I move amendment No. 1:
In page 8, paragraph (b), lines 43 and 44, to delete "a description of the data and the purposes for which they are kept" and substitute "the main purposes for which the data are held".
Data Protection Bill, 1987: Committee and Final Stages.
Sections 1 and 2 agreed to.
SECTION 3.
With regard to Senator Manning's amendment, formally moved by Senator Fennell, I understand Senator Manning is anxious that the requirement in section 3 that a data controller should give an inquirer a description of the data would not involve him in giving a very detailed account. I know the Senator is particularly concerned with health data. I can give Senaror Manning the definite assurance he requires. Any holder of health data must register, and the registration regulations will prescribe the way in which the data are to be described in the registered entry. It is envisaged that only a general description will be required for the register and the same will apply to the information given under section 3. I hope that assurance will meet Senator Manning's concern.
We accept the assurance the Minister has given, and we will not pursue that amendment.
Amendment, by leave, withdrawn.
Section 3 agreed to.
SECTION 4.
Question proposed: "That section 4 stand part of the Bill".
I am sure the Minister would prefer if I let this Bill go through quickly without even complimenting him, but there is a small part of section 4 which deserves to be commended, that is, section 4 (1) (a) which states:
...where any of the information is expressed in terms that are not intelligible to the average person without information, the information shall be accompanied by an explanation of those terms.
The Minister might suggest to the apparatus of State that a similar qualification be applied to all information supplied by all the organs of the State, because it is a most commendable clause, and one that will contribute quite substantially to the participation of the citizen in the operation of the State.
I thank Senator Brendan Ryan and I am glad he has noticed that I am making an important start here.
Question put and agreed to.
Sections 5 to 7, inclusive, agreed to.
SECTION 8.
Question proposed: "That section 8 stand part of the Bill."
The Minister replied at considerable length on Second Stage to some questions I had about section 8. I would not claim to have read this Bill in great detail but he did refer to the data which are required in the interests of protecting the international relations of the State. I do not have any disagreement about that, but the Minister suggested that it would be the Garda who would do such things and section 8 states quite clearly that the Garda or an authorised officer of the Defence Forces will be involved. Why is this necessarily restricted to the Garda? Is there any restriction on the sort of people who can go looking for the data?
There is no restriction at all. It is not being confined to the Garda.
The Minister mentioned the Garda as an example, and one can appreciate that, but maybe he can explain why it is so broadly drafted that virtually any agent of a State agency, could ask for this information. For example, the whole of the Department of Foreign Affairs could be looking for information on this basis.
The Bill prevents any disclosure whatsoever unless the person registered is a disclosee. That is why it is as broad as that.
I do not want to delay the House unnecessarily on what is noncontroversial legislation, but is the Minister satisfied it is a good idea that virtually anybody who is connected in any way with the international relations of the State can go looking for what is otherwise protected data? This puts the onus of the decision on the person who is responsible for the custody of that data and seems to dilute quite substantially the important protections contained in the Bill.
Certain foreign companies, especially American companies, have set up companies in Ireland processing data for their customers and their clients who live abroad. Will they have to register here? What will be the position of their customers, who will be mainly citizens of another country? Can American citizens get that data under this Bill or will the companies have to register here?
I know Senator McEllistrim will not mind if I begin by saying that I cannot, as Minister, give an authoritative opinion on the application of this Bill in a particular case. The Senator will appreciate that much will depend on the facts, the relationship between the American company and the Irish company and so on. However, the following principles would need to be taken into consideration in reaching a decision on the matter.
First, anyone who processes personal data in the State for another individual or firm, whether resident here or outside the State, is subject to the Bill and must register as a data processor in accordance with section 16. Second, if the Irish company control the contents and the use of the data, they are a data controller and will have to register as such if they come within one of the categories mentioned in section 16. In fact the data commissioner will advise, in due course, any firms who may be doubtful about their position. That is as far as I can go at this stage. If, on reflection, I can get further information on the matter I will communicate with the Deputy on this case but I do not want to give an authoritative opinion on an individual case as of now.
I presume the Minister is satisfied about the drafting of the legislation. Otherwise he would not have brought it here. I would like to understand the reasoning behind it because it seems to me to be extraordinarily broad. Virtually anybody involved in preventing, detecting, and investigating offences, apprehending or prosecuting offenders or assessing or collecting any tax due to anyone or any other moneys, whatever their degree of seniority, or the opposite, if I can coin an awful word "juniority" can actually contact somebody who has responsibility under this Act to protect personal privacy and transfer the onus for disclosure onto that person if they can simply say, "We are trying to collect tax, we are trying to collect duty". I would have thought that it would be reasonable to say that that had to be authorised by a person of some degree of seniority in any investigation.
