Skip to main content
Normal View

Joint Committee on Children, Equality, Disability, Integration and Youth debate -
Tuesday, 13 Jul 2021

General Scheme of the Birth Information and Tracing Bill 2021: Discussion (Resumed)

If any members or witnesses who are participating remotely are experiencing any sound or technical issues, I ask them to let us know through the "chat" function in Microsoft Teams, otherwise I will proceed with the meeting. Apologies have been received from Deputy Dillon and Senator Ruane. Senator McGreehan is hoping to join us but she will connect remotely to today's meeting.

I remind members who are participating remotely to keep their devices on mute until they are invited to speak. When they are speaking, I ask them to, where possible, have their cameras switched on. I remind them to be mindful that we are public session. I also remind members of the constitutional requirement that members must be physically present within the confines of the place in which the Parliament is choosing to sit, which is Leinster House or the Convention Centre Dublin, to participate in public meetings. I will not permit a member to participate where they are not adhering to that constitutional requirement. Any member who attempts to participate at this meeting from outside the precincts will be refused.

The committee is resuming pre-legislative scrutiny of the birth information and tracing Bill 2021. I sincerely welcome the representatives from the Data Protection Commission, DPC, who will address the committee virtually via Microsoft Teams. The meeting today will comprise two sessions, each of one hour's duration. Members will engage with representatives of the Irish Human Rights and Equality Commission in the second session.

We are joined for our first session by Mr. Dale Sunderland, deputy commissioner, and Mr. David Murphy, assistant commissioner. The purpose of our meeting is to engage with both our guests on the pre-legislative scrutiny of the Bill. The purpose of the proposed legislation is to enshrine into law the importance of an individual knowing their origins. Before I ask our guests to deliver their opening statement, I must advise them about the parliamentary privilege that applies when they are addressing a parliamentary committee. As all of the witnesses are appearing before the committee virtually, I need to point out that there is uncertainty if parliamentary privilege will apply to evidence given from a location outside the parliamentary precincts of Leinster House. Therefore, if our guests are directed by me to cease giving evidence about a particular mater, it is imperative they comply with any such direction.

Our guests will be allocated three minutes' speaking time and due to the time constraints we are under this afternoon, I must strictly adhere to the time allocation. We will have the opening statements, followed by a question-and-answer session with members. A speaking rota was circulated to members in advance of the meeting and members will also be allocated three minutes each. We will allocate any extra time at the end of the meeting.

I call Mr. Sunderland to deliver his opening statement. I sincerely welcome him to the meeting and thank him for joining us.

Mr. Dale Sunderland

I thank the committee for the invitation to appear before it and for facilitating contributions from the DPC on the committee's discussions, assessment and deliberations on the general scheme of the Bill. I am one of the deputy commissioners at the DPC with responsibility the commission’s supervision, guidance and international affairs functions. My colleague, Mr. David Murphy, assistant commissioner, supervision section, is also in attendance.

By way of general observation, the DPC notes that the broad intention of the draft heads of the Bill is to provide "relevant persons" aged 16 or over with access to a range of records and information, including their birth certificate, early life information, care information and medical information. The 1998 ruling of the Irish Supreme Court in I.O'T v. B and the Rotunda Girl’s Aid Society, and MH v. Rev GD and the society found that neither of two constitutional rights – the right to know about one's origins on the one hand and the right to privacy on the other – were absolute and that each might be constrained by the weight of the other, as well as the weight of the common good. That has resulted in the past, and still results, in a position where agencies in Ireland tasked with providing access to birth and early life information of adopted persons have had to do their best on a case-by-case basis to balance the competing rights in the cases on hand.

The DPC notes the Government's intention to propose legislation to the Oireachtas codifying how the balancing of these non-absolute rights should be achieved with a start and end point in favour of the right to identity information. The DPC considers that it is important in the context of this Bill that clear articulation is given to the proposed policy position to be adopted in favour of providing birth certificates to relevant persons aged over 16 without any process allowing for objection by a birth parent. An example of such an objection could be on the grounds that it would seriously harm him or her. Given that the previous iteration of this Bill outlined such a process, it is important that there is clarity around the policy change and why the balancing of rights in these sensitive situations is now deemed to have changed in favour of an absolute right to identity data. To be clear, the DPC does not advocate for either position. We are simply pointing out that data protection and privacy issues arise and the State must be able to articulate how it has come to the policy position and what considerations underpin the balancing of rights presented in the Bill.

With regard to the balancing of rights, it is clear that Article 15 of the general data protection regulation, GDPR, which provides the right of access to personal data, is not absolute. Article 15.4 states that the right to obtain a copy of personal data shall not adversely affect the rights and freedoms of others. That underlines the need for the Department, Government and Oireachtas to be clear in the context of the Bill as to how the rights and freedoms of the birth mother are not adversely affected to the extent they would restrict the right of access of the individual to information about his or her identity.

To be of assistance to the work of the committee, appended to my opening statement are the preliminary observations of the DPC on the Bill, as provided to the Department of Children, Equality, Disability, Integration and Youth. Those observations address the balancing of rights in addition to other data protection considerations such as the importance of transparency, the difficulties in treating data, including medical data, as anonymous in this context, and the limitation or restriction of rights provided under GDPR. The Department has responded positively to the DPC’s observations and has committed to further addressing the matters raised.

As part of the consultation process, we yesterday received a copy of a data protection impact assessment, DPIA, from the Department but we have not yet had the opportunity to assess it. I cannot, therefore, give the committee the view of the DPC as to whether the DPIA satisfactorily addresses all the data protection issues that arise. The DPIA provides an opportunity for the Department to interrogate the proposed processing of personal data in depth in terms of its justification on the basis of necessity and proportionality, in particular the balancing of the right to access to identity on the one hand, and data protection and privacy rights on the other.

It also provides an opportunity to identify and mitigate any data protection risks that arise. We note that many of the operational aspects of the Bill will be left to the formulation to be decided in guidelines., including the conduct of the tracing function. Again, the DPIA process is the mechanism by which the formulation of those guidelines can be informed and consideration given to all the necessary data protection policies and measures, including technical and organisational measures required to ensure compliance with data protection law. I will finish there. I hope these comments will be of assistance to the committee. I am happy to take any questions members may have.

I thank Mr. Sunderland. We will move straight into the questions from Deputy Cathal Crowe. I ask him to please confirm his location.

I confirm that I am in Leinster House 2000.

I read Mr. Sunderland’s statement, and I followed his delivery of it. The one thing I wanted to home in on was article 15.4 of the GDPR. We are trying, insofar as is possible, to scrutinise this legislation, and ensure that when it comes out the other end is that it is very much favourable to the survivors and victims of the mother and baby homes. This is so that they can go back and rightly trace their identity and obtain biological records that relate to themselves, potential medical situations, etc.

