Data Protection Act 2018 (Section 60 (6)) (Central Bank of Ireland) Regulation 2019: Minister of State at the Department of Finance

I welcome the Minister of State, Deputy Michael D'Arcy, and his officials and call him to give his opening statement.

I thank the Chairman and members for the invitation to attend. As the committee will be aware, the Data Protection Act was enacted on 25 May 2018. On foot of that Act, it is necessary to make updated regulations under section 60 to provide for certain restrictions on obligations of controllers and rights of data subjects for important objectives of general public interest in respect of the work of the Central Bank of Ireland. Similar restrictions that the Central Bank relies on are in place under the Data Protection Act 1988 (Section 5(1)(d)) (Specifications) Regulations 1993 and, on foot of the resolution sought, they will be replaced by the draft regulations before the committee.

The proposed regulations restrict, in limited circumstances, the rights and obligations provided for in specific provisions of the general data protection regulation, GDPR. These restrictions apply only where necessary and proportionate to the need to safeguard specified important objectives of general public interest pursued by the Central Bank of Ireland "relevant objectives" set out in the regulations.

These relevant objectives include, for example, regulating financial service providers and markets, protecting the best interests of consumers of financial services, supervising or enforcing compliance with financial services legislation, carrying out monetary policy functions, and contributing to the stability of the financial system.

The regulations provide the bank with the necessary powers to protect the public against harm arising from dishonesty, malpractice, breaches of ethics or other improper conduct by, or the unfitness or incompetence of, persons currently or previously authorised to work in the financial services industry.

To give a very real life example, these regulations are vital to allow the Central Bank of Ireland to investigate whether individuals in regulated financial services providers have committed wrongdoing to customers, and to record where they have found breaches by individuals so they can be prevented from taking on similar roles in the future. In accordance with the provisions of the 2018 Act, the Department consulted extensively with the Data Protection Commission and the Minister for Justice and Equality throughout the drafting process in order to assess the necessity and proportionality of the measure, and to ensure compliance of the proposed measure with EU law on data protection. This consultation involved a cross-functional liaison group led by officials from the Department of Finance and consisting of officials from the Department of Justice and Equality, the Data Protection Commission, the Office of the Parliamentary Counsel, and the Central Bank of Ireland.

Following that consultative process the Data Protection Commissioner wrote to the Minister for Finance to confirm that pursuant to Section 60 (11) of the 2018 Act, the commission has identified no matter which is of significant concern in relation to the proposed regulations. The Minister for Justice and Equality has also acknowledged his agreement with the proposed regulations. Section 6(5)(a) of the Act provides regulations may be made only if a draft of proposed regulations is laid before each House of the Oireachtas and a resolution approving the draft has been passed by each House. I thank the Chairman for the time of the committee here today.

A copy of this draft was laid before the Dáil on 20 September 2019 and was referred to the Joint Committee on Finance, Public Expenditure and Reform, and Taoiseach, in accordance with Standing Order 84A(4)(k) which not later than 8 October 2019 shall send a message to the Dáil in the manner prescribed in Standing Order 90 and Standing Order 89(2) shall apply accordingly. We have now considered-----

I have one question. Where is the line drawn between giving and not giving information? I imagine this is a very narrow line that is drawn. Who is or are the designated person or persons to give the information or not? In other words, who is the deciding officer?

The bank requires extra powers to protect the public against harm arising from dishonesty, malpractice breaches of ethics, or other improper conduct. The example we gave was that these restrictions could apply where the exercise of the right may interfere with the prevention, detection or investigation of breaches of the enforcement of compliance with financial services legislation. These regulations are vital to allow the Central Bank to investigate whether individuals in regulated financial service providers have committed wrongdoing to customers. The restrictions could also apply where, for example, the exercise of the right would disclose that the Central Bank of Ireland is carrying out certain tasks and that such disclosure may prejudice the achievement of a relevant objective.

To put this into context for the Senator, if the Central Bank is investigating an individual, and the individual may know of this, that individual could require under the General Data Protection Regulation, GDPR, to have all data relating to that person deleted. The issue here is to ensure that the Central Bank is allowed to investigate and to see somebody's financial services' past. It is something that is essential.

In line with the order of the House, we have now considered the Data Protection Act 2018 (Section 60 (6)) (Central Bank of Ireland) Regulation 2019 and we will inform the Dáil accordingly. Is that agreed? Agreed.

The meeting is now adjourned-----

May I raise one matter, please, Chairman, in relation to the Migration of Participating Securities Bill, or will I leave it?

Yes, the Minister of State may, if he so wishes.

I realise that the committee has considered the pre-legislative scrutiny for the Bill.

We have a concern about the amount of time it may take to get the report back to the Department and that we may not reach the time schedule, which is to have the legislation concluded by the end of the year. It is a very important piece of Brexit legislation relating to the stamp duty that applies for the trading of shares. There is a quite an amount of money, potentially, on the line. Would the Chairman consider the matter for pre-legislative scrutiny by the committee, please?

Yes, this is an issue that myself, the Minister of State and the committee clerk have discussed. Perhaps we can deal with this at the committee on Thursday morning. We can note that and at some stage we can make the arrangement to ask the members and make that decision.

I appreciate that.

The meeting is now adjourned.

The joint committee adjourned at 4.25 p.m. until 10 a.m. on Thursday, 3 October 2019.