere to the GDPR. The Office of the Data Protection Commissioner recently published guidelines on how canvassers would have to adapt. It will not affect polling companies or the use of focus groups or market research, only in the sense that consent will be required from the person being polled. Obtaining this consent should not be especially difficult or onerous. In any case, the GDPR absolutely requires the seeking of this consent, as per Article 9, in processing special categories of data such as political opinion.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I do not see any legal difference between the current wording of "any right or obligation" and "specific rights or obligations". Where any right or obligation is conferred or imposed by law, it is a specific right or obligation. Apart from that, there is a grammatical problem because of the plural nouns "rights or obligations" being used with a singular verb. This means that the wording would read "exercising or performing specific rights or obligations which is conferred or imposed". For these reasons, I cannot accept the amendment.

Amendment No. 66 brings us back to the Seanad where I introduced amendments to ensure the processing of political opinions for electoral purposes would apply only in the course of elections within the State. That was an issue. Of course, the content is based on Recital (56) of the GDPR which makes it quite clear that, where in the course of electoral activities the operation of the democratic system in a member state requires political parties to compile personal data for people's political opinions, the processing of such data may be permitted for reasons to do with the public interest, provided that appropriate safeguards are established. I am at a loss to determine the consequences of what Deputy Donnchadh Ó Laoghaire has in mind. I do not recognise circumstances in which such personal data would be shared with a private company. They would more likely be used during the course of an election campaign when parties were canvassing and seeking reactions to election manifestoes or questionnaires and the voting intentions of constituents. I am not sure whether the amendment is needed and even if I were minded to accept it, I am not clear on the actors and entities involved. I will not accept it today, but there might be scope for further debate on it. With its current wording, I cannot accept it.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I wish to speak briefly to amendment No. 64. Article 9 of the GDPR , from which the section is derived, states the processing of special categories of data in the context of employment and social welfare law is allowed as long as the "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject" in these areas. That is where we took the word "specific" instead of "any". We think it is more in line with Article 9.

On amendment No. 66 and the section, I am in favour of the deletion of the entire section. It was the subject of a huge amount of debate in the Seanad. Polls, focus groups and canvass tallies will all still be allowed if the section is deleted. All that has to happen is for consent to be gained to note somebody's political view, only if someone is planning to use it with the person's name and address or IP address in the course of one or other of these activities. It is not really a big ask. Notably, there was a letter yesterday in the newspapers from Digital Rights Ireland, Data Compliance Europe, Dr. T. J. McIntyre of the Faculty of Law in UCD, FP Logue Solicitors, Rossa McMahon and the Irish Council for Civil Liberties. The top people in this area are warning us. They have taken successful legal actions against the State. Because of their knowledge, they are warning us and arguing for the removal from the section of the blanket exemptions in the processing of personal data which reveals political opinions. That is why we are pushing to oppose the section. The State will pay heavily if we do not delete the section. Parties and candidates will still be able to run an analysis of election results in granular form. They will still be able to have super sophisticated analysis of polling data. The only things involved are personal data that can identify people in the context of their political opinions and the State would be well served by deleting the section in its entirety.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The amendment does not attempt to impinge on what political parties do in this jurisdiction or, at least, for its purposes. Its intention is to prohibit the gathering of data in this jurisdiction for use elsewhere. There is a belief, which I share, that it is not currently prohibited and that it is something we should seek to do.

The other point made by Deputy Jim O'Callaghan and the Minister is fine, but the issue is why are we drafting a provision when all of these practices and behaviours in canvassing and making representations are provided for under the GDPR. This is a regulation, not a directive. Most of it has direct effect. There is a margin of appreciation of certain provisions, but as Article 9 of the GDPR has direct effect, I do not see any need for section 45 in that context. People have spoken about lawyers' holidays. The greatest example will be when the GDPR and the Act will be in conflict. Section 45 is a prime example in that regard.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I wish to address the point made by Deputy Jim O'Callaghan. If a really nice individual who I like comes to my door and asks me for my vote and I tell him that I will give it to him and he happens to be from Fianna Fáil, I might not want it to be made public or recorded that I was actually prepared to support Fianna Fáil. Someone might want to make a call and agree to support a fellow, but I can understand that person not necessarily wanting it to be made public or recorded.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

This is an absolutely enormous section which has caused huge controversy. Even as we sit here, a load of people are commenting on it, including some of the experts in Ireland on data protection because they believe this is a serious category.

To answer some of the points made by Deputy Jim O'Callaghan, it is not about canvassing or recording details. All of that good stuff can continue. It is about targeting and isolating an individual and personal data. That has very big implications. If the debate on the section is continued on Report Stage, there will again be huge controversy.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thank the Deputy. As there is no other member offering, I will revert-----

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

That is okay. Does the Minister have anything further to add?

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I have to contrast the differing opinions in so far as some members say this is revolutionary and foreboding, while others say it is not necessary because it is already catered for.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

We will see.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Deputy Jim O'Callaghan indicated that he would withdraw amendment No. 65.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 66:

In page 31, between lines 12 and 13, to insert the following:“(2) This section does not permit the sharing or processing of personal data revealing political opinion with or by any private company, as defined under section 2(1) of the Companies Act 2014 without the consent of the data subject even when that private company has been contracted by the actors or entities specified under paragraphs (a),(b) or (c).”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Deputy Clare Daly has indicated that she is opposed to the section. Is she happy that she has covered the points she wanted to make?

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Yes, absolutely.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I apologise, Chairman, but I meant to interject when we were on section 42. Perhaps I am too late, but there is something I wish to raise on Report Stage.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

If the Deputy wishes to so indicate, he may take the opportunity to do so briefly.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I reserve the right to speak and possibly introduce amendments about external databases that hold special categories of personal data. The ISideWith online campaign has data for more than 100,000 individuals which are available to be used in micro-targeting. They are held in the United States beyond the jurisdiction of GDPR, but they could still potentially be used in the future to affect Irish elections and referenda and pose a threat to democracy. I wish to raise this issue on Report Stage.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It is duly noted and the Deputy will be in a position to proceed to discuss it.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 67 to 70, inclusive, in the names of Deputies Clare and Mick Wallace are being discussed together. I understand Deputy Mick Wallace will take the lead.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 67:

In page 31, line 24, after “subjects,” to insert “and subject to subsection (2),”.

Recital 52 of the GDPR states exemptions in the processing of special categories of personal data can be provided for in member state law in settling claims for benefits and services under the health insurance system. I acknowledge that section 47 invokes suitable and specific measures which revert to some of the safeguards provided in section 35, but Recital 52 of the GDPR makes absolutely no references to occupational pensions, for example, as is the case in respect of section 47(c) or to the mortgaging of property, as provided for in section 47(d). This section essentially provides for exemptions from the requirement for explicit consent under the GDPR for the processing of special or sensitive categories of data. That is fine, as long as we adhere to the possible exemptions provided for in the GDPR. However, we are surely overstepping the mark in this section and going beyond services provided under the health insurance system, as per Recital 52 of the GDPR. Why could consent not be sought in the instances given in section 47(c) and (d)? Surely obtaining consent in these instances would not be too onerous or difficult. The proposed insertions in amendment No. 70, subsection (2)(a) and (b), even stipulate that processing might take place without the consent of the data subject if the data controller could not reasonably be expected to obtain consent for whatever reason. In other words, obtaining consent should be a reasonable step.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

The provisions of the GDPR provide for exemptions from the requirement for consent for processing with a view to safeguarding public health, but that is not necessarily what health insurance companies do. The processing of health data is not necessary for the management of the health service. It obviously has some function in that regard, but I do not think it should do so without having to ask for our permission. For example, VHI is running a TV advertisement campaign asking members to sign up to be DNA tested by it in order that it can help an individual to find out what future ailments to which he or she might be genetically disposed, but that is not the reason it is doing it. It is doing it in order that it can charge higher premiums to individuals who are predisposed to something that could trigger an illness later. It wants our data in order that it can levy higher premiums. It is not doing it for the good of the health service. There is no reason we should give such data to it; it should have to obtain an individual's consent first. That is all we are asking for.

It is an even bigger problem in the case of the banks because this allows for an exemption for the banks to process health data in the case of mortgage applications. The Government's proposal is that the banks can do this without obtaining the consent of the person concerned. That is ludicrous. Everybody knows that when he or she fills in the application form for a mortgage, he or she will have to fill in numerous forms. I do not think one of them being a consent form would be too onerous. It woud not stop the banks or insurance companies from obtaining the information, but they would have to have our consent first.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Section 47 has been included to address a specific issue arising from the strict definition of consent included in the GDPR. The matter also arose during the preparation of legislation in a number of other member states, of which we are aware.

The matters referred to in section 47, paragraphs (a) to (d), inclusive, insurance or life assurance policies, pensions, annuities and mortgages, are normally the subject matters of a detailed contract between the data subject and an insurance company or a financial institution. In order to determine contributions, it may well require obtaining information on the health of the data subject, or his or her welfare or disposition. Article 6(1)(b) of the GDPR permits the processing of non-sensitive personal data.

Article 9.2 does not permit the processing of such personal data for contractual purposes. The question then is whether the explicit consent of the data subject in Article 9.2(a) provides a sufficiently robust ground for securing the benefits of such a contract. The difficulty that arise relates to the strict definition of "consent" in Article 4.11 of the GDPR. It prescribes that for the consent to be valid, it must be "freely given". Recital 43 states that consent should not provide a valid legal ground for the processing of personal data "where there is a clear imbalance between the data subject and the controller". My concern, which is shared by a number of other member states, is that the insurance company or financial institution may in certain circumstances, in the absence of this section, seek to resile from the contract with the data subject on the basis that the consent of the subject could not have been freely given. The need for the provision has been discussed and agreed with the Attorney General and I am not inclined, therefore, to accept the amendments.

