Skip to main content
Normal View

Seanad Éireann debate -
Thursday, 3 Apr 2003

Vol. 172 No. 8

Data Protection (Amendment) Bill 2002 [ Seanad Bill amended by the Dáil ] : Report and Final Stages.

Acting Chairman

This is a Seanad Bill which has been amended by the Dáil. In accordance with Standing Order 103, it is deemed to have passed its First, Second and Third Stages in the Seanad and is placed on the Order Paper for Report Stage. On the question, "That the Bill be received for final consideration," the Minister of State may explain the purpose of the amendments made by the Dáil. This is looked upon as the report of the Dáil amendments to the Seanad. The only matters, therefore, which may be discussed are the amendments made by the Dáil. For the convenience of Senators, I have arranged for the printing and circulation to them of those amendments.

Question proposed: "That the Bill be received for final consideration."

Acting Chairman

Members may speak only once on this question.

The Bill passed all Stages in the Seanad on 24 April 2002. It subsequently lapsed on the dissolution of the 28th Dáil but was restored to the Order Paper on 18 June 2002. It now returns to this House for Report Stage having been amended in the Dáil.

I propose to outline briefly the aim and content of the changes made, some of which take account of concerns raised in this House. For ease of reference, I will go through the list of 28 amendments.

Amendments Nos. 8, 11, 22 and 27 are essentially drafting changes designed to improve the sense or layout of the text, while amendments Nos. 12, 14 and 20 provide in each case that the Minister shall consult with the Data Protection Commissioner in advance of making regulations under the respective provisions. Such consultation had already been provided for elsewhere in the Bill in relation to other matters and is fully justified in these instances also.

The aim of amendment No. 1 is to exclude from the definition of "direct marketing" any direct mailing activities carried out in the course of political activities by political parties or their members or by candidates for, or holders of, elective political office. The activities of a statutory body in this field are also covered by the exemption, for example, mailing by the Referendum Commission in advance of a referendum. The amendment is in keeping with other provisions already included in the Bill which recognise the importance of elections, political parties and political activity. Political activity and elections are essential foundations of our democratic system, and the citizen who has a right to vote also has a responsibility and duty to inform himself or herself about the aims and policies of the candidates putting themselves forward for election.

Amendment No. 2 seeks to make it clear that the exemption in respect of data kept solely for the purpose of historical research includes archives or departmental records as defined in the National Archives Act 1986. It is important to ensure such archives and records are safeguarded for research purposes. I am confident that the Data Protection Commissioner and the Director of the National Archives will work together to ensure clear and consistent guidelines in this area and that this co-operation will ensure adequate protection for all archival material.

The text of amendment No. 3 deals with the interface between the data protection and freedom of information regimes. It provides that a right under data protection law shall not prejudice the exercise of a right under the 1997 Freedom of Information Act. Where, for example, a data subject fails to obtain access to personal data under the Data Protection Act – perhaps because it is manual data that are not recorded in a relevant filing system – the person concerned may, depending on the circumstances, have a right to gain access to the data under the 1997 Act. To ensure appropriate communication and co-operation between the Data Protection Commissioner and the Information Commissioner with regard to personal data, the amendment also provides that both commissioners shall co-operate and provide assistance for each other in the performance of their respective duties.

I want to mention amendment No. 18 at this stage because it also touches on the functions of both commissioners. Its purpose is to protect personal data being kept by the Data Protection Commissioner and the Information Commissioner for the purposes of their respective functions from access requests. By virtue of section 5 of the Data Protection Act 1988, the Data Protection Commissioner is already protected from such requests where he or she is carrying out an investigation into an offence under the Act. However, where the activity being investigated does not constitute an offence, the protection afforded by section 5 may not be adequate. Likewise, the Information Commissioner is protected under section 46 of the 1997 Act.

Amendment No. 4 amends the wording of the "fair processing" principle. The position is that it is not necessary to state data shall be processed "lawfully" in paragraph (a) because the Bill goes on to specify and set out the detailed conditions under which non-sensitive and sensitive personal data may be processed. The words used in the EU directive in this context are similar to those in the Council of Europe convention on which the 1988 Act was based. The wording in the 1988 Act, therefore, does not need to be changed.