There are two conflicting rights. Article 15.4 states that the “right to obtain a copy of personal data should not adversely affect the rights and freedoms of others”. GDPR is an EU regulation and comprises set of laws that have come from Europe. Each nation has taken them on. They have come in regulation format. However, it seems that, over the years, we in Ireland have had different interpretations at times. That should not be the case insofar as regulations are concerned. However, we have had a different interpretation over the years on a number of fronts. One example is CCTV, although it comes from a different realm entirely. We are at odds with some other European nations in some of our appraisals of GDPR. Could Mr. Sunderland elaborate on the incongruence of article 15.4? How does he believe that we as a committee, as we try to shape this legislation, can ensure compliance, while still ensuring maximum data is available to the survivor or victim?

Mr. Dale Sunderland

I thank the Deputy for his question. He rightly pointed to article 15.4. Article 15 is part of the GDPR, which came into application in Ireland in May 2018. As I said earlier, article 15 acknowledges that an individual's right of access to personal information is not an absolute right. It can be restricted if the information could adversely affect the rights and freedoms of others. In the specific context of the Bill, article 15.4 relates to the right of privacy of the birth parent or, particularly, of the right of the mother. That is the core right in play. In essence, the Bill facilitates the right of access. It gives expression to article 15 in respect of the relevant person's broad ability to access information about themselves. However, it has to be done by balancing, or looking at, the other rights. It has to conclude whether those rights are being adversely affected. There is, therefore, a balancing act between the different rights.

The implementation of safeguards can provide justification for a measure. It appears to the DPC that the Bill seeks to achieve that in number of ways. It proposes a form of safeguards to protect the rights and freedoms of others. For example, only an individual aged 16 or older can be issued with a birth certificate. It allows parents to register their contact preference to the national adoption contact preference register. It proposes an information campaign during the three-month time period, following the commencement of section 3 of the Bill. It proposes that only a relevant person can apply for a birth certificate following the passing the of the three-month time period. Where a no-contact preference is registered, there has to be an information session, and so on. It is not for the DPC to say whether they are effective safeguards. It appears to us that the purpose of all those measures within the Bill is to strike the right balance and ensure the privacy rights of the birth parents are not overly or adversely impacted. It seems appropriate to us that the Oireachtas would provide means to ensure that the balance is appropriately struck, and that this right is not adversely or overly impacted. The Deputy referred to balancing. That is what we see the Bill trying to do. We will see what has been provided to us by the Department in its DPIA. We expect within that assessment to see a further elaboration on each of these measures and how the Department believes that these are appropriate safeguards that allow the right balance to be struck and provides for this broad right of access to information to be allowed in a way, as Article 15.4, states, “adversely affect the rights and freedoms of others”. We have raised a number of questions, to which I can speak later, if the Deputy so wishes. However, we have raised in the observations we provided to the committee a number of the issues we would like to raise.

I apologise for interrupting Mr. Sunderland. We need to move on to other members. I call Senator Mary Seery Kearney.

I thank Mr. Sunderland for his opening statement. More importantly, I thank him for his submission. I am keen to contextualise this discussion of the balancing of rights. My mother gave birth to me in the Coombe Women's Hospital. From the moment I was born, or within a feasible administrative period, I had access to my birth certificate, which stated who my mother and father were. The objective of this legislation is to enable others to have a parity of entitlement to fundamental information about themselves.

While I agree a balance needs to be struck, the balance primarily in this legislation is the requirement of this information session or information meeting. The purpose of the information at that meeting is to impart that there is a no-contact preference, and that the privacy rights of the birth parents need to be respected. In this way, the State vindicates the right to privacy of the birth parents, while not in any way inhibiting the right to personal or identity information on the part of an individual. That is their fundamental right. I see this as being the balance is in the Bill.

In Mr. Sunderland’s submission, I am concerned to see him raise issues such as "sanction" and "safeguards" in that context. I am concerned that this meeting will not send out the message that a sanction will be considered anywhere. People do not need to engage GDPR in many respects to track down parents. The point of this is to have access to information. Mr. Sunderland said that perhaps the contact preference meeting should include all those who have not indicated a contact preference. I am a little concerned about that as well because it suggests that we reverse the onus. If we were to pursue that line, instead of having an obligation to register for no contact, it would become an obligation to register for contact. At the moment, there is a presumption that if someone has not registered a no contact preference, then contact is fine whereas, if we were to move with Mr. Sunderland has put forward, that would reverse that onus. I am not sure that balances the fundamental right to information about who someone is as an individual. I am, therefore, concerned about that. I would appreciate Mr. Sunderland’s comment. I would like him to bear in mind that I would like this to be a conversation and not a challenge. These were the issues that jumped out to me, as well as many others.

Does Mr. Sunderland want to address some of those questions?

Mr. Dale Sunderland

Yes. I thank the Senator for her comments. We do not disagree at all with the view she expressed. As the body that looks at the processing of personal data and the balancing of rights, we are simply posing a number of questions that should be looked at by the Department. We are not saying that those are the solutions by any means. We are not disagreeing with what the Senator said but merely providing our analysis in that when you look at the balancing of rights, you look at a whole suite of safeguards that might be implemented and choose ones that strike the right balance and will best achieve the desired outcome, which is the appropriate balancing of rights. We raise questions the Department should consider and either rule in or rule out.

The point we are really making is that it should be clear the Oireachtas did the balancing exercise with this Bill and found, at a global level, that the balance lies in favour of the adopted child, subject to safeguards proposed in the legislation. That is what we believe the Oireachtas needs to achieve overall. The detail is in how that is done. We are not saying the safeguards proposed in the Bill are inadequate by any means, we are just asking if the proper analysis has been done to substantiate and demonstrate that the balance has been appropriately struck. That is all we are trying to achieve in our observations. I want to be clear about that.

Again, there is also a distinction between data protection and privacy. In the context of article 15(4), we are talking about the privacy rights of the mother and how that provision is satisfied so those rights are not adversely affected. As I said, we are not suggesting that these provisions need to be included in the Bill. We are just asking if all these matters have been considered in ensuring the right balance is struck between the two competing rights.

On the issue of the lawful basis of processing, a lawful basis is provided for by article 7(1)(e) and Recital 45 if we engage that purposeful legislative basis in the context of public interest. Does the creation of this legislation provide that lawful basis?

Mr. Dale Sunderland

I can reply but I do not want to overrule the Chair.

I ask Mr. Sunderland to be very brief as we have to move on to others.

Mr. Dale Sunderland

The legislation provides a lawful basis but in accordance with EU law and legal precedent it has to be established that the legislation is both proportionate and necessary. If rights are being restricted, it has to be demonstrated that the appropriate balancing has been carried out. It is not simply a matter of stating that the legislation provides for it and, therefore, it de facto meets all the requirements. That analysis has to be done before the legislation is enacted. That flows from EU legal principles.