James Lawless (Kildare North, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I agree with the Minister's comments. I worked in the insurance industry and the health insurance industry, in particular, and, therefore, I am familiar with the motivation behind the section. Deputy Daly will be glad to know that the advertisements that the VHI or other health insurers run and any tests they may perform as regards a predisposition to various conditions and diseases under law can have no effect on the premium they charge because of community rating, which means health status and categories of illness are immaterial when it comes to premium pricing.

There is a difficultly with the amendments. The Minister stated that one of the grounds for the purposes of a contract is that consent be freely given. Life insurance has always been risk-rated as opposed to community-rated and there is a difficulty in this regard. For instance, when completing a proposal form, one is required to outline various health conditions and information which is necessary for actuarial pricing for the performance of the contract. Under the amendment, there is the possibility of the data subject withholding consent. I do not know how that would work if a contract has been signed. If a client filled out a proposal form to take out a life insurance contract and at a later stage withheld consent for the use of this information, how could a claim be processed if no one has access to the information that was the subject of the contract in the first place? The amendments are well-intentioned but they are problematic and I do not see how they could work. I will oppose the amendments.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

On foot of the Minister's comments, we were going to withdraw the amendments but Deputy Lawless has almost tempted me to reintroduce them. I will withdraw them for now and reserve the right to table them again on Report Stage.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 71 to 76, inclusive, are related and will be taken together. If amendment No. 71 is agreed to, amendments Nos. 72 to 76, inclusive cannot be moved. Acceptance of the amendment involves the deletion of section 48.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 71:

In page 31, between lines 30 and 31, to insert the following:"Processing of special categories of personal data and Article 10 data for reasons of substantial public interest

48.(1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made undersubsection (3).

(2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).

(3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following —

(a) special categories of personal data, and

(b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.

(4) Without prejudice to the generality ofsubsection (3), regulations made under that subsection shall identify

(a) the substantial public interest concerned, and

(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(5) For the purposes of subsection (4)(b), subsections (2)to (6)of section 35shall apply in like manner to regulations made under subsection (3)as they apply to regulations made under section 35.

(6) Regulations may be made under subsection (3) by—

(a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

(b) any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3)shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(8) Regulations made under subsection (3)shall—

(a) respect the essence of the right to data protection, and

(b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(9) In this section, "Article 10 data" has the meaning assigned to it bysection 52.".

The amendment provides for the replacement of section 48 with a new section. The section replaces section 2B(1)(b)(II) of the 1988 Act. However, the original wording of section 48 was narrower in scope than section 2B(1)(b)(II) and it did not extend to personal data in respect of criminal convictions and offences. This is because data relating to criminal convictions and offences fall within the definition of "sensitive personal data" under the 1988 Act whereas it forms the subject matter for a separate Article 10 under the GDPR. The purpose of the amendment, therefore, is to bring section 48 more fully into line with the 1988 Act. Yesterday, I outlined some of the statutory instruments made under the corresponding section 2(B) of the 1988 Act in respect of the historic institutional abuse inquiry in Northern Ireland, the coroner's inquest into the death of Arlene Arkinson, and the coroner's inquest into the Kingsmill massacre. The processing of personal data under those regulations could involve the processing of personal data in respect of criminal convictions or offences or the alleged commission of an offence. These are matters of great importance and they necessitate the making of regulations to facilitate processing of sensitive personal data. The provisions of section 48 will permit the making of similar regulations in the future where that is justified for reasons of substantial public interest such as those I have outlined.

I will not accept amendments Nos. 72 and 73 because they seek to narrow the scope of the regulation-making power under the section. If I was to confine the scope of the section to the processing of data by public authorities in cases of urgency, it would mean that the making of regulations such as those we made to facilitate the McAleese committee and its important work would no longer be possible. I have concerns about the content and the cumulative impact of the proposals in amendments Nos. 74 to 76, inclusive, and I am not minded to accept them.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

We dealt with many of the issues relating to the section during the debate on amendment No. 5. The amendment relates to the processing of sensitive categories of data, which can only be done in the substantial public interest. None of us will have a problem with the example cited by the Minister but we are concerned to head off that interpretation being stretched in the future based on the current definition. The Sinn Féin position is similar. We propose that regulations under the section should be examined by a body or organisation that has data protection expertise. Amendment No. 72 provides that anybody who wants to rely on the substantial public interest ground to process special category data should be a public authority. That is both a matter of principle and a matter of the public authorities having an obligation to appoint data protection officers.

We propose in amendment No. 74 that the data protection officer of the relevant public authority the Minister wants to give permission to process special category data has to conduct a privacy impact assessment on the proposal and refer it back to him or her whereupon he or she can take the findings on board and, if not, make a statement in the Houses as to why not. Sinn Féin's amendment is similar. Regulations would be referred in draft form to the DPC for his or her opinion and he or she would have three months to think about them and refer them back to the Minister. If the Sinn Féin amendment is considered to be drafted appropriately, I am happy to go with it over ours.

Amendment No. 76 is of a piece with our amendments Nos. 96 and 111, which we discussed earlier. It is about oversight.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The amendments are not quite similar and I am concerned about the Minister's proposal to delete and replace the entire section because it would mean our amendments would be lost. Section 48(4) is the result of a Sinn Féin amendment that was made in the Seanad. I have sought to refine it to take account of a point made by the Minister to tighten it up.

To identify the point exactly, rather than section 48(4)(a) seeking an impact assessment, it would be defined as an opinion. The Minister made the point in the Seanad that the provisions would have some implications for the independence of the data protection commissioner. This is an attempt to refine that. Deputy Daly's amendment diverges from the existing section 48(4)(a) in part (c). Will the Deputy explain the difference in (c) to me?

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Where is it? I cannot see it.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Section 48(4)(c). That is the implication of our amendment. It is to try to preserve and enhance an amendment that was made in the Seanad.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

On the issue of "substantial public interest", German data protection legislation specifically restricts processing in this sense to public authorities, and I think we should do the same. We are talking about sensitive personal data and I do not see any reason private companies would be processing sensitive data for what is referred to as "substantial public interest".

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

There is validity to Deputy O'Callaghan's point in the sense that what we agreed yesterday on Oireachtas oversight has maybe moved the goalposts since we tabled these amendments. We tabled two amendments to get around the legal prohibition on us placing an obligation on the Data Protection Commissioner to do anything. We have probably favoured Deputy Ó Laoghaire's amendment to ours but we were worried how that might stack up in that legal context and we put them in as reserves. I am happy enough to withdraw these for now with the option, when we look at the final draft, to see how it might fit in. Amendment No. 76 is consequential on amendment No. 5, and, on the point that Deputy O'Callaghan made about democratic oversight, we need to get that one passed. We are okay with withdrawing the others.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

If I can clarify before the Minister responds, are Deputies Daly and Wallace proposing to withdraw amendments Nos. 72, 73 and 74?

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Yes.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I wanted to short-circuit matters by saying that I agree fully with the point raised by Deputy O'Callaghan. This is not an academic exercise. There are practical obligations and a practical process here. I am prepared to look at what we did yesterday with regard to amendments Nos. 35 and 37. We can go back to that later.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Will Deputy Ó Laoghaire indicate where he is on this grouping?

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I am conflicted because the Seanad took a view on this and voted against the Government to include this impact assessment process with good reason. I take the point that Deputy O'Callaghan raised about decisions being made by the Oireachtas. There is no provision here that ensures that the Data Protection Commissioner would take a decision. Any decision could only be made by a Minister and now perhaps requires prospective sanction by the Dáil and Seanad. Any decision that is made by elected representatives has to be based on gathering the information available, evaluating it, and then taking the decision. The expert in these matters will be the Data Protection Commissioner. The commissioner's say on what additional exceptions and special categories might be required to be processed is necessary information, even with the prospective approval of the Dáil. We should have that and should be able to evaluate it. I will not support the Minister's amendment and will press my own.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

The Deputy heard the robust debate in the Seanad and the manner in which it dealt with this issue. It is fair to say that the Seanad is more academically minded than the Dáil. I think, from time to time, that the Seanad does not have the practical experience of life that we bring as Members of the Dáil. I would not be overly exercised at the debate in the Seanad as far as this issue is concerned. I feel that, were we to accept these amendments, it would be grossly excessive with regard to the obligation on outside bodies. We would find it very difficult to get matters done in a way that might be regarded as efficient or timely in response to a public interest issue.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

There are echoes of a former Taoiseach's intent in what I just heard. I can tell that Deputy Brophy cannot wait to meet his colleagues from the Seanad.

Colm Brophy (Dublin South West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I have a feeling my colleagues from the Seanad will have heard well before I get an opportunity to meet them.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I wish the Deputy good luck nevertheless.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I wonder if this Seanad referred to by the Minister is the same one that his party was trying to get rid of not so long ago.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I, too, referred to that.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I was an abolitionist.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

So was I.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

So am I.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

If I went on, I would probably find myself in some difficulty.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

This point of an onerous obligation assumes that this will happen frequently. It should not happen frequently. If we are talking about new special categories being taken into account and that the Minister would be able to provide for that, that should not be happening willy-nilly or frequently but should be infrequent. One would hope that it would not happen any more often than once a year or even less often than that. I do not see why the Data Protection Commissioner cannot match up to that job. I do not think it is an onerous obligation. If it is, it means that the provision is being abused and that we are looking for new special categories to be sanctioned too frequently.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I remind members that if amendment No. 71 passes, irrespective of those withdrawn, none of the other amendments can then be moved.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

As a consequence of the amendment being agreed to, neither amendment No. 75 nor amendment No. 76 can be moved. Amendments Nos. 72 to 74, inclusive, have already been withdrawn.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 77:

In page 33, line 13, to delete “health professional” and substitute “health practitioner”.