Amendment No. 5 deletes a subsection in the 1988 Act that was originally included to provide a possibility for additional safeguards in relation to the handling of sensitive personal data. However, the provision was never used and no regulations were ever made. The provision is now superfluous because the safeguards are set out in the Bill.

Amendment No. 6 inserts the phrase "including personal data that is required by law to be made available to the public" in the new subsection (8). It is intended to address the problem of public data such as registers being used for direct marketing purposes. The amendment means that where personal data obtained from such a source are to be used for direct marketing, the persons to whom the data relate must be informed by the data controller that they may object, free of charge, to any such processing. The amendment will effectively address difficulties that have arisen in this area during the years and which have given rise to complaints to the Data Protection Commissioner. It replaces the earlier text of subsection (5) intended for inclusion in section 1 of the Act.

The importance of data subject consent was raised in this House at an earlier stage by former Senators John Cregan and Farrell. Amendments Nos. 7 and 9 deal with this important matter. The EU directive which forms the backdrop of the Bill provides that the processing of both non-sensitive and sensitive personal data is permitted with the consent of the person concerned, that is, the data subject. The Bill originally provided that consent should be explicit in the case of both non-sensitive and sensitive data. However, the directive does not prescribe explicit consent when it comes to processing non-sensitive data. Concerns were expressed by a range of interests, including most recently the legal affairs group of the Information Society Commission, that the Bill went further than required by the directive and it was agreed to drop the requirement for explicit consent in relation to non-sensitive data.

The other issue raised in this context was the need for parental consent. The Bill originally required the consent of a parent or guardian where the data subject was under the age of 18 years. However, many people of this age are in third level education or working and parental consent is neither feasible nor necessary. The amendment provides that the consent of a parent or guardian should be required only where the data subject is unable to give consent for reasons of physical or mental incapacity or age.

Amendment No. 10 deals with the processing of sensitive personal data on a number of grounds not originally included in the Bill. These relate to the administration of justice and the performance of functions conferred by statute or required for the performance of a function of the Government or a Minister of the Government. These forms of processing had not been mentioned specifically in the Bill as proposed because it had been intended to provide for them in regulations to be made at a later date. However, as a general rule, and wherever possible, detailed provisions should be included in primary legislation.

Amendment No. 13 deals with the sensitive manner in which data relating to convictions, offences and sanctions should be handled. The issue was raised in this House by Senators Cregan and Farrell and the amendment seeks to address their concerns. The new subsection set out in the amendment relates to the handling of sensitive personal data concerning offences, administrative sanctions and judgments or decisions in civil proceedings. It may be entirely reasonable in certain circumstances for a data controller to keep a record of offences or sanctions but the sensitivity of such data means that they must be treated and handled with care. Some of this may be in the public domain but other data may not be. For example, an insurance company may be fully justified in retaining material of this nature for the purpose of guarding against fraudulent claims. My Department will consult the Data Protection Commissioner in relation to possible regulations to be made under this new provision.

Amendments Nos. 15 and 17 deal with the issue of confidentiality of sources and information supplied in confidence. The new requirement on a data controller to disclose whatever information is available about the sources of data could have unintended and serious consequences, one of which might be a reluctance on the part of people to volunteer information in a variety of situations where the availability of that information could have beneficial consequences. The possibility that sources might be disclosed could deter the giving of such information which would not be in the public interest.

Amendment No. 17 relates specifically to section 4(8) of the 1988 Act which deals with access to personal data concerning physical or mental health or data kept for, or obtained in the course of, social work. It provides for the making of regulations restricting access to such data where the Minister considers it desirable in the interests of data subjects to do so. Such restrictions are currently set out in the Data Protection (Access Modification) (Health) Regulations, 1989, and the Data Protection (Access Modification) (Social Work) Regulations, 1989. The effect of these regulations is that health data or data obtained in the course of carrying out social work shall not be supplied to a person if it would be likely to cause serious harm to the physical or mental health or emotional condition of that person. The amendment broadens the grounds for restricting access to include a public interest ground.