Has the Data Protection Commission reached the end of the line in its involvement with this legislation? I ask this because if there is to be a data protection impact analysis, presumably the DPC is still in, what I would call, an iterative process in respect of the legislation. I ask Mr. Sunderland for clarity on that.

Mr. Dale Sunderland

The process is continuing. There is an obligation under article 36(4) of the GDPR for the Government or State to consult us on proposed legislation. As I said, we just received yesterday a copy of the data protection impact assessments, which we have not yet had a chance to review. We will be doing that and will be engaging further with the Department on any observations we may have. That is the current position.

I am trying to think forward to where there might be - I will use the word "dispute", though lightly - a dispute between two parties, the parent and the child. If it reaches the point where there is a dispute, where does the DPC see itself in terms of the existing legislation in respect of dispute resolution and in the context of this legislation when it is passed? In other words, when there are competing parties, as I understand it, the DPC seeks to mediate between them. If a situation arises, however, that is beyond mediation or agreement, where stands the DPC in all of that? I hope that question makes sense. If it does not, tell me straight out.

Mr. Dale Sunderland

It does make sense. The Deputy is referring to the role of the DPC as an independent authority for assessment of compliance with data protection law. In a hypothetical situation, should either party make a complaint to the DPC stating that his or her personal data, because of this Act, or Bill when enacted, has been unlawfully processed, we would handle that in accordance with our procedures. We would assess the issues, handle the situation in an appropriate way and investigate it to the extent necessary. All of the procedures under the Data Protection Act 2018 would kick in.

I want to be clear that this is about data protection. We can only regulate in respect of the processing of personal data. Bigger issues are at play here regarding privacy rights and the DPC does not adjudicate per se or directly on those. The DPC only comes into play in the context of article 15(4), for example, where the rights and freedoms of others have to be taken into account. First and foremost, however, our regulatory responsibilities and only mandate is to regulate in respect of the processing of personal data. Theoretically, a complaint could be submitted to the DPC. We would have to adjudicate that complaint fairly and impartially as we are required to do under law and then make a determination on whether the processing of the personal data was lawful or not.

This was an issue that was on my mind and I wanted to seek clarity on it. Mr. Sunderland has confirmed what I thought. This is an iterative process and the DPC has yet to fully analyse or process the data protection impact assessment. In light of that, and once that analysis is done, I ask the Chair if there is a possibility of hearing further from the DPC on how this legislation works in the context of its responsibilities? I would welcome a further submission on that. I will leave it at that.

Mr. Dale Sunderland

We are always happy to engage with any Oireachtas committee, including this one. We will be making our observations to the Department. It is really for the Department to make its assessments as to how it takes those observations on board. While we are happy to appear before the committee again to discuss any observations we have, I also suggest that the view of the Department is of even more crucial importance in terms of its responsibilities because that is ultimately where it lies at this stage. We are more than happy to come before the committee.

I should have said that if this legislation is passed, it will grant access to the personal data concerned. From the DPC's perspective, this committee debate and the process of passing the Bill before the Oireachtas will form part of the demonstration to a complainant that the Oireachtas has carefully considered the balance of rights. When we look at something like this, we do not look at it in isolation. We will look at the intention of the Oireachtas should the Bill pass in due course.

I thank Mr. Sunderland. This is a really enjoyable and informative session of the committee. I also welcome the news that the data protection impact assessment has been drafted. It is a pity members of the DPC have not had time to appraise it and I look forward to seeing that appraisal. As the witnesses said, it is about getting the balance right between the conflicting rights of the right to identity on the one hand and the right to data protection and privacy on the other. It is a very fine balancing act.

As Mr. Sunderland mentioned, a very comprehensive data protection assessment will be key to formulating the appropriate guidelines. The witnesses only received the assessments today so I am putting them on the spot a little, but when will they be appraised by the Data Protection Commission? Will its observations be published?

What happens after that? I want to echo the comments of Deputy Sherlock. It might be worthwhile bringing in the DPC after it has had a chance to appraise the impact assessment.

Mr. Dale Sunderland

I thank the Deputy for his question. We will immediately commence our review of the DPIA. I hope that process will be concluded within a few weeks. It is not the intention to delay that process. We want to conclude it as quickly as possible. The Department is obliged to consult us under the GDPR and we will communicate our views to it. We will have a fuller picture at that stage and I hope that the answers to many of the issues and questions we raised in our initial observations will be very clear and the Department will have set out the issues very clearly. That is my hope. I have not read it yet.

As I said, we are happy to come before the committee again. The view of the Department on whether it is going to accept the DPC's views is critical. If it is, we need to know how that will be addressed. As I said, if there is invitation forthcoming to the DPC we will of course be happy to facilitate that.

On a point of clarification, I refer to the process. The DPC will evaluate and appraise the recommendations from the data protection impact assessment and it then goes to the Department. At that stage it is up to the Department whether to publish the information. What happens at that stage? I would be interested in seeing it.

Mr. Dale Sunderland

That is the case. We have seen good examples in the past where data protection impact assessments have been published. For example, the Department of Health published the Covid tracker app data protection impact assessment. As a general position, we, in the interests of transparency, recommend the publication of a data protection impact assessment.

I thank the witnesses.

I have a couple of questions and if there is time I will come back in with more depending on how long the answers are, if that is okay.

Head 40 sets out a list of requirements for when or if the Government wants to restrict GDPR rights. Is that compliant with Article 23 of the GDPR, which sets out when member states can make those exemptions? Is it permissible at present for the Department of Children, Equality, Disability, Integration and Youth to refuse people access to information about themselves on the basis that it also concerns a deceased person? Is it permissible at present for the Department of Children, Equality, Disability, Integration and Youth to refuse to give people's medical information directly to them and instead require people to hand over their doctor's details in order that the Department can speak to a doctor about whether they pose a risk to themselves?

Does the Bill attempt to stop GDPR operating in respect of all data controllers other than what the Bill refers to as the relevant bodies? They are currently proposed as the Adoption Authority of Ireland and Tusla. If that is the case, is that permissible under GDPR? Why should people not be entitled to request their data from whoever holds it, including the Department of Children, Equality, Disability, Integration and Youth and other private organisations under current GDPR provisions? The scheme does not provide a mechanism for adopted people involved in forced family separation to access the administrative files of institutions, agencies and individuals and a full range of the records held by State bodies and private entities concerning early life information.

I will start with those questions. If there is time, I will come back in with more.

Does Mr. Sunderland want to come in on some of those questions?

Mr. Dale Sunderland

I thank the Deputy. My colleague, Mr. Murphy may come in on one of the questions on medical information.

In respect of Article 23, it is a matter where we raised a note of concern with the Department. The Bill provides for very blanket provisions restricting all rights under GDPR to the extent necessary to enable persons to access birth and related information in accordance with the provisions of the Act and to enable the agency and authority to provide a tracing service in accordance with the provisions of the Act.