This is a drafting amendment.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 78 to 81, inclusive, and 110 are related and may be discussed together.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 78:

In page 35, line 2, to delete “compliance with Article 6(1), to”.

The purpose of amendment No. 80 is to provide a basis for possible future regulations to combat bribery and corruption. Members will recall that I recently launched important proposals to strengthen our law relating to bribery and corruption and I thank the committee for its contribution thereto. It will be necessary for any such future regulations to have regard to the policies and principles set out in subsection (5). Advance consultation with the Data Protection Commissioner will also be necessary. Amendments Nos. 78 and 79 are consequential drafting amendments.

I am not inclined to accept amendments Nos. 81 and 110 in the names of Deputies Wallace and Clare Daly but I recognise that a provision on these lines was carried yesterday.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

They are consequential on yesterday's provisions and they relate to the same oversight provisions. For consistency, they should be allowed. They are in line with what we agreed yesterday but relate to a different section.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I accept that.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 79:

In page 35, line 7, to delete “or” where it secondly occurs.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 80:

In page 35, between lines 7 and 8, to insert the following:

“(b) assess the risk of bribery or corruption, or both, or to prevent bribery or corruption, or both, or”.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 81:

In page 35, to delete lines 11 to 15 and substitute the following:“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission,

and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee,

or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission,

and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 82, 83 and 93 will be taken together.

Colm Brophy (Dublin South West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 82:

In page 35, line 35, after “candidate” to insert “, or in relation to the scripts completed by him or her in an examination,”.

This is a small set of amendments, primarily to do with access to examination scripts. It is designed to tidy up the process and in no way seeks to restrict the current situation in which candidates have access to, and can talk about, their examination scripts. Amendment No. 110 is at the heart of the issue and seeks to include a provision to safeguard access in the examination process, particularly in the case of rights relating to the removal of scripts from institutions.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

In an important ruling of December last year, the European Court of Justice in Luxembourg ruled that examination scripts fall under the heading of personal data under EU data protection law. The consequences of that judgment are such that the Department of Education and Skills and the Attorney General are now examining the issue. I am not in a position to accept these amendments today but I assure Deputies Brophy and Burke that I will bring forward appropriate amendments on Report Stage in due course. It is an important point and I accept it.

Colm Brophy (Dublin South West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am willing, obviously, to accept that but it is very important because access to an examination script could have major implications for the examination process and marking systems. I will wait to see what the Minister comes back with on Report Stage.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I thank Deputy Brophy for bringing the matter to my attention.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 84 is a standalone amendment in the names of Deputies Wallace and Clare Daly.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 84:

In page 36, to delete lines 17 and 18 and substitute the following:

“him or her to—

(I) make representations to the controller in relation to the decision,

(II) request human intervention in the decision-making process,

(III) request to appeal the decision.

(2) In the case of requests made under subsection 1(b)(ii) or (iii) the controller shall—

(a) comply with the request, and

(b) notify the data subject in writing of—

(i) the steps taken to comply with the request, and

(ii) in the case of an appeal under section 1(b)(iii), the outcome of the appeal.”.

Article 22.1 of the GDPR specifically states that people should not be subjected to automated decision-making, which it describes as "profiling". The GDPR provides member states with possible exemptions and Article 22.2(b) is different from (a) and (c) in the sense that there does not seem to be a provision in (c) for a data subject's right to obtain human intervention on behalf of the controller. I also accept the fact that section 54 of the Bill refers to suitable and specific measures and, therefore, the toolbox of safeguards. I accept that automated decision-making might be necessary at times but we are uncomfortable with blanket, catch-all, automated decision-making. In the Seanad debate, the Minister talked about the unintended consequences of amending this section in line with our amendment, suggesting it would facilitate wrongdoing and fraud. Perhaps the Minister can clarify this.

One of the problems with this section of the Bill is that it is not specific in any way on the matter of automated decision-making. It gives the power to introduce automated decision-making in a whole host of cases and we feel this may alienate certain vulnerable people from the institutions of the State. I do not know if anybody has seen the film "I, Daniel Blake" by Ken Loach, which would remind one of the issue in this case.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Section 54 gives further effect to Article 22 of the GDPR, which deals with the automated processing of personal data including profiling. Paragraphs 2(a) and (c) of Article 22, which have direct effect, permit automated processing, including profiling, where it is necessary for entering into, or the performance of, a contract between a data subject and a controller and where the data subject has given explicit consent. Paragraph 2(b) of Article 22 permits such processing where it is authorised by the European Union or national law but subject to appropriate safeguards. Recital 71 of the GDPR mentions measures to combat fraud and to monitor tax evasion, areas where such activity is relevant under national law but subject, again, to safeguards.

Section 54 makes it clear that the steps that need to be taken to safeguard the interests of the data subject must include an arrangement whereby the data subject has the opportunity to make representations on any intended decisions. This means, in the first place, that a data subject has the information on any proposal to make such a decision and, secondly, has the opportunity to bring any concerns to the attention of the controller.

As I have said, the general data protection regulation, GDPR, mentions fraud and tax evasion as areas justifying automated processes. It seems to me that the existing safeguards are adequate and are GDPR compliant. The essential features of amendment No. 84 are contained in section 54. I am not inclined to accept it. In this regard we must ensure that our laws combating fraud and tax evasion are fully fit for purpose.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Article 29 of the GDPR is the god of guidance on the GDPR. On automated processing the GDPR says that minimum safeguards must provide an explanation of the decision reached and a way for the data subject to obtain human intervention, to express his or her point of view and to contest the decision. This Bill refers to making what are called representations. It is not clear at what stage the data subject can make representations and there is no guarantee that he or she will get a human intervention if it is wanted. There is no obligation on a controller in this regard. We have to see this in the context of the fallibility of machines. It is crucial that there needs to be a clear right for people in Ireland to get a human intervention and an appeal process for any decisions that are made by the machine. This is what our amendment provides for. We have to be cognisant that over the next ten years, automated decision-making is going to become much more prevalent. There is a problem with the wording of the Bill in that the rights enshrined in the GDPR are somewhat circumscribed by this. Unless we clearly delineate the rights now, there will be confusion and possible court cases in the future. It is far better not to use the phrase "make representations", which is in the Bill. If the phrase is to be used, then accept our amendment.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I refer again to section 54 and to section 51, which require that any automated processing must be authorised or required by, or under, an enactment. Further, it requires that the effect of any decision is either to grant a request of the data subject or that adequate steps have been taken to safeguard the interests of the data subject. This covers the points raised by Deputy Clare Daly and therefore I am not inclined to accept amendment No. 84.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Under Article 21 everybody has a right to object to having their data processed for the purposes of direct marketing. The Government inserted this new section in the Bill in the Seanad that says receiving direct mail from a political party or the Referendum Commission is not direct marketing, so a person has no right to object. Essentially, it limits a person's right to object to being spammed so long as the bodies sending unsolicited mail are political parties or candidates. Is the Government doing this to get around the freepost thing that everybody gets in an election, which is sent out by An Post? If it is, then deal with that. By doing it this way the legislation is just allowing any unsolicited mail from a political party or candidate to get through. I do not believe this would be desirable.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

On section 55 and direct marketing for the purposes of Article 21, the reason for excluding direct mailing from direct marketing in these cases is that the enhanced right to object to direct marketing activity should not apply to direct mailing for these purposes. This exception is based on the idea that citizens not only have rights but also obligations to inform themselves as part of their civic responsibilities. During Seanad discussions on this Bill, Senator Norris referred in passing to his practice of sending information circulars on his parliamentary activities to the Trinity College electorate by direct mailing. This section is intended to contribute to the formation and maintenance of an informed electorate in the State as part of our democratic system of government. I was not minded to recall the incidents, as referred to by Deputy Clare Daly, but it is important that direct mailing be retained as part of the civic engagement.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

That is not the issue here. There is nothing to stop politicians continuing to mail people, every day of the week if they like. Section 55, however, prevents a constituent from objecting to that process. This is an entirely different matter. While I will continue to use my Oireachtas envelopes, with which I think I am informing my constituents, if someone contacts me and gives me their name and address and objects to that, I believe the objection should be upheld. This section removes their right to object. It does not stop politicians from continuing to burn down the rain forest to churn out reams of paper to tell people how great we are.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Deputy Daly has clarified the intent of the opposition to the section. Are there further comments?

Colm Brophy (Dublin South West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I was not going to comment. I find it amusing that people view communications from themselves in one way but view as completely different the communications from others who are engaged in the same career path. If people chose to communicate with an individual through a letter in an envelope or if people chose to communicate by direct mail, it is the same process at heart and we should respect the integrity of all our colleagues' ability to communicate.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I did not hear anyone else saying that it was not. I said that a citizen or a resident had a right to object to any material they got from me and from Deputies Brophy, O'Callaghan, Ó Caoláin or whoever.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I have heard that loud and clear.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I would like to reinforce that. A thread is emerging in this debate that rather than going out and canvassing during elections or gathering data, candidates should stay behind closed doors and pray for people to vote for them. No one is suggesting that. We are trying to ensure that we comply with an EU law that will have a direct effect, and where people hold data around political opinions and constituents' issues, they must mind it carefully, delete it where appropriate and have proper consent for it.