It seems to me a recipe for quite chaotic attempts to seek personal data by anybody who is involved. It could be very junior officials of the tax office, of the Garda Síochána, of a local authority or a health board who could actually contact people who have a duty under the law to protect personal privacy. What I do not understand is that why there is not a reference in paragraphs (b) and (c) to an authorised officer of a designated status to authorise such inquiries. Presumably there is a reason, and I would like to know it.
First, with regard to this particular section, there is a slight difference between Senator Ryan's interpretation of it and mine. I do not accept that this is as widely drawn as Senator Ryan suggests and I am advised that this is so. It is there primarily for the purpose of protecting the data controller who elects to give information in certain essential cases from breaching the restrictions in the Bill on disclosing information to people who are not registered as disclosees. The exceptions are very tightly drawn and are done so in the interests of the public. Of course, the data controller need not give the information. He does not have to give it. He can do so if he wishes and if he thinks it is in the interests of the State to so do.
I do not want to delay the House unnecessarily——
You said that earlier, yet you keep standing up.
A Chathaoirligh, that is not something that you should have said. You have a right to regulate this House, but I also have a right to participate in its activities.
Senator Ryan to continue.
What the Minister said does not really answer my question. Maybe I am wrong about the extent or the generality or the sort of generalisations that are contained in it, but in the case of paragraph (a) the basic condition for seeking disclosure is the authorisation or the opinion of a member of the Garda Síochána not below the rank of chief superintendent or a member of the Defence Forces not below the rank of colonel, which seems to me to be not unreasonable. On another occasion I might argue about that but that is not the issue. That is a reasonable qualification but is it not likely there will be a fairly widescale breach of the protections that are contained in this Bill by people who are of a relatively junior nature and who believe that the information would be useful.
The word "required" is an interesting word. It is not necessary: it means required. If it makes my job easier I might think that something is required. It does not mean that it is necessary to do my job but it might make my job easier if instead of having to go and search for data through public sources. I could contact somebody who is responsible for this data and simply say I want it because I want it for any of the conditions listed. Similarly in the case of paragraph (c) "required in the interests of protecting the international relations of the State" one could not argue that where information is required for that reason it should be made available but what one could argue is whether it should be available to anybody who can wave the flag of the international relations of the State. I do not think that the Minister has given me a particularly convincing reason it should be so. I would like to know why.
I am not going to make a huge issue out of it but it seems to me that we have so much detail, and justifiable details gone into about personal privacy and the control of access yet section 8 gives what seems to me to be close to being the potential for untrammelled access to people at all sorts of levels of responsibility. We have an extraordinary concern for privacy on the one hand while facilitating breaches of privacy on a grand scale on the other hand where, as the Minister says, the person responsible chooses to make the information available. Is it not a little bit unfair to those who have an obligation under the law to protect personal privacy to place the burden of judgment on them entirely? I think that is a bit unfair.
I understand the point being made by Senator Ryan. Mainly this provision is to provide for the non-application of the restrictions in the Bill on the question of the disclosure of information except in certain cases. Here, it is spelled out in section 8 (a) which states "in the opinion of the member of the Garda Síochána not below the rank of chief superintendent or a member of the Defence Forces, not below the rank of colonel ..." they may seek particular information. The reasons that information is then sought are spelled out in the other subsections there. The data controller has to be satisfied that the information is required for specific purposes and that is set out in section 8 (b). That is acceptable, but Senator Ryan must recognise that the data controller does not necessarily have to give the information that is required. It is not as widely drawn as Senator Ryan thinks it is. You have to give a certain element of protection to the data controller. He is seeking to breach the restrictions in the Bill to people who are not registered as disclosees. It is fairly tightly drawn. It can only be done in certain circumstances and at a certain level and for very good reasons. We are satisfied that it is as tightly drawn as we could have it.