On the Deputy's latter questions, those restrictions or rights can only act insofar as the Act is concerned. If there was an intention to restrict in all forms, it would need to be much more explicit. Insofar as the restrictions apply, it will be in the context specified by the Act. That would be our reading of the matter.

The problem with a blanket exemption or restriction of rights is that it is not, we believe, in accordance with what the GDPR requires in Article 23. We raised this with the Department. We have questioned whether it meets the criteria set down in Article 23 and have recommended that it review the position.

For example, it is proposed to restrict the right of erasure, which may be a logical position to take. However, Article 17 of the GDPR already provides exemptions which may apply in certain circumstances. The right of transparency is a very important right. Why would there be a blanket restriction? These are the questions we are asking. It is something about which we want to hear further from the Department. If it is not that the restriction of rights is not legitimate in certain circumstances, that needs to be much more defined and specified in terms of the rights that are being restricted, the reasons and the specific sets of circumstances.

In respect of the Deputy's question on deceased person's access to data, I am only aware of this matter through some public commentary. I do not know all of the details. The GDPR sets out a process. An access request can be submitted by an individual for access to his or her data. There may be an element of mixed data such as, for example, a birth certificate which has someone else's name on it where that person is deceased. That is the very issue at the centre of discussions on this Bill. If another person is on the birth certificate, the Department has to carry out a balancing test in terms of the release of the data. It is possible that other third party data may be released in that context.

If the person is deceased it is another set of circumstances in the sense that GDPR is explicit in saying that the regulation does not apply to the personal data of deceased persons. The Department has to work through the analysis on that. First and foremost, any request from a person about access to his or her data is a valid request. I am not sure this is the case but it would not be possible to submit an access request for someone else's data, whether they are alive or deceased. That would not be a valid access request under GDPR. However, there may be alternative circumstances where the information of a deceased person is sought, but it is not sought under the GDPR, if I am being clear, because the right of access, first and foremost, relates to one's personal data. It then extends out and there is a concept of mixed personal data. A birth certificate is a very good example of that.

I am happy to come back on that further, if I have not been clear enough. I will hand over to Mr. Murphy to address the question on medical information.

Mr. David Murphy

The Deputy's question referred to the application of the Data Protection (Access Modification) (Health) Regulations 1989 from the Department in respect of access requests made regarding the database of the Commission of Investigation into Mother and Baby Homes and Certain Related Matters. We understand from the public commentary that this has been very difficult. People have been waiting a very long time to make these access requests and it now seems that another barrier is being thrown in their way.

Under the Data Protection Act 2018, the 1989 regulations continue in force. Their purpose is, essentially, to prevent the release of what is called medical information to an individual under an access request where there is a risk of serious harm to the physical or mental health of that person. It does not necessitate engagement with that person's GP. There is a hierarchy of appropriate medical professionals and practitioners who can make that assessment on behalf of the controller. We have engaged with the Department on its application of the regulation.

We can also say that we are aware from the Department that moves are in place to amend these regulations. We welcome that, principally from the point of view that these regulations date from 1989 and perhaps represent a very paternalistic view of access to medical documents that might have been prevalent at the time.

They represent a paternalistic view of access to medical documents that might have been prevalent at the time. Section 60 of the Data Protection Act specifically envisages that the Minister will update these regulations and we would welcome if that was done with full stakeholder engagement, involving patient representatives, the Medical Council and so forth. In addition, Article 23 of the GDPR specifically envisages the possibility of restricting rights such as access, where necessary, to protect the data subject. In that sense it is not contradictory in and of itself to the GDPR, in that it is a possible ground to restrict access where it may harm the individual, but the application of this needs to be addressed carefully. We welcome the intention of the Department to update and amend the regulations in the future.

Mr. Dale Sunderland

I might add that we are not convinced. As Mr. Murphy said, we have questioned the application by the Department in this context. We believe that this regulation was never intended for medical records held in the context of mother and baby homes. There are one or two options. Either the statutory instrument is amended, and that is what the Department has indicated, or there is a pragmatic approach under the current statutory instrument that could be used where a medical professional, on behalf of the State, would do a general analysis of the records held, not on a case-by-case basis but on a general basis, and determine whether there is any serious impact arising to individuals from releasing them. That is a potential pragmatic approach we suggested to the Department as well. They are the options but, as my colleague said, we have questions about its application and we welcome the fact that the Department has indicated that it is going to amend the regulation shortly, specifically as it relates to the mother and baby homes commission archive. However, there is a broader context around this regulation, which my colleague referred to, and that also must be addressed.

Deputy Cairns and Senator Seery Kearney have other questions so I will take both of them together and then hand over to Mr. Sunderland to respond and make any concluding remarks.

I am happy to let Deputy Cairns proceed on the basis that it flows from what she has been asking.

I thank the witnesses for their responses. In the interests of time, I will not go back into the other questions, although I might follow up after the meeting. Is it permissible under the GDPR to have blanket restrictions on several categories of personal data access? Care information is defined as excluding information about a parent's care of a person, so there is a total exclusion of identifying information about siblings. Presumably, who one is a sibling of is one's personal data. Am I correct in thinking that?

Mr. Dale Sunderland

One needs to look at a case-by-case assessment. I probably need to reflect on it, but one cannot just assume that who the person's siblings are is necessarily the person's personal data. It is a complex situation and the further one moves out, the less of a link there is. Personal data has to relate to the person as an individual and, through direct or indirect means, the person can be identified from that data. It would be hard to envisage a situation where the name of one's sibling or who that is would be constituted as one's personal data. It is different in the context of a direct relationship between a parent and the child specifically where that personal data is recorded on a birth certificate. It is a complex question and I am afraid that I am probably not going to be able to answer it in full today. It would be my general position that one could not automatically say that information about a sibling is one's personal information. There may be certain cases where that is the case, but it would have to be looked at on a case-by-case basis, to look at the link and whether there is any joint or mixed data. There is a difference between mixed data and what can be constituted as one's personal data. There can be a context where there is mixed data, for example, a bank account. A spouse's data may be included in the same bank account details as the person's in terms of a joint account, but that does not per se mean that one's spouse's data is one's personal data. That is a practical example of where that might arise. I will leave it at that.

My questions are less complex. When I envisaged the coming into force of the GDPR, it was in the context of Cambridge Analytica, Facebook, the modalities and storage of data now and the fact that our data can be transported, used and commodified so easily. I must confess I never considered it in the context of who the person fundamentally is. If one was arguing for Ireland or the Government against the DPC where restrictions and balancing of rights come in, I would have said that this is bigger than GDPR. This is about who a person is and the person's fundamental right to that information. That said, it engages issues such as where I am advising a company on data subject access requests. I always advise it to put in a procedure of verifying the data subject who is seeking all this information. One has to have that absolute proof that this person is who he or she says he or she is, so that it is not for other purposes. Then we come back to where that is a difficulty. If one does not know who one is and one is seeking information outside of the provisions of the agency within this context, then proving who one is to get access to that data becomes a difficulty. That is where I see this needing complex legislation. We have a fundamental problem that needs to be addressed. That is a comment rather than a question. How does Mr. Sunderland think about that?