In that regard, if a person repeatedly receives letters that he or she considers nuisance mail, it is reasonable for that person to have the right to say that he or she does not wish to receive such mail. Democracy in this country is more feeble than I thought if such a right is considered a threat to it.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

It may not be directly relevant to the amendment but a threat to democracy is posed by how the mainstream media and the State-run, Government-controlled broadcaster, RTÉ, shapes the news. We have serious reservations about the threat posed to democracy by how RTÉ operates-----

Colm Brophy (Dublin South West, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Many people wish for RTÉ to be controlled by the Government but it certainly does not seem to be.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I thought Deputies who wish to speak must do so through the Chair. The notion that social media is less authentic than mainstream media is a bit odd.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Perhaps the Minister wishes to reveal whether or not he controls RTÉ.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am surprised that members see this section as new or novel. The Data Protection Act 1988 contains reference to direct marketing and direct mail. Much of this is subjective on the part of the recipient. All Members have seen signs stating "no junk mail" in the course of canvassing. Such a sign is an objection in itself. However, I recall more than one occasion on which I did not leave a leaflet but was subsequently contacted by or spoke to the householder and pointed out that I had honoured the sign declining junk mail only to be told that it did not apply to me but, rather, the other crowd. This is merely subjective.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It applied to Deputy O'Callaghan's crowd.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am inclined to accept what Deputy O'Callaghan has stated on the section. There is a practical issue in terms of day-to-day activities and people have the right to object. People exercise that right at the ballot box.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The ultimate judgment.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

Section 56 undermines Article 21 of the GDPR and the right to object. I acknowledge that the section refers to personal data rather than special categories of data such as political opinion, sexual orientation, ethnicity and so on. However, no provision in the GDPR allows the Government to deny data subjects the right to object to the processing of personal data. The Minister may object and state that I want to deny the Referendum Commission the ability to do its job but that would not happen with our amendment as the work of the Referendum Commission would be permitted as per Recital 69 of the GDPR and the reference therein to a compelling and legitimate interest. The Referendum Commission is a legitimate interest under the GDPR and section 56 of the Bill makes no difference to it. Section 56 is, therefore, unnecessary. Surely we should have the basic right to object if our data is being processed in an inappropriate manner for election purposes.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Deputy Wallace mentioned Article 21. A strict reading of the right to object indicates that it is subject to compelling and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. I believe that the effective operation of our democratic system depends on the right of those seeking or in elected political office to communicate their programmes, manifestos, policies, platforms, decisions and, often, achievements to the electorate. There is a corresponding obligation that voters be informed in order to promote the discharge of civic duties in society. That is the same argument as made previously. The section as drafted is not unimportant.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

It is incredible that we are discussing a complicated document and are further unnecessarily complicating it. The entities to which the Minister referred such as the Referendum Commission, political parties, political wannabes and others can rely on existing legitimate interest grounds to carry out direct mailing and so on. These sections relate to removing a recipient's right to object. The sections remove the existing right under the articles of the GDPR for a person who does not wish to receive spam via phone, text messages and so on to object to that. The arguments being used to justify the section are neither valid nor accurate. We stand over our opposition to the section.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I wish the record to show my agreement to that.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

With what is Deputy Ó Laoghaire in agreement?

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The comments made by Deputy Clare Daly.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I was teasing the Deputy.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 85 to 92, inclusive, 94, 95, 97 and 184 to 196, inclusive, are related and may be discussed together. Amendment No. 85 is in the names of Deputies Clare Daly and Wallace and I invite them to address it, subsequent amendments and the grouping in general.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

Deputy Daly will speak to the amendment.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Will the Deputies share the joke? We all need it.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

It has been a long week.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

Members would prefer if we did not share it.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I do not know at whose expense the joke was but let us continue.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 85:

In page 37, line 3, to delete “to 22” and substitute “to 21”.

It has been a very difficult week. I am aware that Deputy Ó Laoghaire is opposing the section, and Deputy Wallace and I support him in that regard. However, on the basis of the debate on the section in the Seanad, we did not think that approach would be heard or accepted and have, therefore, taken a harm mitigation approach. However, we support Deputy Ó Laoghaire on the section other than in that regard.

As discussed in regard to amendment No. 6, section 57 allows for the restriction of rights under various articles for the purpose of so-called important objectives in the public interest. Amendment No. 85 proposes to change the rights which can be restricted under the section to those outlined in Articles 12 to 21 of the GDPR rather than Articles 12 to 22. It is not a major change but would mean that people would have the right not to be subjected to automated decision making or profiling under any circumstances under the section, which is important. The British legislation on this matter includes a provision similar to that which we are proposing and it is important in that regard.

On amendment No. 90, as previously mentioned, section 57 proposes that the Minister would have wide discretion in limiting the rights of persons under Articles 12 to 22 in respect of certain circumstances that are united under the vague banner of being in the general public interest.

The section also proposes to give the Minister wide discretion in limiting the rights of persons if he or she believes it is necessary to do so for the protection of the data subject or the rights and freedoms of others to do so. While this provision appears to be fair, the section does not include an obligation on the Minister to balance the rights and freedoms of data subjects with the rights and freedoms of others in circumstances in which he proposes to restrict the right of access to information under this section. I am concerned that the provisions under this section could be used to deny adopted persons' requests for information about where they come from on the basis that another party is involved. To oblige the Minister to balance rights would not be a great imposition. It is important that he should be obliged to do so.

This ties in with amendment No. 90 where the Minister also has the power to limit the rights of data subjects in respect of personal data kept for or obtained in the course of the carrying out of social work by a public body. On the face of it, this appears to be vaguely acceptable. However, if one scratches a little deeper, it becomes obvious that the restriction of rights could and, given the history of the State, probably would be used to refuse information to adopted children about their natural parents. If this is not the Minister's intention, I ask him to review these provisions and improve the wording. As matters stand, I propose to press the amendment.

Amendments Nos. 92 and 94 limit the Minister's right to invent a new public interest objective with a view to restricting rights. The key word in this context is "indicative". The 14 objectives listed are only some of the public interest objectives the Minister may use as a basis for restricting rights. A Minister can, at any time, add to these objectives without consulting elected representatives. As matters stand, restrictions of rights could be justified on any basis. Data centres, for example, have been justified on the basis that they are crucial and in the public interest. Given that a caveat could be applied in respect of anything, it is necessary to introduce some checks and balances. For this reason, we propose to restrict the public interest objectives by providing that a Minister who wants to designate an objective that is not already listed in the Bill as one that is of general public interest will be required to submit the proposal to the Oireachtas for approval. The amendment introduces a check on the Minister's powers in this regard.

Amendment No. 95 requires the Minister to consult the Data Protection Commission before making regulations and present to the Joint Committee on Justice and Equality his rationale should he ignore the advice of the commission. In that respect, the amendment is in line with previous amendments.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Of the 12 amendments in the group, six are in my name. The purpose of section 57 is to protect the public and other objectives of general public interest. I state categorically that it does not restrict, nor will it be used to restrict, the data protection rights of citizens. For example, the Medical Council or the Property Services Regulatory Authority may have good reason to investigate a doctor or estate agent on foot of a complaint by a patient or client alleging unfitness to practice or otherwise. If the data protection rights of the individuals in question are not restricted on a temporary basis while the complaint is investigated, the doctor or estate agent could apply to have his or her data rectified, restricted or erased in certain circumstances. Any of these actions would put pay to an investigation, which would be to the detriment of the complainant and the regulatory body charged with supervision.

Regulations made under this section will permit regulatory bodies to carry out their statutory obligations to conduct inquiries or investigate complaints in the knowledge that those being investigated will not be permitted to exercise data subject rights in a manner that could jeopardise the regulatory body's performance of its statutory functions. Persons under investigation will not be permitted to exercise rights to rectification or erasure of their personal data while the investigations are ongoing. I say this against the background of the importance of meeting the conditions set out in Article 23 of the general data protection regulation in the text of section 57.

Subsections (1) and (2) give effect to the introductory text of Article 23.1 of the GDPR. Subsection (3) restricts the exercise of data subject rights. These are important issues and include Cabinet confidentiality and parliamentary privilege. We need to be mindful of many examples, including in the context of protected disclosures and other whistleblowing activity.

Amendment No. 86 is a drafting amendment that substitutes revised text for subsection (2). Amendment No. 87 removes reference to judicial independence and court proceedings from subsection (3)(a)(i), while amendments Nos. 194 to 196, inclusive, make more detailed provision for restrictions on the exercise of data subject rights in the case of courts acting in their judicial capacity. Amendment No. 89 inserts reference to the Comptroller and Auditor General alongside the Data Protection Commission and Information Commissioner. This will protect investigations and inquiries undertaken by the Comptroller and Auditor General in the performance of his or her constitutional and statutory functions.

As regards other amendments, my position is as follows. While I cannot accept amendment No. 85, which is not in line with Article 23 of the GDPR, I can accept amendment No. 88 tabled by Deputies Clare Daly and Mick Wallace. Amendment No. 90 is unnecessary in light of the requirement in subsection (10) that any regulations must "respect the essence of the right to data protection and protect the interests of the data subject". I cannot accept amendment No. 91, which seeks to delete subsection (5)(b), nor can I accept amendment No. 92, which seeks to limit the scope of "important objectives of general public interest" contrary to Article 23.1(e) of the GDPR. As regards amendment No. 94, it repeats the content of the existing subsection (8) and paragraph (b) duplicates the content of subsection (11). For these reasons, I cannot accept the amendment. I will accept amendment No. 95.

Amendment No. 97 would, if accepted, breach the GDPR insofar as the controller or processor is responsible for carrying out impact assessments. This is not a task for the data protection authority, not least because it would erode the authority's independence, which is important in the context of the legislation. As I stated in respect of section 48, the cumulative effect of the provisions proposed would be excessive and disproportionate. The making of regulations could take six, eight or nine months or perhaps longer. There are circumstances in which we would find that to be less than acceptable. In view of the issues I have outlined, I will not accept amendment No. 97.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

As with several other sections, the phrase "public interest" can be used to justify many things. While it is important to protect the public interest, it can often be used by organisations, agencies and government to make decisions that suit their objectives at a particular time. Articles 9 and 145 of the GDPR specifically cover these matters. In the absence of a proper definition of public interest and in view of the wide powers and discretion provided for the Minister under this section, I will oppose the section and support the amendments proposed by Deputies Clare Daly and Mick Wallace.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Before I call Deputy O'Callaghan, I welcome Ms Gina Long back to the clerk's seat.