Amendment No. 16 addresses the provision whereby expressions of opinion by another person may be released without obtaining the consent of that person could create pressure to release material given in confidence or on the understanding it would be treated as confidential. The Freedom of Information Act already restricts access to information given to a public body in confidence or on the basis that it would be treated as confidential if its disclosure would be likely to prejudice the giving of further similar information from the same person or other persons.

Amendment No. 19 restricts the right to object to processing in certain circumstances. Since a data subject may be subject to legal obligations, for example, payment of taxes, the amendment provides that the right to object to processing should not apply in such cases. The Bill already provides that the right to object does not apply where a data controller is subject to such a legal obligation.

The purpose of amendment No. 21 is to ensure consistency between section 8 of the 1988 Act and the new definition of processing in this Bill. It will mean that restrictions on processing set out in the Act do not apply in the situations outlined in section 8. This is in line with Article 13 of the EU directive which provides for restrictions on the obligations and rights set out in various articles for the reasons set out in Article 13.

Amendment No. 23 concerns registration requirements. The Bill provides for the registration of all data controllers and processors except those specifically excluded. Some of the excluded categories are mentioned but there is also provision for the exclusion of "prescribed" categories. "Prescribed" in this context means prescribed in regulations made by the commissioner with the consent of the Minister. The directive contains some flexibility regarding registration requirements. Since registration could be seen as involving an additional burden on small-scale data controllers and processors where there is no obvious risk to fundamental rights and freedoms, it is intended to seek the views of interested and relevant parties regarding future registration obligations. With this in mind, the amendment provides that the registration requirements will be specified in regulations made by the Minister following consultation with the Data Protection Commissioner.

Amendment No. 24 increases the penalties set out in the 1988 Act. On the basis of advice provided by the Office of the Attorney General, the fine of £1,000 on summary conviction increases to €3,000, while the fine of £50,000 for conviction on indictment becomes €100,000.

Amendments Nos. 25, 26 and 28 deal with the entry into force of the Bill. It had been intended that it would enter into force on a specified day after its passing but the amendments will allow activation of its provisions by means of commencement orders. This will, for example, facilitate a consultation process in relation to future registration requirements.

This Bill was brought before the House in April 2002 by the then Minister of State at the Department of Justice, Equality and Law Reform, former Deputy Mary Wallace, but lapsed with the dissolution of the Oireachtas. There must be a great deal of frustration within the Department about the time lag involved in the publication and enactment of the legislation. Its genesis is the EU directive to which we signed up in 1998, when a commitment was given that within three years of signing the directive, the legislation would be passed. It is worrying that we have not managed to hold to this.

The Minister of State referred in the other House to the fact that we were discussing the Data Protection (Amendment) Bill, an amendment to the 1988 Act. It is very difficult to get a grip on legislation when two Bills are involved. There is a need for consolidation in this area. I would like the Minister of State to indicate if this will be done in order that the legislation is more accessible.

We welcome the amendments to the Bill which follow a number of proposals made in both Houses on Second Stage. It is interesting that the Minister of State referred to ideas put forward last year by former Senators John Cregan and Farrell. In the main we welcome these amendments but I would like to put a number of questions to the Minister concerning some of them.

The first amendment concerns the exclusion of the definition of direct marketing where it concerns political activity, and it is eminently sensible. We all want to be in a situation where we can engage with the public by means of communication without undue pressure being brought to bear on political parties and individuals in terms of conformity. I understand there is a requirement on all politicians to be registered with the Data Protection Commissioner. Does the Minister have information from the commissioner concerning the number of politicians who have registered with his office? The fee as I understand it is very small, perhaps €10 annually.

Such registration concerns the right of politicians to hold information on a variety of constituents, some of that information being personal. In order for the politician to have that information in his or her office in electronic or manual form, it is required that a register be made with the Data Protection Commissioner. This is a legal requirement and the commissioner does his best in conveying this to Members, but we need to know the exact number of politicians who have registered. Where personal records are kept on individuals, with files being processed by colleagues in both Houses, it is in the interests of the individuals that the politicians involved should be registered. I would like to know the level of compliance in this area.