Second, in paragraph 19 he referred to medical information in the context of relevance and said there must be guidelines for the issue of relevance. How I understood that, and I can be corrected if I am wrong, is the threshold of relevance being when it is the medical information of somebody else and the relevance being congenital matters. If I was born without a finger, that might be a congenital matter, but if I had a finger severed in an accident after birth, that is not necessarily relevant because it does not relate to a child I gave birth to, for example. Has Mr. Sunderland any ideas on the thresholds of relevance?

Mr. Dale Sunderland

To comment on the first point, it is not just about the GDPR. That is for sure. The GDPR states that the processing of personal data should be designed to serve mankind and that it is not an absolute right and must be balanced with other rights. That is essentially what this Bill is trying to do. It is looking at the fundamental rights of individuals under EU law, and it has to be seen in the context of the Charter of Fundamental Rights of the European Union, trying to address the competing rights and striking the right balance. Ultimately, what the Oireachtas has to do is be satisfied that whatever form of the Bill is passed and enacted, it balances those rights in an appropriate way and one cedes to the other in a way that does not adversely override the rights of others, and that the right of birth parent mother is not so adversely affected that it impedes the right of access. That is the balance one is trying to strike and the safeguards can provide for that.

We felt relevance with regard to medical data needed to be explained and defined further. We are not necessarily experts in this field and it would not be right of me to suggest what those safeguards might be. I am conscious that while we know data protection, we are not medical experts on the considerations that go into that.

It is simply to say that there may be cases where third parties may be involved and where issues arise in the context of medical information relating to a birth parent or a relative. In a data protection sense and from a privacy perspective, such individuals have certain rights that need to be looked at. That is why it is important that all of these issues would be well defined so that there is absolute clarity regarding the rules and thresholds. If that is got right at this stage, the eventual Bill will be sound and will operate on a sound legal footing and as intended by the Oireachtas. That is the point we are trying to make.

I have come across difficulties for next of kin in getting information as to how people are in hospitals. People have a perception that next-of-kin status has a standing but it does not have any legal standing and there is no right to information attaching to it. Yet, we are prescribing in legislation a right to medical information for all the right reasons. It is perfectly reasonable that we would do so but it is interesting that outside of the context of information and tracing, adoptees and all that goes with that, there is not necessarily a right to that information in other contexts. That is where there is an anomaly and, as a result, an enhanced right is being provided here for all the right reasons. Trying to find that point of relevance will be a challenge.

We are coming to the close of the meeting. This session has been of particular interest. People were anxious to have more time. I feel like I am always the person who has to cut people off. I do apologise but, unfortunately, we must adhere to the rules relating to Covid.

There were some very good suggestions about having Mr. Sunderland and Mr. Murphy back before us again. That is something we should probably look at, particularly if there are other reports or analyses that would be revealed, by then and while we are still discussing this topic. In general, I imagine that we will be engaging with the Data Protection Commission. We look forward to that. I sincerely thank the witnesses. I can give them one or two minutes if there is anything they did not get to say or any concluding remarks they wish to make. Is Mr. Sunderland happy enough?

Mr. Dale Sunderland

There is nothing else I want to say unless any of the members has a further question. I am, of course, happy to answer any further questions. Thank you.

I thank Mr. Sunderland. As I say, we will obviously have future and ongoing engagement. I need to get agreement to publish the opening statement to the Oireachtas website. Is it agreed? Agreed. I sincerely thank Mr. Sunderland and Mr. Murphy for their time.

We will suspend for a few moments to allow for the commencement of the next session with the Irish Human Rights and Equality Commission. I remind members that they need to exit this meeting and join a new Teams meeting in order to participate.

Sitting suspended at 4.23 p.m. and resumed at 4.30 p.m.

We will resume our pre-legislative scrutiny of the general scheme of the birth information and tracing Bill. I welcome the representatives of the Irish Human Rights and Equality Commission, IHREC, which will address the committee virtually via MS Teams. They are Ms Sinéad Gibney, chief commissioner, Professor Ray Murphy, a commission member, and Ms Maria Mullan, senior research and policy officer. The purpose of the proposed legislation is to enshrine in law the importance of an individual knowing his or her origin.

I must advise the witnesses about parliamentary privilege. As all of the witnesses are appearing before the committee virtually, I need to point out that there is uncertainty if parliamentary privilege will apply to evidence given from a location outside the parliamentary precincts of Leinster House. Therefore, if they are directed by me to cease giving evidence about a particular matter, it is imperative that they comply with such direction.

The witnesses will be allocated three minutes' speaking time. Since we are under time constraints, I must adhere to the time allocation strictly. The opening statement will be followed by a questions and answers session with members. The speaking rota was circulated and will be the same as the previous one.

I invite Ms Gibney to deliver her opening statement.

Ms Sinéad Gibney

I thank the committee for its invitation to this meeting. IHREC is Ireland's independent national human rights institution and national equality body. Our commission of 15 met in plenary today and approved our written recommendations to this committee, which will we send on later.

This legislation engages significant rights issues, including the rights to identity, privacy, equality and non-discrimination, health, bodily, physical and mental integrity, freedom of expression, dignity and know. While the commission welcomes that the proposed legislation grants the right to access birth and early life information, we would make recommendations on a number of issues, namely, the right of access to birth certificates and early life information, "no contact" preference and counselling, the child's access rights, and access for relatives of deceased relevant persons.

In my listening sessions with mother and baby home survivors, it was clearly stated that the right to truth was key. "Free and unfettered" access to their personal information and records is essential for survivors. To deny this could in itself be retraumatising, particularly for older survivors, and, therefore, the burden on legislators to shape this pivotal law effectively is a heavy one. It is also important for the State's approach to recognise that, while this legislation must vindicate rights to truth denied to so many for so long, there is a corollary that there are birth mothers who have been living under a cloud as inquiries, debates and now legislation happened, fearful that undisclosed information would be revealed. It is important to be mindful of all.

The IO'T v. B Supreme Court case has repeatedly been cited as the reason adoptees cannot be provided with unfettered access to their birth and early life information. While the Supreme Court set out that the birth parent enjoyed a right to privacy and confidentiality, it followed that such a right was not absolute. The courts have sought legislation from these Houses to support the balancing of rights on access to information. The provision of birth certificates or early life information is, by definition, the vindication of the right to identity, to personality and to private and family life for adopted people.

People seeking access to the records at the centre of the Bill have suffered delays, often of many years, and, therefore, this legislation should mark a sea change in approach. Therefore, the commission recommends that statutory timeframes for compliance with information requests should be set out. We also recommend that this legislation establish a system for the management of records across agencies and locations that ensures that significant delays are avoided.