She was our clerk from the outset back in the 1990s up to 2016.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I am not surprised Mr. Damian Byrne moved out for a while.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

In response to an issue raised by Deputy O'Callaghan in respect of amendment No. 85, removing reference to judicial independence and court proceedings, that provision in fact reappears in amendment No. 195, which is probably more appropriate. It provides that, "The rights and obligations ... are restricted to the extent that the restrictions are necessary and proportionate to safeguard judicial independence and court proceedings." This amendment is in respect of section 156, which we will address later on.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 86:

In page 37, to delete lines 8 to 10 and substitute the following:“(2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 87:

In page 37, lines 14 and 15, to delete “judicial independence and court proceedings,”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 88:

In page 37, line 33, after “the”, where it firstly occurs, to insert “commercial”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 89:

In page 37, to delete lines 39 to 41 and substitute the following:“(c) the personal data concerned are kept—

(i) by the Commission for the performance of its functions,

(ii) by the Information Commissioner for the performance of his or her functions, or

(iii) by the Comptroller and Auditor General for the performance of his or her functions.”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 90:

In page 38, line 4, to delete “Subject” and substitute “Having regard to the balance of the rights and freedoms of data subjects and the rights and freedoms of others, and subject”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 91:

In page 38, to delete lines 13 to 15.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 92:

In page 38, to delete line 21 and substitute the following:“(8) The important objectives of general public interest referred to in subsection (6) are limited to:”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 94:

In page 39, between lines 31 and 32, to insert the following:“(8) (a) In circumstances where it is necessary to restrict the rights and obligations referred to in subsection (1) for important objectives of general public interest other than those listed in paragraphs (a) to (n) of subsection (7), the Minister shall cause to be laid before both Houses of the Oireachtas a written statement of those further objectives.

(b) Regulations may be made restricting the rights and obligations referred to in subsection (1) only if a resolution approving the written statement laid before the Houses under paragraph (a) has been passed by each House.”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 95:

In page 39, to delete lines 38 and 39, and in page 40, to delete lines 1 to 8 and substitute the following:“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission, and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee,

or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission, and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 96:

In page 40, between lines 8 and 9, to insert the following:“(11) Regulations may be made under this section only if—

(a) a draft of the proposed regulation has been laid before the Houses of the Oireachtas, and

(b) a resolution approving the draft has been passed by each House.”.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 97:

In page 40, between lines 8 and 9, to insert the following:“(11) (a) Any regulations under this section shall be referred to the Data Protection Commissioner before their enactment, who shall conduct an impact assessment, undertaken by the Data Protection Commission.

(b) The impact assessment shall have the purpose of ascertaining whether the proposed processing of special categories is—

(i) necessary,

(ii) proportionate,

(iii) in compliance with subsection (4),

(iv) in compliance with the GDPR.

(c) The impact assessment shall be returned to the Minister within three months of the Minister’s referral, and it shall make recommendations as to whether the proposed processing of special categories is in compliance with the criteria laid out in paragraph (b) and shall recommend any changes necessary to the regulation to ensure compliance, or may recommend that the Minister not proceed with the regulation.

(d) In the event that the Minister does not follow the recommendation of the Data Protection Commission, the Government shall—

(i) publish in Iris Oifigiúil a reasoned written explanation of the decision of the Government not to follow the recommendation of the Commission,

(ii) cause to be laid before the Houses of the Oireachtas a statement containing a reasoned written explanation of the decision of the Government not to follow the recommendation of the Commission.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 98 to 107, inclusive, are related and may be discussed together. They are all in the Minister's name.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 98:

In page 42, to delete lines 33 to 39, to delete pages 43 and 44, and in page 45, to delete lines 1 to 7 and substitute the following:“(1) Notwithstanding subsection (1)of section 8, the Data Protection Act 1988 (Section 2A) Regulations 2013 (S.I. No. 313 of 2013) and he Data Protection Act 1988 (Section 2A) Regulations 2016 (S.I. No. 220 of 2016) shall, in addition to applying for the purposes referred to in that subsection, apply for all other purposes for which they applied immediately before the commencement of that subsection and, in so far only as they apply for the second-mentioned purposes, they shall be deemed to have been made under section 37and may be amended or revoked accordingly.

(2) (a) The Data Protection Health Regulations shall continue in force upon and after the commencement of section 7(in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 57(5)(a).

(b) The Data Protection Health Regulations are amended—

(i) in Regulation 3, by—

(I) the deletion of the definition of “the Act”,

(II) the deletion of the definition of “health professional”, and

(III) the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘health practitioner’ has the same meaning as it has in the Health Identifiers Act 2014.”,

(ii) in Regulation 4(1), by—

(I) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and

(II) the substitution of “the physical or mental health of the data subject, but this restriction on providing information applies only to the extent to which, and for so long as, that likelihood pertains.” for “the physical or mental health of the data subject.”,

(iii) in Regulation 5, by—

(I) the substitution of “health practitioner” for “health professional” in each place it occurs,

(II) the substitution, in paragraph (1)(a), of “a request under the said Article 15 of the Data Protection Regulation” for “a request under the said section 4(1)(a)”, and

(III) the substitution, in paragraph (2)(a), of “within the meaning of section 2 of the Medical Practitioners Act 2007 or a medical practitioner practising medicine pursuant to section 50 of that Act” for “within the meaning of the Medical Practitioners Act 1978 (No. 4 of 1978), or registered dentist, within the meaning of the Dentists Act 1985 (No. 9 of 1985)”, and

(iv) by the deletion of Regulation 6.

(c) A request referred to in Regulation 4(1) of the Data Protection Health Regulations which includes a request for health data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7(in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.

(3) (a) The Data Protection Social Work Regulations shall continue in force upon and after the commencement of section 7(in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 57(5)(b).

(b) The Data Protection Social Work Regulations are amended—

(i) in Regulation 3, by—

(I) the deletion of the definition of “the Act”,

(II) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

and

(III) the substitution of the following definition for the definition of “social work data”:

“ ‘social work data’ means personal data kept for, or obtained in the course of, carrying out social work by a public authority, public body, voluntary organisation or other body but excludes any health data within the meaning of the Data Protection (Access Modification) (Health) (Regulations) 1989 (S.I. No. 82 of 1989) and ‘social work’ shall be construed accordingly.”,

(ii) in Regulation 4—

(I) in paragraph (1), by—

(A) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and

(B) the substitution of “the physical or mental health or emotional condition of the data subject, but this restriction on providing information applies only to the extent to which, and for as long as, that likelihood pertains.” for “the physical or mental health or emotional condition of the data subject.”,

and

(II) in paragraph (3), by the substitution of “under Article 15 of the Data Protection Regulation” for “under section 4(1)(a) of the Act”, and

(iii) the deletion of Regulation 5.

(c) A request referred to in Regulation 4(1) of the Data Protection Social Work Regulations which includes a request for social work data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7(in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.”.

These are merely drafting amendments. Section 65 is technical. Its purpose is to carry over certain regulations already made under the 1988 Act and thereby obviate the need to remake regulations under this Bill. I dare say the amendments are non-controversial.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Does any member wish to indicate to the contrary?

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 99:

In page 45, lines 8 and 9, to delete “, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects,”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 100 is a milestone.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 100:

In page 45, between lines 19 and 20, to insert the following:“(8) The Regulations of 2011 are amended—

(a) in Regulation 3, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”,

(b) in Regulation 4, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”, and

(c) by the insertion of the following Regulation after Regulation 6:

“7. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35of the Data Protection Act 2018.”.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 101:

In page 45, lines 21 and 22, to delete “and subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 102:

In page 45, between lines 32 and 33, to insert the following:“(9) The Regulations of 2015 are amended—

(a) in Regulation 2, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and

(b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35of the Data Protection Act 2018.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 103:

In page 45, lines 34 and 35, to delete “and subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 104:

In page 46, between lines 7 and 8, to insert the following:“(10) The Regulations of 2016 are amended—

(a) in Regulation 2, by the substitution of “Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and

(b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35of the Data Protection Act 2018.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 105:

In page 46, line 10, to delete “Health Regulations” and substitute “Data Protection Health Regulations”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 106:

In page 46, between lines 11 and 12, to insert the following:“ “Data Protection Social Work Regulations” means the Data Protection (Access Modification) (Social Work) Regulations 1989 (S.I. No. 83 of 1989).”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 107:

In page 46, to delete lines 19 and 20.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 108, 109, 117, 128, 129, 135 and 189 are related and may be discussed together.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 108:

In page 47, line 27, to delete “States” and substitute “states”.

There are six amendments that are minor drafting amendments.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Nobody wishes to take up that amendment.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 109:

In page 51, line 37, after “matters,” to insert “and”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 110:

In page 54, to delete lines 14 to 18 and substitute the following:“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission, and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee, or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission,

and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 111:

In page 54, between lines 36 and 37, to insert the following: “(7) Regulations may be made under this section only if—

(a) a draft of the proposed regulation has been laid before the Houses of the Oireachtas, and

(b) a resolution approving the draft has been passed by each House.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 112 and 113 are in the Minister's name.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 112:

In page 55, line 12, to delete “Where” and substitute “Other than where section 90 applies, where”.

These are drafting amendments to section 71(4) which is intended to ensure coherence between this section and the later section 90 to which mention is made in section 71(4)(b).