I agree fully with amendment No. 2, which deals with historical research, including archives or departmental records, and which makes sense. The Minister of State would be aware that the 30-year embargo rule applied before the introduction of the Freedom Information Act 1997, and there has been a significant advance since then. There is an obligation on the Data Protection Commissioner and on the director of the National Archives to work together to ensure consistent and coherent guidelines are put in place. I know that is conveyed in amendment No. 2.

There is one possible bone of contention which I will put to the Minister of State. It is in relation to the Freedom of Information Act itself. As the Minister knows, the debate has raged in this House and is now in the other House concerning the amendments the Government proposes to that Act. Would it not have been more sensible to wait for the final, amended version of the Freedom Of Information Bill to be enacted by both Houses of the Oireachtas before we put in place the legislation now under discussion?

The Minister, in the context of amendment No. 3, has referred to the Freedom of Information Act, but we are no longer talking about the Act as it stood in 1997, because of the substantial amendments since made to it. That matter is not resolved. The Seanad debated it for 24 hours only some weeks ago, it is now at Committee Stage in the Dáil, and already the Minister's colleague, the Minister for Finance, Deputy McCreevy, has given way on substantial amendments.

I put it to the Minister that because of the confluence between the data protection legislation and the freedom of information legislation, it might have been more sensible to await the final form of the Freedom of Information Bill before we proceeded with the Bill under discussion. I know the matter will be resolved within the next two weeks, because it must be in order for the changes to apply in relation to the five-year rule.

Amendment No. 6 includes the phrase "including personal data that is required by law to be made available to the public". The Minster stated that where personal data obtained from such a source is to be used for direct marketing, the person to whom the data relate must be informed by the data controller that he or she has the right to object, free of charge. That is certainly a useful amendment, but how does a person object? In order for people to object, they need to know the personage of the Data Protection Commissioner and know that the commissioner is in place. While no doubt the Commissioner himself has tried to inform the public as to the functions of his office, many people do not know that this office exists. There would need to be a significant campaign to make this amendment workable, because if people know they have the right to object, they must know the person to whom their objections should be made.

Amendment No. 13 follows comments made by the former Senators John Cregan and Farrell, and involves data relating to the handling of convictions, offences and sanctions. I do not object to the amendment – this matter must be handled sensitively. However, it is important for the purposes of research that we know the number of convictions, penalties and sanctions that have been imposed by the courts or other bodies. Is the Minister convinced that even when this amendment is put in place, from a legal perspective we will be able to have recourse to that information? In terms of the sanctions involved and the people who for example suffer burglaries, it is important that the actual numbers involved – not the personages, or the profiles of the cases – but the numerical information, should still be in place. This is very important for research purposes.

In relation to amendment No. 23, the Minister of State has stated that "prescribe" in this context means prescribe in regulations made by the commissioner with the consent of the Minister. If there is a difference between what the commissioner wants to prescribe and what the Minister wants to consent to, how will the Members of the Oireachtas know? I presume the commissioner makes a regular report, but from a parliamentary scrutiny perspective, do we have an automatic right to know where there is disagreement between the commissioner and the Minister? There may well be such disagreement. The Minister of State might comment.

On amendments Nos. 25 to 28, inclusive, which deal with the entry into force of the Bill, I put it to the Minister of State that there should be a specific date for the commencement of each Bill. I referred to this in the Order of Business in the Seanad today. The Ombudsman for Children Bill went through the House more than two years ago. A specific amendment was put to the Government at the time concerning the operation of the Bill, yet we still do not have an ombudsman for children. If we had been given an actual date of commencement, that person would be in place to deal with children's rights.

The same principle applies in the Bill under consideration. It is inherently wrong that where we establish law, we do not state exactly the date when that law comes into effect. Such a situation gives far too much power to the Government of the day, whatever Government is in place, regarding the introduction of legislation. We should look at this again. A commencement date gives an element of parliamentary control on the legislation passed by both Houses. The Minister of State might give his extended views on that matter.