The requirement for an information session where there is a no contact preference appears to cater to the privacy rights of natural parents. However, the extent to which this requirement will achieve that aim is questionable, as the information will ultimately be provided and the theoretical contact will be possible once the information session is held. This requirement would present a further obstacle to affected persons in accessing long-sought information. Where the relevant person does not want to undergo an information session, it represents a complete barrier. We recommend that this requirement be removed from the legislation or, if retained, it should be transformed into no-obligation counselling, support and information services tailored to the needs and wishes of the individual and co-designed with him or her.

Children have material questions about their birth and background. However, head 3(1) provides that only a relevant person aged 16 years or over will have the right of access to his or her birth certificate. Heads 5, 6 and 7 similarly restrict access to birth information, early life information, care information, and birth and medical information to those aged over 16. We believe this approach to be inconsistent with the right to identity under the children's rights convention as well as a child's right to his or her identity under the European Convention on Human Rights and case law of the European Court of Human Rights. The committee may be interested in knowing that other EU states, including Germany, Denmark, Belgium, Italy and Sweden, make provision for children, albeit with different conditions, as we have set out in the paper that we will submit.

We also recommend that a proposed restriction of access to materials to "relevant persons" should be reconsidered, given that this "relevant person" could be deceased but his or her birth relatives could be seeking access, including for medical reasons.

We are happy to take questions. If I may, I recommend that, rather than asking questions through me, members ask questions and we will respond accordingly, depending on who is the appropriate person.

That would be not be a problem.

I thank Ms Gibney for her presentation. It is different hearing it read by its writer versus reading it myself, so it was good to hear her comments.

I wish to get straight to the nub of the issue. It is great that information is being made available to adoptees, which is as it should be, but there is a competing right that the Government is trying to, and the State needs to, vindicate. The reference in the presentation to birth mothers being fearful of undisclosed information being revealed were tender and moving words, given that I know this to be a difficulty for them. It is not that they perceive adoptees making contact as a threat. Rather, it has to do with their current circumstances, for example, the families they are now in, or the knowledge they have carried for a lifetime and that they do not want to return to. This difficulty is personal to the birth mother in most cases, not the adoptees. I wish to be clear that adoptees are not perceived as a threat.

I agree with Ms Gibney that there is a disconnect between the information session and the objective of the action. From reading it, I understand it to be an attempt to vindicate a person's right to privacy while also being sure the other person is told the information. Do the witnesses have suggestions as to how that right of the birth mother is vindicated but not at the expense of the adoptee, who has an entitlement to unfettered access to his or her information? That is the challenge in this legislation.

Ms Sinéad Gibney

I will start and Professor Murphy and Ms Mullan might add more. One of the ways in which this should be handled is through awareness and public information campaigns. They must reach into every home in Ireland and extensively throughout the diaspora. I agree with the Senator, in that there are people living with these secrets whose anxieties and fears have been escalated over the past number of years as these issues were dealt with through inquiries, legislation and so on. It is the responsibility of the State, while this legislation is being passed, to allay those fears as best it can and to send the information into the homes of Ireland. This would mean an extensive campaign across all types of media, for example, a household mail drop or the like, whereby people would be reached in an effective way to allay concerns.

Bringing it back to the information session, the reality is it does not become comparable to my ability to access information if there is that session placed in front of the people. That is the reason we cannot place that barrier for adopted people. I do not know if Professor Murphy or Ms Mullan would like to jump in further.

Professor Ray Murphy

We were very aware of the fears that birth or natural mothers would have. While trying to respect and vindicate the rights of adoptees, it was foremost in our minds. One of the things suggested is the possibility of counselling, which would be helpful to all parties if availed of. Obviously, it would not be obligatory. There has been considerable discussion of the I.O'T v. B. case. At the end of the day, you will sometimes have conflicting constitutional and other rights. In this case, the right to identity and the right to privacy conflict. At the time, over 20 years ago, the court did invite the Oireachtas to legislate for this because when you have a conflict, at the end of the day, you have to decide which gets priority.

In this instance, there has been a change in the culture with regard to adoptees and this issue. There is now an international recognition of the right of people who have been adopted to have access to their birth information and all the other information being sought. The only way you can do this is, to some extent, by giving information on birth mothers and birth fathers, if it is there, but in many instances it will not be. We need to do this in as sensitive, caring and empathetic a way as possible but there is no way around this. Not just the Irish case law but the other international case law such as that of the European Court of Human Rights also talks about trying to balance these rights and doing so in a proportionate and fair way that harmonises rights. At the end of the day, it is the function of the Oireachtas, which it is now doing, to bring in legislation to facilitate this and put in the supports necessary for all the parties involved.

I will come back in if there is time.

There is time now if Senator Seery Kearney wants to come back in.

Is there? Right. My follow-up question was about counselling and how there should be counselling, while also being aware that people perhaps cannot go to a counsellor in their town. I tend to think of things in Dublin because I am from Dublin and have always lived there but there are challenges when you are out in a rural community, that I know have already had to be overcome in the context of mother and baby homes. A really good suggestion was also put in on having a statutory framework for the provision of information. Would Ms Gibney like to elaborate on that? It is a brilliant suggestion.

Ms Sinéad Gibney

The statutory timeframes we are recommending are to make sure there are no more delays for people than what they have already experienced. We have not specified a specific timeframe but it is important that whatever the administrative processes involved are, they are clarified and clear expectations are set in terms of how long these requests will take and that those timeframes are then met. That is really important. There are other areas in which you can take precedent for such requests and potentially use them as models for setting those timeframes. Is that what Senator Seery Kearney is referring to?

Yes, and they need to be supported by enhanced powers to compel the information when it is in the hands of a third party.

Ms Sinéad Gibney

Exactly. In terms of how the agency is set up or handled, it is very much about resourcing it adequately to do its job in a way that prevents any further delays. It is up to the Oireachtas and the relevant agencies to decide who will handle the requests and how they will be handled, but it is quite clear multiple agencies or sources will be involved. It is a question of making sure that co-ordination and resourcing are done ahead of time in order that people do not experience delays once these requests start coming in.

I thank the witnesses. It is a really enjoyable session again. With regard to what Senator Seery Kearney said on the statutory timeframes for the compliance of the information requests to be given out. Ms Gibney mentioned other models out there. If she could elaborate on what other models are out there, that would be really helpful. How does she see those models influencing what the statutory timeframe should be?

Ms Sinéad Gibney

The one example to put forward is under Article 12 of the GDPR. Data controllers have to respond to a request without undue delay and, at the latest, within one month of receiving the request. Deputy Ward can probably ask the committee's previous guests for more detail on those requests and how they are handled. That is what I am referring to in terms of a specific example one may draw from or a precedent one may take from. We are not suggesting what it might be because we would not have the expertise in terms of what the administrative processes are but I imagine one is talking about maximums of months. It really is looking at what is reasonable within that timeframe and making sure those expectations are heard, understood and held to.