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 113:

In page 55, line 17, to delete “is restricted in accordance with section 90” and substitute “is restricted, as may be appropriate”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 114 to 116, inclusive, are related and may be discussed together.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendments No. 114:

In page 58, line 23, to delete “and processor” and substitute “and a processor”.

Section 77 imposes an obligation on data controllers operating under Part 5 of the Bill to have a detailed contract with any processor that carries out data processing activities on their behalf. The intention is to ensure the controller retains overall control over the processing chain, especially where the processor needs to obtain the assistance of a sub-processor. A very simple example is where, for example, the Garda, acting as a controller, obtains documents in a foreign language and transmits them to a translation service, which would be a processor, for translation into the English language. If that translation service does not have the necessary expertise to translate the particular language into English, it may need to obtain the services of another service with the necessary translation expertise, which would be the sub-processor. The proposed amendments to section 77 are technical in nature, but the intention is simply to ensure the controller which in my example is the Garda retains control over the personal data contained in the documents. That will enable it to retain control over the data and facilitate the exercise of data subject rights. It will also enable it to demonstrate compliance with the requirements in Part 5 of the Bill to the Data Protection Commission if called upon by the commission to do so. A possible Report Stage amendment is being considered with regard to determining the controller-processor relationship between the Office of the Director of Public Prosecutions and the prosecuting counsel on behalf of the State.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 115:

In page 58, line 35, after “processor” to insert “(in this section referred to as a “secondary processor”)”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 116:

In page 59, to delete lines 16 to 25 and substitute the following:“(4) Where a controller gives an authorisation, whether specific or general in nature, to a processor, including a secondary processor (in this section referred to as “the procuring processor”) to procure the services of a secondary processor, the procuring processor shall inform—

(a) the controller, and

(b) where relevant, any processor who procured the services of the procuring processor in relation to the processing concerned, in advance of any such procurement or of a change in the terms of such procurement.

(5) Where a procuring processor procures the services of a secondary processor to carry out processing on behalf of a controller, subsections (1) and (2) shall apply to the procuring processor and the secondary processor, subject to the following modifications and any other necessary modifications:

(a) a reference to a “controller”, other than in subparagraphs (ii), (iv), (v) and (vi) of subsection (2)(d), shall be construed as a reference to the procuring processor,

(b) a reference to a “controller” in subsection (2)(d)(iv) shall be construed as a reference to the controller and the procuring processor,

(c) a reference to a “controller” in subsection (2)(d)(v) shall be construed as a reference to the controller or the procuring processor, as appropriate, and

(d) a reference to a “processor” shall be construed as a reference to a secondary processor.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 117:

In page 64, lines 34 and 35, to delete “data protection breach” and substitute “personal data breach”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

This is a standalone amendment.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I have a problem with the clarity of the issue. As I mentioned in the Seanad when dealing with a similar amendment, I am unable to accept an amendment which would insert a new subsection (9) in section 84.

Under section 84 there is already an obligation on a controller to inform a data subject where there is a high risk to the data subject's rights and freedom arising from a breach. In such a case, the controller, in clear and plain language, must notify the data subjects of the nature of the breach, its likely consequences and a description of the measures taken or proposed to be taken to mitigate its possible adverse effects. The proposed amendment refers to a data breach which affects a data subject. It is far from clear what it is intended to mean. Under the GDPR and the law enforcement directive, the thresholds for informing the Data Protection Commissioner of a data breach and informing the data subject whose data protection rights have been breached are defined in terms of risks for the data subject arising from the breach.

If a data breach involves a high risk for the data subject, then the data subject must be given all relevant information and may require further information. I should add that acceptance of the amendment would also create a confusing and perhaps even undesirable divergence between the reporting thresholds in the section and the corresponding provision in the GDPR. I know where Deputy O'Callaghan is coming from, but I am somewhat concerned that we would be making matters less certain. For those reasons, I am not minded to accept the amendment. Perhaps the Deputy would like to think about it further.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The Deputy is withdrawing the amendment.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 119 to 124, inclusive, are grouped.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 119:

In page 66, lines 17 and 18, to delete “A controller, other than an independent judicial authority acting in its judicial capacity,” and substitute the following:“A controller, other than—

(a) a court, or

(b) another independent judicial authority, acting in its judicial capacity,”.

This is a technical amendment. The revised wording is closer to the text of paragraph 2 of Article 32 of the directive. I will briefly refer to the other amendments at this stage.

I recognise the intent on the part of Deputies Daly and Wallace in respect of amendment Nos. 120 to 123, inclusive. They wish to bring the content of the section into line with the corresponding provision in the GDPR. While the directive does not contain or require the same level of detail, I will consider the matter with a view towards a Report Stage amendment if the Deputies withdraw their amendments today. I know what they are trying to achieve, but I do not want to have different consequences.

I see the reasoning of Deputy Ó Laoghaire but I cannot accept amendment No. 124 because it deals with the risk that a data protection officer might encounter non-co-operation, harassment, duress or even victimisation in the workplace as a result and would no longer be in a position to perform his or her duties. We considered that matter during the Seanad discussions in the context of a similar amendment. I am strongly of the view that a more effective remedy is already available to data protection officers under the Protected Disclosures Act 2014 and that it is better that we address these issues under that Act rather than introduce them into data protection.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

We will not fight over this. The Minister is prepared to examine the issue on Report Stage. We are trying to protect the independence of the data protection officer.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

While going along with that and taking on board the Minister's point that data protection officers might have recourse to the protected disclosures legislation, there might be some overlap in some cases. They might make protected disclosures to bring themselves within the scope of this Bill. We think it would be preferable to avoid the need for them to artificially bring themselves under the protected disclosures legislation if they could get protection under this Bill. That is what we are trying to do.

Part of the confusion is that Part 5 is a new Bill. A second Bill has been inserted into the Bill to give effect to the criminal justice directive. Due to the fact that the GDPR does not apply to the criminal justice system, not everything is transposed and so on. We are trying to give data protection officers specific protection against victimisation and being penalised for doing their job. We are allowed to go beyond the directive. That is what we are trying to do and it is necessary because by going beyond the directive we are bringing them in line with the GDPR. That is all that is being sought. We will withdraw the amendment, but if the Minister does not address the issue at a later Stage with something better we will come back with this.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Are amendments Nos. 120 to 123, inclusive, all being withdrawn?

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Yes.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The reason Deputies Daly and Wallace brought forward their amendments and I brought forward mine is that it is quite easy to imagine the circumstances in which a data protection officer is doing his or her job and the data controller has his or her own reasons for trying to frustrate the process. The organisation he or she is responsible for may not be complying properly with data protection or may be abusing or misusing people's data or being careless in some respect. One can see how it would be in the interests of the data controller to frustrate, victimise or harass a data protection officer. That is very apparent.

I appreciate there is the Protected Disclosures Act, but that could be a cumbersome mechanism in some respects. If this all relates to data I do not see how a data protection officer could not say to the Data Protection Commissioner that he or she has an issue with data protection in the organisation in which he or she works and is being frustrated by his or her superior, that is, the data controller and is seeking an intervention and assessment. That is reasonable. There are probably a number of ways that could be done. The existing subsection on corrective powers could be used to facilitate that.

I will press my amendment, but I will not call a vote. I would appreciate if the Minister could consider that. There must be another mechanism beyond the protected disclosure legislation which would be potentially cumbersome and probably quite slow.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

It is my firm belief that a more effective remedy already exists in law, namely, the 2014 Act, section 7 of which deals with the issue in a comprehensive way. I am satisfied that it provides an effective remedy where a data protection officer is experiencing difficulty in the performance of his or her functions.

An important thing to take into account is the fact that a data protection officer who makes such a protected disclosure would enjoy the extensive protections against dismissal and against victimisation or any form of loss or detriment which is provided specifically under Part 3 of the 2014 Act. I believe it is better and clearer if it is under that umbrella. I note what Deputy Ó Laoghaire has said.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 124:

In page 67, between lines 22 and 23, to insert the following:“Protection of Data Protection Officers

86. (1) The Data Protection Commission shall provide a protection, whereby Data Protection Officers may seek the assistance of the Data Protection Commissioner, due to the fact that the Data Protection Office is not in a position to carry out their role fully, due to inappropriate interference from the Data Controller, or duress, harassment or victimisation.

(2) Where the Commission receives a complaint under subsection (1), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Having considered the matter and engaged in consultation, it appears the intended exclusion of Forensic Science Ireland from the provisions of chapter 4 of Part 5 is not required.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 125 to 127, inclusive, are related and may be discussed together.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment. No. 125:

In page 68, line 32, after “concerned” to insert “, including the legal basis for any transfers of data”.

With these amendments, we are adding two points of information to the list in section 88(2) that data subjects have a right to get from data controllers. Most of the items of information in subsection (2), such as information on controller's contact details and the right to lodge a complaint, are replicated in the GDPR and the directive but two of them, namely, the legal basis for any transfers and such further information as is necessary to enable the data subject to exercise his or her rights, which are in the GDPR, have not been included in this Bill. I understand that they are not specified in the directive but, unlike the GDPR, we can go beyond it to strengthen people's rights in this area. That is what we are trying to do.

Amendment No. 126 proposes that the obligation regarding legal transfers will only apply in individual cases where further information is necessary to enable the data subject to exercise his or her rights.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 127 is the third in the group.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

Is there another amendment?

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

No. The amendments are Nos. 125 to 127, inclusive.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I do not believe amendment No. 127 should be grouped with the other two.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

It relates to another section but it is part of the grouping.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

It is funny that it is grouped here. It is slightly different as the GDPR Article 13.2(f) gives people the right to be given information about the existence of automated decision-making, including profiling. The right is not replicated in the directive or this Bill and we think it is no harm to put it in there as it could be valuable. The directive prohibits automated processing, including profiling, that results in discrimination. To enforce the right not to be profiled in a discriminatory way, a data subject has to know they have been subjected to automated processing. To know that, he or she would have to be told about it when he or she exercised his or her right to access information under section 89. At the moment, section 89 does not oblige controllers to inform people of the fact that they have been profiled or subjected to automated processing.