If the provisions of paragraphs (b), (c), (d), etc. were clearly an expansion of paragraph (a), there would be no problem. In other words, if it was either a garda superintendent or a colonel in the Defence Forces or somebody of an equivalent status in whichever agency was seeking the information, one would have no problems at all with it. I am not disputing the principle. I have no argument with the principle that people who are attempting to enforce the law or protect the security of the State or the international interests of the State can seek information. That is not the issue. The issue is that it is not clear to me from the legislation that anybody who has an interest in any of the things related in paragraph (b) or who can talk about the interests of protecting the international interests of the State could ring up any data controller and ask for information. What is to prevent a junior official in Foreign Affairs who is interested in a particular issue in which the country is involved, ringing up a data controller and asking for information about a, b and c because he believes it is required in the interests of protecting the international relations of the State? Is there any restriction at all on the request being made?
I appreciate, as the Minister has said, that the data controller does not have to respond to the request if he or she feels that it is trite or not justified, but that is perhaps a little bit unfair in terms of the balances that are necessary in legislation between the data controller and those seeking information. My own feeling would be that if a garda superintendent wants the information, the data controller should not be allowed to refuse it. Civil Libertarian and all as I am, if the Garda or the defence forces want that sort of personal data they should be entitled to set it.
I do not believe that every official of a health board, the Revenue Commissioners, the Department of Foreign Affairs or any other Government Department concerned with international relations should be able to simply ring up and say: "I want that information" and leave it to some other person, who is, perhaps, conscious of his position or his future career prospects to decide to say no. We ought to have restricted it to competent people and say that because these people believe it is important and they are informed and have knowledge of the position, they are the ones who can do it.
Quite rightly, in paragraph (a) reference is made to senior officers in the Garda and Defence Forces but for other areas, which are equally important, there is no such qualification. Why not make reference in paragraph (a) to any member of the Garda Síochána or any member of the Defence Forces? One could turn this on its head and say that we are imposing an inhibition on the security forces which is not placed on any other area of State activity. A garda superintendent or a colonel in the Army must authorise a request for information from those security forces but in other areas there is no such restriction. I keep saying that I do not understand why there is no similar qualification in terms of seniority in paragraph (b) or in the later paragraphs as their is in paragraph (a). I do not want to keep us here all day but if the Minister explained the thinking behind the inclusion of that distinction to me I would not say I would be happy but I would shut up.
There is an obligation on the data controller to satisfy himself that the conditions in section 8 apply. In all cases where the public interest requires it the data controller should be able to give the information sought without incurring a breach of the provisions in the Bill. If he has any doubts as to whether the information sought is required for the purpose of safeguarding the security of the State he should ask the chief superintendent or the Army officer, as the case may be, personally to state that the information is required for that purpose. As I mentioned in the course of my reply to Senator Ryan on Second Stage, if it referred to a case possibly involving risk to life or property where the chief superintendent was not present to make the request for information, the firm could contact the chief superintendent by telephone for reassurance. If time allowed the chief superintendent could give a certificate about the purpose for which information was required. In my reply on Second Stage to comments made by Senator Ryan I suggested that, in the event of a garda feeling that there was an actual threat to somebody's life, he could ask a particular question to get information from a data controller. If the data controller felt it was necessary for his own protection he could ask for that assurance which would enable him to comply with the obligations on him as regards the disclosure of personal data in certain cases without incurring the risk of being prosecuted.
I promise not to keep us one second longer than is necessary. I can understand what the Minister is saying. That is covered by paragraph (d) which reads: "required urgently to prevent injury or other damage to the health of a person or serious loss of or damage to property". If it was specified in paragraph (d) that it was required by the Garda, the security forces or any other agent of the State involved in these sort of activities, that would be fine and one would have no problem with it but paragraph (d) does not just apply to the Garda. Virtually any citizen could say that they desperately need to gain access to the information on a, b or c. For instance, in the regional college where I work my home phone number will never be disclosed to anybody in any circumstances. People can use all the plausible arguments they want but it is hard to convince oneself, particularly if an inquiry is made by phone, that there is any validity to it.
Paragraphs (b) and (c) bother me. Is there any restriction at the point of the making of the inquiry, as distinct from the right of the data controller to refuse, on who can make such inquiries? The Minister has come some way in saying that the data controller must satisfy himself that the inquiry is valid. That is fair enough. That, to a considerable extent, meets my complaint but it appears that any officer of a health board, down to the level of a junior clerk, in assembling information on a debt to or the funding of a health board, can ring up any data controller and say that under the Data Protection Act they can, if they wish, give them information which they require. That seems to be a fairly large breach in the dyke.