I agree with Ms Gibney in that statutory timeframes should be in this because it is important to have a start and an end to a process. If it is left indefinitely, people could be left waiting for a long time. Ms Gibney mentioned the rights of children between 16 and 17 years old. They are inconsistent with other European countries. They are also inconsistent with the right to identify under the children's rights convention. Ms Gibney mentioned other countries in the EU that have made provision for children. What can we learn on how other countries have made this provision for children and how can we adapt that to this context?

Ms Sinéad Gibney

I will ask if one of my legally skilled colleagues will take this one, either Professor Murphy or Ms Mullan.

Professor Ray Murphy

I will say something and maybe Ms Mullan can follow up. It is clear under international law and the European Convention on Human Rights that children should have access to their relevant data. What we are doing in this legislation is proposing something that restricts that. One of the measures by which we try to attain the highest standards in terms of international human rights is by subscribing to these international conventions and then being reviewed by them. It is quite clear from the European Court of Human Rights, the UN Convention the Rights of the Child and other UN conventions that children have specific rights and there is a real danger this proposed legislation violates those rights and therefore, it should be amended to provide for children to have some kind of access. It would not be open access like an adult because there are special considerations with regard to the sensitivities of children. One of the things we propose is a maturity test, which would apply in respect of children of a certain age or the adoptive parents, if they are seeking information on a child. There is established practice. There are established principles and, prima facie, this proposal seems to violate those and we are suggesting it be amended and changed. Will Ms Mullan add something?

Ms Maria Mullan

One of the core principles of the UN Convention on the Rights of the Child is that laws should respect the evolving capacities and views of the child. Setting an age requirement may violate that. Articles 5 and 12 of the UN Convention on the Rights of the Child, UNCRC, relating to the evolving capacities of the child in respect of the views of the child are important and should be respected in order to comply with international standards. The Data Protection Commissioner has a document entitled Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing that recognises children should be able to access their data at any time, as long as they have capacity to do so and it is in their best interests. It is recognised children are data subjects for the purpose of the GDPR also.

Is it the recommendation that the age of 16 or 17 is too restrictive?

Do the witnesses feel that it needs to be lowered to an age of maturity? How would they bring the age down? What are their thoughts on it?

Ms Maria Mullan

That is where the sufficient maturity test would come into play. The commission has recommended that previously in other submissions, on a case-by-case basis, to assess the evolving capacity and views of the child in compliance with the United Nations Convention on the Rights of the Child.

I thank the witnesses for their opening statements and responses. I agree with their call for the removal of the mandatory information session. It seems to be another obstacle to people accessing their information. Their submission echoes the objections raised by representative groups and human rights experts. We have to ask if it is discriminatory to require adopted people to be met by a social worker to have privacy explained to them when there is no evidence that adopted people are incapable of understanding written information or that they might need a compulsory social worker involved in their lives.

I was talking to the Minister about this last week. He told me that a session was necessary for the balancing of rights but, due to time constraints, I was not able to question the point further. The commission has determined that the session should not be compulsory. Will the witnesses elaborate on why and how they came to that conclusion? The Minister seems to be unwilling to acknowledge it. If the witnesses could give any points to strengthen the argument for its removal, that would be appreciated.

Professor Ray Murphy

With regard to the balancing of rights, I can see what the Minister is attempting to do, but what he is actually doing is creating an obstacle to free access by adoptees. The primary purpose of the legislation as I understand it is to establish this legal framework and to facilitate access through GDPR. This sets out a national legislative framework that allows people to also claim, under Article 6 of GDPR, that they have a right of access to data. There will be a presumption of constitutionality and legality in respect of this legislation. It is in the remit of the Oireachtas to enact legislation to cover these types of challenging and difficult situations. The Minister is wrong because he is creating an artificial obstacle which may be a significant impediment. Those people who are most affected by this have advocated for its removal. That in itself should tell us something. It does not achieve the long-term objective of denying access. At the end of the day, access will have to be granted under the legislation. We are not saying to remove the no-contact preference where the person will be informed that his or her natural or birth mother does not want contact and he or she will then respect that. Where necessary, we are also advocating for supports through counselling. To reiterate, I do not think it is required by any constitutional balancing of rights to incorporate this. It is certainly not required under any international legal provision. At the end of the day, the Oireachtas must decide what the priority is and how to facilitate access by adoptees. The commission has suggested that the formal meeting that is proposed acts as an impediment and does not help.

Ms Sinéad Gibney

Being aware of how these processes evolve, if this is retained, we recommend that it should in that case be made a no-obligation counselling support and-or information service that is tailored to the needs and wishes of the individual. It should be co-designed with the individual. That feeds into the principles of transitional justice around participation. As Professor Murphy has already expressed, it is clear that this is not desired by the main parties involved. If anything is to be suggested, it should be something that they design and should be informed by the individuals who are availing of the service.

The scheme currently provides no mechanism for adopted people and natural mothers to access administrative files of institutions and agencies involved in forced family separation. Will the witnesses comment on this aspect of the legislation from a human rights perspective and their engagement with survivors and advocacy groups? Will they comment on the absence of a mechanism for siblings to get information about each other? We all know that so many adopted people and their siblings, whether adopted or not, are eager to learn about each other and be in contact. Will the witnesses comment based on their engagement with adoptees and different groups from a human rights perspective?

Ms Sinéad Gibney

I do not have anything to hand about this. We can follow up on it. I do not know if Ms Mullan or Professor Murphy have anything to add immediately. If not, we would be happy to follow up on this issue.

Professor Ray Murphy

I can add something. If you look at the definitions of relevant persons in the legislation, they do not include relatives. That is somewhat arbitrary. Likewise, when you look at relevant records, which is what the Deputy is referring to, the definition of what a relevant record that people can have access to is quite narrow. It should include a full schedule of all the records relating to adopted persons. The definitions section of the Act could be looked at again. The purpose of the legislation is to make information available to affected persons. Using restricted definitions will have a significant impact on the type of information is available and those who can access it. The Deputy asked what the view of those affected is. It is that this should be significantly expanded. From a human rights perspective, I think that would be a good idea.

I apologise. I could not connect to the Internet in the convention centre. My first question was for the first session, so I do not know if it can be answered, but I will ask if the witnesses do not mind. Regarding the birth certificate, there are no circumstances in which it is okay to refuse to issue a birth certificate to someone and right to identity is paramount. Do the witnesses know if this is a widespread practice? Maybe this was already answered. Do the witnesses feel that there is enough engagement about Bills such as this? I get the impression that GDPR is not fully understood and is often used incorrectly. Is that the witnesses' experience?