I welcome the main purposes of the Bill and the amendments before us. The Labour Party greatly welcomes this legislation and has a responsibility in relation to the same, having secured the inclusion in the 1994 programme for Government that the provisions of the Data Protection Act be extended. I agree with Senator Brian Hayes that there is a need for consolidation of the legislation and would like to hear the Minister of State's views.

In the time available to examine the amendments today, it has been difficult to grasp their meaning. I would like the Minister to clarify one or two points in particular. One concerns amendment No. 4. I appreciate the Minister's explanation for deleting the words "and lawfully", but I wonder whether that is necessary. If it was thought acceptable to include it in the original Bill, it seems reasonable to leave it in.

I totally accept the Minister's explanation for amendment No. 7, but I have concerns about its implementation and whether the Minister is happy. It does not clarify the age of the person and whether he or she consents. I would like to hear the Minister on how the Data Protection Commissioner will implement that section.

Amendment No. 21 concerns the substitution of "processing" for "disclosure" in each place where it occurs. I know that disclosing information is included in the definition of "processing", but I ask the Minister if he is happy to replace each mention of "disclosure" with "processing", for the meaning might be different in the original legislation. I ask the Minister to clarify that amendment.

Senator Brian Hayes's point about the importance of politicians being registered is very true. Solicitors have an education programme about the effect of the legislation on them, and perhaps we in the Houses of the Oireachtas should have some training about the Act and its implications for how we comply with the legislation in holding data. I also agree with Senator Hayes's point that we do not know what form the Freedom of Information Act will take, since it is still in progress through the Houses of the Oireachtas. It would have been better to adopt this legislation with that knowledge to hand.

Perhaps the Minister might further clarify the purpose of amendment No. 18. I am concerned that the wording is particularly broad.

I join the other Senators in welcoming the Minister to the House. I support the amendments. As Senator Brian Hayes has said, it is great to see concerns raised in the last Seanad, of which many of us were not Members, addressed by the Minister and the Department, and finding their way into this Bill through the other House. These amendments further strengthen the legislation underpinning the protection of individuals regarding the processing of personal data and the free movement of such data. It is particularly important now.

I have a special interest in the delivery of services electronically, including Government services. We hear much about e-Government and the delivery of State services electronically. This legislation and the amendments on which the Minister has spoken seek to underpin public confidence in the protection of those data. For many years, there was a concern abroad about the way in which Governments, not just in Ireland but around the world, protected such data. There was a worry about the Big Brother approach and that, the more information was gathered, the more it would be used or abused at a later stage. It is therefore all the more welcome that this legislation is going through, and that, as future Governments seek to roll out electronic services to the public, that confidence continues.

Unlike Senator Brian Hayes, I am not too concerned about the delay in the legislation's passage, since it is better late than never. I am sure that the Minister will agree with me that the reason for the delay has been the large volume of legislation that this Government and its predecessor have succeeded in processing during their terms in office.

Ramming through.

Certainly not. As Senator Hayes knows, we consider all legislation carefully. The extent of consultation has been such that the views expressed have found their way into the legislation. In the case of certain Bills which we may not be able to guide through in the final stages of our term, we would hope that an incoming Government would be kind enough to ensure that our concerns were taken on board.

I thank Senators for their contributions both today and in our earlier discussions. Senator Brian Hayes raised a number of points, first regarding the fact that the directive dates from 1998, and that only now in 2003 are we implementing the legislation. I agree with his point and plead in defence that a general election occurred in between. That accounts for some of the delay but does not alter the fact that a five-year delay is quite unacceptable. The Government is conscious that it will have to shorten the timescale between the issuing of EU directives and our implementation of the same.

Senator Hayes also asked about consolidation, as did Senator Tuffy. They made the point that it is difficult to read two such Bills together. I am glad to be able to tell them that both pieces of legislation will be restated under the Statute Law (Restatement) Act 2002 before the end of 2003. Senator Hayes also asked the very interesting question about how many politicians had actually registered with the Data Protection Commissioner. I am informed that such questions are a matter for the data controller – the politician in this case – and the Data Protection Commissioner. We have no involvement, so I do not have that information.