This section is in Part 5, which means we are talking about the potential profiling of innocent people in a discriminatory way by the Garda. We know that ethnic profiling has taken place, so we are trying to provide that a person who asks for information about what the Garda has been up to with his or her data will get the information they need.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Amendment No. 126 is not needed because paragraph (f) of subsection (2) imposes an obligation on the controller to provide further information to a data subject to enable him or her to exercise his or her Part 5 rights.

As regards amendment No. 127, section 89 gives effect to Article 14 of the directive. Rights relating to automated data processing, including profiling, are set out directly in Article 11 of the directive and in section 87 of the Bill.

I am reluctant to accept amendment No. 125, which proposes to insert a specific reference to the legal basis for any transfers of personal data in section 88. The existing reference to the legal basis for processing the data includes reference to transfers because of the wide definition of processing in section 66. In accordance with the definition in section 66, it is clear that processing includes the disclosure of data by transmission, dissemination or otherwise making the data available. This would include the transfer of personal data. My concern is that the inclusion of a specific reference to transfers of data in this section could well cast doubt on its usage, validity or application in other parts of the Bill. Subsection (2)(f)(iii) requires that information be given on categories of recipients, and this includes recipients in third countries and in international organisations.

I will not accept amendment No. 125 and amendment No. 126 is not needed. In respect of amendment No. 127, section 89 refers to Article 14 of the directive.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 126:

In page 68, line 36, to delete “data.” and substitute the following:

“data;

(iv) such further information as is necessary to enable the data subject to exercise his or her rights under this Part.”.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 127:

In page 69, line 30, to delete “interest.” and substitute the following:“interest;(vi) in circumstances where the data subject has been or is being subjected to automated decision-making, including profiling, the fact of same, and information in relation to the logic involved in the automated decision-making, as well as information in relation to the significance and envisaged consequences of such processing for the data subject.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 128:

In page 71, line 23, to delete “sections 91(4)(ii) and 92” and substitute “section 91(4)(ii)”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 129:

In page 71, line 35, to delete “sections 91(4)(ii) and 92” and substitute “section 91(4)(ii)”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 130 and 131 will be discussed together by agreement.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 130:

In page 76, line 4, to delete “privilege.” and substitute “privilege;”

The new paragraph (j) is inserted in subsection (3) of the section in order to protect investigations, inquiries and prosecutions undertaken by the data protection commission into alleged infringements of the law enforcement directive, including data breaches. It carries over the current provision in section 5(1)(gg) of the Data Protection Act 1988, which was overlooked during the drafting process.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 131:

In page 76, between lines 4 and 5, to insert the following:“(j) the performance by the Commission of its functions.”.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 132:

In page 82, line 39, to delete “an independent judicial authority acting in its judicial capacity” and substitute “the courts when acting in their judicial capacity”.

Amendment No. 132 is a drafting amendment that clarifies that the data protection commission shall be competent to supervise the data processing operations of all bodies except the courts when acting in their judicial capacity.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 133, 137 to 154, inclusive, and 159 to 171, inclusive, are related and may be discussed together.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Is Deputy O'Callaghan indicating he will withdraw amendment No. 138 in favour of amendment No. 137?

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Before I bring in the Minister, I will indicate to members that amendments Nos. 138 and 139 are physical alternatives to amendment No. 137. Amendment No. 139 is a physical alternative to amendment No. 138. Amendments Nos. 144 to 146, inclusive, are physical alternatives to amendment No. 143. Amendment No. 148 is a physical alternative to amendment No. 146. Amendment No. 160 is a physical alternative to amendment No. 159. Amendments Nos. 164 to 167, inclusive, are physical alternatives to amendment No. 163. Amendment No. 169 is a physical alternative to amendment No. 168 and amendments Nos. 133, 137 to 154, inclusive, and amendments Nos. 159 to 171, inclusive, will be discussed together. I invite the Minister to respond to Deputy O'Callaghan and then I will bring in the other members when they have heard the Minister's response.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Sections 103, 107, 108, 109, 111, 120 and 121 deal with the complaints handling process, which is both streamlined and comprehensive. I will focus on the key amendments. As regards Deputy Ó Laoghaire's amendment No. 137 and Deputy O'Callaghan's amendment No. 138, both of which would replace section 107(1), I have a serious problem with the introduction of a discretion on the part of the commission not to investigate a complaint that is "frivolous or vexatious."

Amendments Nos. 139, 144, 159, 160, 164 would also allow the commission to decide not to investigate complaints on the basis that they were considered to be frivolous or vexatious. I am completely opposed to the introduction of this discretionary filter into the Bill for a number of reasons. First, it would not be compliant with the GDPR. Second, while the term "frivolous or vexatious" has a specific meaning in our law when used by the courts, that is, that the claim is unsustainable in law and is bound to fail, the term is not understood in other member states, except possibly in a common law jurisdiction such as the UK. On the contrary, to a data subject or a data protection authority in another member state, use of the word "frivolous" suggests that the matter is not regarded as sufficiently serious for investigation, while "vexatious" suggests that the complaint is seen as a deliberate intention to cause annoyance. The scope for such misunderstandings will be much greater under the "one-stop-shop" mechanism because the data protection commission will be acting as lead supervisory authority in many cross-border cases.

Unfortunately, the term "frivolous and vexatious" is used in section 10(1)(b) of the 1988 Act and it has created confusion and misunderstandings in recent years, especially in cross-border cases. In the Schrems judgment, Judge Hogan commented that the wording of that provision "is somewhat unfortunate and perhaps even unhelpful". Its use was widely misinterpreted and misunderstood in the aftermath of that case in which Mr. Schrems successfully contested the adequacy of the safe harbour mechanism. His original complaint concerning the shortcomings of the safe harbour mechanism had been rejected on the grounds that it was frivolous or vexations, that is, unsustainable in law because of the European Commission's decision to recognise the adequacy of privacy safeguards provided by the safe harbour mechanism.

The risk therefore of misinterpretation or misunderstanding will be very much greater in future because of the expected increase in the number of "one-stop-shop" cases handled by the data protection commission, which have originated in other member states. As I said, I cannot accept the alternative models put forward in the amendments to the complaints-handling mechanisms in Chapters 2 and 3 of Part 6. I ask for the understanding and support of the committee in the avoidance of any reference to the term "frivolous and vexatious". I believe that the robustness and effectiveness of the mechanisms outlined in Part 6 will be compromised by the introduction of a filter based on the commission's opinion as to whether a complaint it has received is "frivolous or vexations".

As regards amendments Nos. 140 and 161, a reference to consent of the parties is not required because an amicable resolution cannot take place without the consent of the parties in any event.

On section 108, I am not in favour of replacing reference to 107(5)(e) with a general reference to section 107(1) as proposed by amendment No. 147, where a complaint, following an examination by the commission under section 107(1), has been rejected or dismissed under 107(5)(a) or (b), a data subject has a specific right to appeal against that decision under section 148(a). Where the commission, following an examination of a complaint, has already issued an enforcement notice on the controller or processor in any of the situations referred to in section 107, the carrying out of a further inquiry would be unnecessary. The same applies where a data subject has been provided with advice by the commission, for example, where a data subject is seeking compensation and the commission explains that compensation remains a matter for the courts.

Amendments Nos. 149 and 170, which seek to insert new sections into the Bill, contain provisions that are taken from surrounding sections without deletion of those provisions. This would give rise to confusion and legal uncertainty. I cannot accept the amendments as drafted but I am happy to come back to them on Report Stage.The word "where" is correct and is consistent with usage throughout the Bill. I cannot accept amendment No. 171.

In summary, sections 107, 108, 120 and 121 of the Bill provide, in my view, a coherent and streamlined approach to the future handling of complaints by the Data Protection Commission and I am not disposed to accepting amendments that would militate against that coherence or streamlined frame that is envisaged under the Bill.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

In regard to the Minister's response to amendments 137 to 139, inclusive, I am sure that like me the other Deputies involved were of the view that these amendments would strengthen the obligations rather than weaken them or create any greater discretion, particularly, in the first instance, the word "investigate" as opposed to "examine" and, in the second instance, the reference to a formal decision, except where a matter is frivolous or vexatious. As mentioned by the Minister, the words "frivolous" and "vexatious" are frequently used in respect of cases which fail to reach a fairly low threshold. I note what the Minister says but it appears to me that as things stand in the Bill there is greater discretion and flexibility than would be the case were amendments Nos. 137 and 138 accepted, in regard in particular to the requirement for a formal decision, which, I think, is important.

Charles Flanagan (Laois, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am happy to take another look at the amendments and to engage bilaterally with the Opposition Members who tabled them. I am anxious to ensure that the provisions of Part 6 are not compromised by the introduction of a new layer in terms of whether a complaint is frivolous or vexatious. I am conscious that there are different interpretations and different understandings in this regard. However, I will take another look at the amendments. I do not want to overestimate what is a real problem. Given the manner of interpretation of words such as this I am concerned. It is within this framework that I would be happy to discuss the matter further. I am happy to listen further to Deputy Ó Laoghaire and Deputy O'Callaghan, as always.

I beg leave of the committee at this point as I have an important meeting to attend at 5 p.m., for which I am already late. I will leave the committee in the very capable hands of the Minister of State, Deputy Pat Breen, who under the Department of the Taoiseach has special responsibility in this area.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

The Minister of State, Deputy Breen, is taking up the baton.