Regarding the age of digital consent and GDPR as we know it, it was left to states to decide whether that age should be 13, 14, 15 or 16. Many child protection bodies recommended that Ireland set it at the lowest age, 13, to ensure that teenagers could access information services independently of their parents as they start to discover and explore their own identities. Ireland ultimately selected 16 to protect children because of issues with the Internet. I know this is due to be reviewed by May 2022. What are the witnesses' thoughts on this? Head 3(1) and head 5 provide that only a relevant person aged 16 or over will have the right of access to his or her birth certificate, birth information, early life information, care information and medical information. Children warrant special protection when it comes to processing their personal data. What steps can we take to ensure that children have greater access to this information about adoption for tracing purposes?

In the context of adoption and tracing, international human rights law is clear that children have a right to their identity. How can we provide this in the Bill? I apologise for coming in late.

That is no problem. Some of those questions were more relevant to the first session. Perhaps Ms Gibney, Ms Mullan or Professor Murphy would like to come in on any of the other points.

Ms Maria Mullan

I will refer again to the question about children's rights and age. I am not entirely sure as to the motivation behind the age limit of 16 and whether this is related to the Internet. We recommend that this should not be a specific age limit and that the test to determine whether children would get access to the said commission should be based on a sufficient maturity test that relates to the evolving capacities of the child and respecting the views of the child, which would comply with the United Nations Convention on the Rights of the Child, UNCRC. It is a core principle of the UNCRC that those articles relating to the evolving capacity and the views of the child should be respected. It is also noted that children are data access subjects under the GDPR. The Office of the Data Protection Commissioner has a draft fundamentals document that states children have a right to access data provided they have the capacity to do so and that it is in their best interests.

Professor Ray Murphy

I agree on the GDPR issue. The GDPR is actually quite complex. We are all grappling with its full implications. There are some fundamental misunderstandings. The earlier session was quite enlightening in some ways. One of the key problems with the GDPR interpretation is that in certain circumstances data may be restricted if the release of this information would have an adverse impact on a third party. As a general principle of law, when one is restricting a right the restriction must be very narrow. As the data protection commission has pointed out there are clear rules and there must be very specific objective and narrow purpose to the restriction, and it has to be proportionate and necessary. In the past it has been interpreted very broadly: there may be an adverse impact so therefore we cannot release the information. In my view, and in the view of the experts, that is an erroneous interpretation of the GDPR. This is, in fact, an impediment to access to information rather than facilitating it.

I thank Professor Murphy. Senator Seery Kearney wanted to ask another question.

Coming back to the relevant persons, in her opening statement Ms Gibney proposed the possibility that the relevant person in this instance may be deceased, and consequently it is reasonable that relatives become the relevant persons. This seems to set up a hierarchy of access whereby if the relevant person should get the information and in the event that the relevant person is deceased, then there should be a broadening of the category. When I read this it triggered in my mind the Succession Act whereby there is a list of individuals who would be entitled depending on the absence of the previous person in the list. I agree that the category should be widened but I can also see reasons for wanting to ensure there is a hierarchy of people who get access to information because they also have privacy and GDPR rights over that information once they secure it. Has the Irish Human Rights and Equality Commission given any consideration to that?

Ms Maria Mullan

I suppose it is a complete prohibition at this point. We have not set out specifically how that should be accommodated, but we have drawn attention to the fact that there is complete prohibition and that this may be in breach of international human rights laws and the European Convention on Human Rights with regard to the relatives of those deceased persons. We ask that this would be reconsidered as part of the review.

I wish to flesh this out. I would be of the view that it needs to be a bit wider and that it is too restrictive as it stands. Head 40 suspends GDPR rights for the purposes of birth information. As I read this, however, GDPR rights are not just rights of access, they are also rights of restriction and it is necessary that the right to restrict the disclosure of data is suspended in order that individuals can receive their birth information. In the discussion on this we see that rather one dimensionally. I am a bit anxious it would come out of these two meetings that this is not the perception. I would see the intention of that section to be that GDPR would suggest that a third party's name, or another party's name, would be redacted as it currently stands, and that we need to suspend those rights in order to ensure that an individual has rights to all of their information. Can the witnesses add to that, consider that or add a bit of context for it?

Professor Ray Murphy

Head 40 was addressed in the previous session also. I agree that as it is currently drafted it is way too broad and much too general. If one is going to try to restrict the rights and obligations under GDPR, as I pointed out to the previous speaker, there are general principles that must be adopted. Under Article 24 of the GDPR, it must be very specific, it must be very clear what the objective is, and it must be proportionate and absolutely necessary. The current proposal is deficient. It is too broad and needs much more consideration and elaboration so that it can be upheld and so we understand what the purpose is and how it will apply. I agree with the Senator that the current proposal in head 40 is insufficient and that it certainly should be re-examined and extended significantly.

I am hearing the professor say that it is lacking in precision-----

Professor Ray Murphy

Yes.

-----as opposed to its objective which is disclosure, and unfettered disclosure I would have thought.

Professor Ray Murphy

I have head 40 in front of me. On access it states the rights and obligations in particular articles of the Bill "are restricted pursuant to Article 23(1)(i) of the Data Protection Regulation to the extent necessary to enable persons to access birth and related information in accordance with the provisions of this Act". It is like the point I made on the interpretation of GDPR in the last number of years. Some are misinterpreting the restrictions that may apply and the consequences. To ensure clarity, therefore, that particular provision needs to be much more detailed and set out much more clearly. As it is currently, we could debate it and I would hate to fall into the trap of the lawyer where "on the one hand this and on the other hand that". We would not have to debate this if it was clear what it meant, how it was going to apply and how it would be implemented. Right now I do not think that it is clear. It needs to be considered. I agree that it is appropriate to raise it here and to highlight that this is a problem with the Bill.

I thank Professor Murphy.

Is there anything else that members or witnesses would like to add briefly? Would Ms Gibney want to add anything?

Ms Sinéad Gibney

I thank the committee again for the opportunity to be here. We believe that the principles of transitional justice really must inform all of the activities of the Oireachtas in dealing with the mother and baby homes and the various pieces of legislation. While understanding that this is broader than the survivors of the mother and baby homes, legislators must understand that it is so important to follow those principles of transitional justice.

I thank Ms Gibney.

I thank all our witnesses today. We look forward to ongoing engagement. Can I get agreement to publish the opening statement to the Oireachtas website? Agreed.

As this is our final public meeting before the recess, I thank all members of the committee for their patience and understanding and all their work since January. I wish to say a particular and sincere thank you to the staff in our secretariat, who do a huge amount of work, sometimes in the background. We would all be lost without them.

We have discussed a range of topics but there has been a huge focus on issues arising from the mother and baby homes report. A sincere thank you to everyone, including all our witnesses, who engaged with us over the last session. We very much look forward to continuing the work in September. On that note, we do not have a date for our next meeting so we are adjourned sine die.

The joint committee adjourned at 5.11 p.m. sine die.
Top
Share