We have waited to see the final shape of the Freedom of Information Act before proceeding with this Bill. The amendment to the Act was drafted in the full knowledge of this Bill's contents. Senator Hayes asked how a data subject can object to the use of direct marketing data –in other words, the need to publicise the office of the Data Protection Commissioner. I am conscious of that, and the Data Protection Commissioner has now been asked to engage in public consultation to draw more attention to his office. However, judging by the number of queries received and the interplay between the Data Protection Commissioner and the public, there seems quite a degree of awareness – more than I thought – of that office's existence.

Senator Hayes asked whether the provisions for the administration of justice will in any way affect information being released about numbers of convictions. That is not the intention, as will be clear in the regulations. He also mentioned the commencement provisions. I understand what he is saying about that, but I say quite deliberately and unequivocally that it is intended that the vast bulk of the Bill's provisions will commence by 1 July.

There are two matters about which consultation is needed, the first being the enforcement of direct access provisions. We must wait to put a proper vetting system in place. The second matter concerns which organisations will be exempt from registration. We need consultation on that. If we said that we would implement everything on one date, other things that we could implement on 1 July would have to wait until those consultation processes had been concluded. I would prefer us to get on, in so far as we can, by 1 July, and I assure the House that no avoidable delay will be entertained regarding the implementation of the rest of the legislation.

Senator Tuffy asked me about the reason for the deletion of the words "and lawfully", dealt with in amendment No. 4. We have had extensive consultation with the Attorney General's office about this matter. The advice we received was that the phrase is tautologous. In other words, there is no need for the words to be included and it does no violence to the legislation to remove them. There was, as far as I am aware, a supplementary reason for that as well. There are exemptions for certain materials relating to the investigation of offences, etc., and if we had retained the words "and lawfully", it would give the impression that the police were acting unlawfully or that people disclosing information to the police were doing so.

On the question of age to which Senator Tuffy referred, there was a general cut-off point, namely, 18 years of age. If one was under 18, the consent of one's parent or guardian had to be obtained. There were various bodies which made representations about that matter and stated that some people who are actually under the age of 18 are either in college or working and are fully capable of making their own decisions in that regard. It was in response to those representations that we decided that there would not be any hard and fast rule about age. It may be that when people consult about, and discuss, the regulations, they will come up with an age limit. It will be under 18 in any event. It may, alternatively, be dealt with on a case by case basis, depending on the individual.

The Senator also raised the question of amendment No. 21 and the substitution of the word "processing" for that of "disclosure". Processing includes disclosure, but processing is a wider concept than disclosure. The EU directive deals with processing and, therefore, the various safeguards and qualifications in the Bill relate to processing. There was no legitimate reason to apply some of them only to disclosure and, as such, apply some to processing.

Senator Tuffy also raised the question of the provision of training for Members of the Oireachtas in respect of the workings of the legislation. That is an interesting point and I will bring it to the attention of the relevant people. I received some correspondence, as I am sure did Members of the House, about a training course on how IT applies generally in the office of the parliamentary counsel and on the various facilities available to Deputies. I understand the course took place at some unearthly hour this morning and I do not know how many managed to attend.

Senator Tuffy also referred to amendment No. 18. If either the Data Protection Commission or the Information Commissioner has personal data for the purpose of his or her functions, it should not be subject to an access request. The access request should be made to the data controller in each case. That amendment, to shield information which either commissioner had for the purpose of doing their job, was introduced specifically on the advice and on the recommendation of both commissioners, and it is not unreasonable.

I thank Senators for the various points they have raised and for their quite considerable contribution to improving this legislation. We are left now with a far better, far preferable and far more workable piece of legislation than that which we began. I thank Members of both Houses who have contributed and made that possible.

Question put and agreed to.

Acting Chairman

When is it proposed to take the next Stage?

Question, "That the Bill do now pass," put and agreed to.
Sitting suspended at 12.45 p.m. and resumed at 1 p.m.