Pat Breen (Clare, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Yes.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

He is very welcome.

Pat Breen (Clare, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I have all night.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I thank the Minister, Deputy Flanagan, for being here. I ask members to please note it is my sincere hope that we will drive this Bill to a conclusion this evening.

Are there any further contributions on this grouping before we move on?

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I welcome that the Minister is willing to take another look at the amendments for Report Stage.

Pat Breen (Clare, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 134:

In page 85, between lines 11 and 12, to insert the following:

“(3) Where a person is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3—

(a) a reference in sections 115, 126 and 133(10) to a controller shall be deemed to be a reference to the appropriate authority that, or the Minister who, made the designation, and not to the person, and

(b) a reference in sections 130(6) and 131(10) to a controller shall be deemed not to include a reference to the person.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 135 is co-sponsored by the Minister and Deputy O'Callaghan and it was discussed with amendment No. 108. I ask Deputy O'Callaghan to move the amendment.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 136, 155 to 158, inclusive, and 172, 173 and 190 are related and may be discussed together by agreement.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 136:

In page 86, between lines 18 and 19, to insert the following:

“Rights under Article 80(1)106. (1) In addition to the rights conferred on a data subject under Article 80(1) to mandate a not-for-profit body, organisation or association to which Article 80(1) applies to lodge a complaint on his or her behalf with the Commission and, under section 15(7) to take a data protection action on behalf of the data subject, a not-for-profit body, organisation or association to which Article 80(1) applies may, independently of a data subject's mandate, and if it considers that the rights of a data subject under a relevant enactment have been infringed as the result of the processing of personal data in a manner that fails to comply with a relevant enactment, take the following actions on behalf of a data subject:

(a) lodge a complaint with the Commission under section 107;

(b) exercise the rights referred to in section 115 and section 148.

(2) Where the Commission or a court, in performing its functions under this Act, has reasonable doubts as to whether a particular body, organisation or association is one to which Article 80(1) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.”.

Deputy Clare Daly was supposed to speak to amendment No. 136. I would like to speak to amendments Nos. 155 to 158, inclusive. Section 115(7) of the Bill as drafted permits not-for-profit bodies such as, for example, Digital Rights Ireland, to bring an action on behalf of a data subject when it has been mandated by the data subject to do so. However, as argued by Dr. T.J. McIntyre during the pre-legislative scrutiny process, the Bill should provide that not-for-profit bodies also be allowed to independently bring actions without their having to be mandated by an individual data subject to do so. Amendment No. 155 seeks to remedy this. Perhaps the Minister of State, Deputy Breen, will explain why the Bill excludes this as I understand Article 80 includes this possibility as a discretionary provision, although in such cases compensation for damages would not be awarded unless the Article 80 body was specifically mandated by a data subject to bring the action.

Amendment No. 156 is an attempt to address the lack of provision in the Bill for a not-for-profit body of the type described in Article 80 of the GDPR, for example, Digital Rights Ireland, to bring an action for compensation for damages on behalf of a data subject. I do not understand why this is prohibited. Dr. T.J. McIntyre made a compelling case for it during the pre-legislative scrutiny phase. He said that, without it, there would be a gap in protection for data subjects. We must remember that when a data subject seeks to take a case for a data breach or violation of his or her data rights, he or she would in many instances be forced to discuss sensitive personal data publicly. Therefore, many people would be reluctant to come forward and become the public face of an issue. There is also the fact that many, if not most, individuals affected would not have the financial ability to bring an action themselves. Class actions are not permitted in Ireland as of yet. If a large number of people are affected by a single data breach, it makes sense on a practical level that they could be represented by a single Article 80 body instead of them taking cases individually, which the courts would not be equipped to handle. Surely it would make sense that Digital Rights Ireland, for example, should be allowed to act on behalf of such people if it is mandated to do so, as the GDPR permits, without taking the possibility of compensation off the table for complainants.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

There are eight amendments in this grouping, all of which are in the names of Deputies Daly and Wallace. Would the Minister of State like to respond?

Pat Breen (Clare, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Yes. Section 115 makes provision for a judicial remedy in the case of infringements of the GDPR. Article 80.2 of the GDPR recognises that a member state may allow in its national laws for a not-for-profit body, association or organisation to take action on behalf of a data subject without the data subject's mandate. However, that is not part of our law and compliance with the GDPR does not require such a provision.

The restrictions in the Bill on the taking of compensation claims by a not-for-profit body, association or organisation is understandably intended to discourage speculative compensation claims, especially where the data subject will be relieved of any risk that costs of the action might be awarded against him or her. There are sound public policy reasons for discouraging the growth of a compensation culture in respect of data protection claims, which is reflected in the Bill's provisions. As Deputy Wallace may be aware, there is already concern at the level of compensation claims, which is contributing to increasing insurance premiums and affecting business, especially SMEs. I am very conscious of this matter when I wear my other ministerial hat.

I cannot accept subsection (8) as proposed in amendment No. 155 or subsection (9) as proposed in amendment No. 157. The same applies to amendment No. 136, which seeks to make provision for the taking of action on behalf of a data subject without a mandate, or permission, from him or her. Deputy Wallace referred to amendment No. 156. I cannot accept it, as it would allow courts to award compensation to data subjects in cases taken under section 115 by a not-for-profit body, association or organisation on their behalf.

Regarding amendment No. 158, the position is that Article 55 of the directive, unlike the GDPR, does not provide for actions to be taken on behalf of data subjects without their permission. For this reason, I cannot accept the amendment, which would allow a not-for-profit body, association or organisation to take action on behalf of a data subject under section 118 without his or her permission. This is understandable, given that the data subject might have specific reasons for not wishing the case to be taken.

I cannot accept the proposed changes in amendments Nos. 172 and 173 to section 126 for the reasons already outlined in respect of the GDPR. That being the case, amendment No. 190, which proposes to amend section 146(1) in order to accommodate the withdrawal of complaints by a not-for-profit body, association or organisation that has not been mandated to act on behalf of a data subject, is not required.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Would Deputy Wallace or any other member like to reply to the Minister of State's contribution?

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

We are being guided by Dr. McIntyre on this matter. We found him to be in a different class than everyone else, as he understands this matter better than all of us, so we will stick with his guidelines and press the amendments.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

As no other members wish to reply, does the Minister of State wish to make a further comment?

Pat Breen (Clare, Fine Gael)
Link to this: Individually | In context | Oireachtas source

Deputy O'Callaghan said what had to be said, and as I have already outlined, this provision would cause many problems.

Donnchadh Ó Laoghaire (Cork South Central, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 137:

In page 87, to delete lines 5 to 8 and substitute the following:“107. (1) For the purposes of section 106(2)(a), on receipt of a complaint the Commission shall investigate the complaint, and issue a formal decision on the conclusion of the investigation, save where subsections (2) to (4) apply, unless the Commission considers the complaint to be frivolous or vexatious.”.

I will withdraw the amendment with a view to resubmitting it on Report Stage.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 138 in the name of Deputy Jim O'Callaghan has already been discussed with amendment No. 133. If the question on amendment No. 138 is agreed to, amendment No. 139 cannot be moved.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 139 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 139:

In page 87, to delete lines 6 to 8 and substitute the following:“and, unless subsections (2) and (3) apply, take the following actions—

(a) cause such inquiry as it thinks fit to be conducted in respect of the complaint, unless the Commission is of the opinion that the complaint is frivolous or vexatious, and

(b) following such inquiry, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 142 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 142:

In page 87, line 20, to delete “complaint, to take an action specified in subsection (5)” and substitute “complaint and following the conduct of an inquiry into the complaint under subsection (1)(a) to comply with section 109*”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 143 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133. I advise that if the question on amendment No. 143 is agreed to, amendments Nos. 144 to 146, inclusive, cannot be moved.

Clare Daly (Dublin Fingal, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 143:

In page 87, to delete lines 21 to 39, and in page 88, to delete lines 1 to 3.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 147 in the name of Deputy Jim O'Callaghan has already been discussed with amendment No. 133. I advise that if the question on amendment No. 147 is agreed to, amendment No. 148 cannot be moved.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 148 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 148:

In page 88, line 5, to delete “section 107(5)(e)” and substitute “section 107(1)(a)".

We will reintroduce the amendment on Report Stage.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendment No. 149 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 149:

In page 88, between lines 11 and 12, to insert the following:“Decision of Commission when inquiry under Chapter 2 conducted under section 107(1)(a)

109. (1) Where an inquiry has been conducted under section 107(1)(a)*, the Commission, having considered the information obtained in the inquiry, shall—

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect and dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, and having regard to the nature of the infringement, make a decision as to whether

(a) an enforcement notice should be served on the controller or processor requiring it to do one or more than one of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

(iv) bring processing operations into compliance with the provisions of a relevant enactment, in a specified manner and within a specified period;

(v) refrain from taking specified actions,

(b) a corrective power should be exercised in respect of the controller or processor concerned, and where it decides to so exercise a corrective power, the corrective power that is to be exercised, or

(c) such other action as the Commission considers appropriate should be taken.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

(4) The Commission shall—

(a) as soon as practicable after a decision under this section is made by it, give the controller or processor concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor,

and

(b) as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

(i) the decision and the reasons for it,

(ii) the action, if any, taken on the basis of that decision,

(iii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.”.

Caoimhghín Ó Caoláin (Cavan-Monaghan, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

Amendments Nos. 150 to 154, inclusive, in the names of Deputies Clare Daly and Mick Wallace have already been discussed with amendment No. 133.

Mick Wallace (Wexford, Independent)
Link to this: Individually | In context | Oireachtas source

I move amendment No. 150:

In page 89, line 18, to delete “, where an inquiry has been conducted in respect of the complaint,”.