If I may interrupt the Senator, I can see the point he is making and I would not say there is any disagreement between us on it. In relation to section 8 (c), in the interests of protecting the international relations of the State, it is not envisaged that junior clerks could ring a data controller to say that they felt they could be relieved of their obligations under the Bill and give them information on a, b and c because the matter has to do with protecting the international relations of the State. A junior clerk can do that but if the Senator or I were data controllers I am sure we would need far more assurance before we would feel that we could be relieved of our obligations under the Bill. We would have to satisfy ourselves that this information was being sought in the interests of protecting the international relations of the State. Not just because it was a request from a junior clerk, the data controller would have to assure himself that the information being sought was being sought for that specific purpose. Otherwise, he could not even consider giving it and even at that stage he would not have to give it. We cannot stop people asking for information. Anybody can ask for information but that does not necessarily mean that they are entitled to be given it.
The Minister has explained it to a considerable extent but what about the legal responsibility on the data controller? Would a data controller be liable to prosecution if he simply took an application for information on a, b or c at face value? Would there be a legal obligation on a data controller to satisfy himself, as distinct from the fact that he can, if he wishes, satisfy himself?
There is. The data controller must satisfy himself that the information being sought will be used for the specific purpose for which it is being sought. Only then can he consider giving the information, but even then he does not have to do so. He has to be satisfied and clear in his own mind that he would be free of any obligations under the Bill, as regards the restrictions in the Bill.
Is that specifically stated in the Bill or is that the Minister's interpretation of section 8? Is it simply implied in section 8 that that is the case, or is it specifically stated somewhere?
Section 8 states that the restrictions do not apply for the reasons listed. Therefore, he is covered because of the way it is worded. If follows on from what is in section 8 and how the section is worded.
Normally in legislation such as this, for instance the Intoxicating Liquor Act for which the Minister deserves to be commended, in which people are given a responsibility like this, there is usually a phrase stuck in at the end to the effect that it would be a good defence where the person satisfied the court that he or she made reasonable attempts to ensure it but there seems to be no such qualification here.
It is not really necessary because the very first lines in section 8 state:
Any restrictions in this Act on the disclosure of personal data do not apply if the disclosure is...
It then lists a number of reasons. I am advised that it is not necessary. I accept the point the Senator is making but it is not necessary. Unless the data controller comes within section 8 he is not protected.
I am really not going to keep us much longer on this but like all legislation this will ultimately be interpreted by the courts. Can we give data controllers assurances about how the courts will interpret this section? The data controller might operate on one basis, but he might end up in court and discover that his interpretation was unfair. Is there sufficient clarity on what this means to protect data controllers for litigation because it seems that they will be the ones to carry the can rather than the people who look for the information?
There is no difference whatsoever between what Senator Ryan is saying and what I am trying to do. We both want to achieve the same thing. I am satisfied from discussion with my senior advisers and the parliamentary draftsman that I am able to give the data controller the protection he requires. I give that assurance to Senator Ryan.
Question put and agreed to.
Sections 9 to 35, inclusive, agreed to.
First Schedule agreed to.
Second Schedule agreed to.
Third Schedule agreed to.
Title agreed to.
Bill reported without amendment.
Question proposed: "That the Bill be received for Final Consideration".
May I avail of the opportunity to say that I had an amendment to the Bill on Committee but having spoken to the Minister's officials this morning I think the difficulty I was trying to raise with that amendment probably has been met? I was proposing to amend the Bill to read: "the main purposes for which the data are upheld" and to delete the description. The reason for this is that I had been approached by a number of people involved in medical research who were afraid that, if the title as it now stands were allowed to remain, it would mean that every piece of data would have to be described by them which would be laborious and extensive. I gather that under the regulations this problem will be addressed and the fears of these people are not as they perceive them to be. Perhaps the Minister could clarify the position.
I readily understand that Senator Manning is anxious about the requirement in section 3 that the data controller should give an inquirer a description of the data that would not involve him in giving a very detailed account. Obviously, he is particularly concerned about health data. I can give that assurance categorically to Senator Manning. Any holder of health data must register and the registration regulations will prescribe the way in which the data are to be described in the registered entry. It is envisaged that only a general description — and I emphasise the word "general"— will be required for the register and the same will apply to information given under section 3. I am happy to say I believe that assurance should satisfy Senator Manning's concern.
I thank the Minister. The assurance goes all the way to meet the worries of people involved in medical research.
I thank the House for the way in which it helped to deal with this legislation. I am thankful to Senators for their contributions and suggestions. They are very much appreciated.
Question put and agreed to.
Question, "That the Bill do now pass" put and agreed to.