Data Sharing and Governance Bill 2018: Report and Final Stages

Before we commence, I remind Members that a Senator may only speak once on Report Stage, except for the proposer of an amendment who may reply to the discussion on it. Each amendment must be seconded. Amendments Nos. 1 and 83 are related and will be discussed together.

Government amendment No. 1:
In page 7, line 9, after “Board;” to insert “to amend the Social Welfare Consolidation Act 2005;”.

We had a good discussion on Committee Stage on a number of different issues relating to the Bill. We have reflected on much of what was discussed and, in particular, on amendments raised by Senators Higgins and Ruane. I have made many amendments to the Bill as a result. There will be some other amendments, which I will need to take to the Dáil and, as a result, return to the Seanad. I have been able to accommodate many of the amendments proposed on Committee Stage. I have reflected on the language of some and there are some that, unfortunately, I cannot accept. It will become clearer as we go through this Stage but I have taken much on board. I thank the Members for their contributions.

Amendment No. 83 creates a new section of the Bill providing for the addition of the National Shared Services Office, NSSO, to the list of public bodies specified under the Social Welfare Consolidation Act 2005 to collect and process the personal public service number, PPSN. Amendment No. 1 is a consequential technical amendment to the Long Title of the Bill to reflect the change. The NSSO currently uses the PPSN to provide human resources, pensions and payroll services to the Civil Service. It relies on the same lawful basis that all organisations, public or private, use to provide these services to staff. NSSO functions are currently being expanded to include the processing of financial transactions for the Civil Service, Departments and offices. Many of the grant schemes the NSSO will be expected to carry out processing on will utilise the PPSN, where appropriate, where they involve applications, claims and payments. To ensure the NSSO is able to fulfil this expanded remit and to use and process the PPSN where this is required, there is a need for the office to be made a specified body under the Social Welfare Consolidation 2005 Act. I ask the House to support the amendments.

I will comment briefly on this because it is a new amendment. I do not have a counter amendment. Concern has been raised about the single customer view dataset associated with the public services card, PSC. The Minister of State referenced the PPSN but the single customer view dataset is wider than that. The issues are subject to some debate around interpretation. I refer to special categories of personal data in the form of biometric information contained within the single view customer view dataset. That part of that information cannot be exchanged under this Bill because the largest part of the Bill explicitly excludes special categories of personal information. I will not oppose or call a vote on the amendments at this point, or perhaps I will just to deal with them technically. I realise I do not have a counter amendment. I am concerned, when we go towards the exchange, that it is not simply the PPSN. Can the Minister of State assure me that only the PPSN will be affected or will there be access to the single customer view dataset? This will create problems down the line, perhaps ones that can be dealt with in Dáil.

To clarify, the full public service identity, PSI, dataset will be covered.

Those issues will arise but I expect they can be debated in the Dáil.

Amendment put and declared carried.

Amendment No. 2 is a Government amendment. Amendments Nos. 2 to 9, inclusive, 16, 22 to 24, inclusive, 34 and 82 are related. Amendment No. 3 is a logical alternative to amendment No. 2. Amendment No. 8 is a logical alternative to amendment No. 7. Amendments Nos. 2 to 9, inclusive, 16, 22 to 24, inclusive, 34 and 82 will be discussed together.

Government amendment No. 2:
In page 9, between lines 24 and 25, to insert the following:
“Application of Act to special categories of personal data
5. This Act, other than Part 5, Part 8 and Chapter 3 of Part 9, shall not apply to special categories of personal data.”.

We had a lengthy debate on Committee Stage on the application of this Bill to the sharing of special categories of personal data as defined under Article 9 of the general data protection regulation, GDPR. While it has always been the intention that the legislation would not provide a general legal basis for the sharing of specific special category data, I acknowledge that the text of the Bill may not have been fully clear that this was the case. Accordingly, I propose an amendment to provide for the insertion of a new section that explicitly states that the Bill may not be used for the sharing of special category data. That was one of the points Senator Higgins raised.

There are also a number of consequential technical amendments to remove various references to special category data that will be rendered redundant by the insertion of the new provision. There are three exceptions to the prohibition on the processing of special category data in the Bill. The first of these relates to the processing of data under Part 5 concerning public service information. In some cases, it will be necessary to process special category data under these provisions, for example, to record if a public servant has retired on health grounds. The second relates to the personal data access portal. This is so that users of the portal will be able to see what, if any, special category data on them is held by public bodies. That was a point a number of Senators and I raised the last night. The third relates to Chapter 3 of Part 9 concerning the prescription of rules, procedures and standards for data management. That is also an issue we had much conversation on in the previous debate. Such best practice standards should also apply to special category data.

Senator Higgins has tabled several amendments on the applicability of the Bill to special category data. Amendments Nos. 3 and 82 propose that section 64 apply to special category data. I wish to inform the Senator that section 64 is not concerned solely with data sharing. Rather it is concerned with how all of the public service manages all of its data, including special category data. We may have a need, for instance, to prescribe strong binding standards for the handling of sensitive data, such as health data. If this amendment were accepted, this would not be possible. This cannot be what the Senator intended and I ask her to withdraw these amendments as I cannot accept them.

Amendment No. 5 would have the effect of making section 38 of the Data Protection Act 2018 apply to special category data. Section 38 does not currently apply to special category data so this would have a significant effect on the Data Protection Act.

Amendments Nos. 4, 5, 7, 8 and 9 are intended to exclude the application of specific sections of the Bill to special category data. These amendments are unnecessary, since the amendment that I am proposing to section 5 provides that the Bill does not apply to special category data, excepting for Parts 5, 8 and 9, for the reasons I have outlined and, given there is no need to keep restating that the Bill does not apply to special category data, I ask the Senator to withdraw these amendments.

Amendment No. 6 proposes that processing of special category data shall be subject to section 38 of the Data Protection Act 2018. I would like to inform the Senator that section 38 of the Data Protection Act relates only to the processing of "personal data" and does not provide a legal basis for processing special categories of personal data. Where special categories of personal data are concerned, the relevant provision under the Data Protection Act is section 49(b), which provides that subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing of special categories of personal data shall be lawful where the processing respects the essence of the right to data protection and is necessary and proportionate, another issue raised here the last time we debated this, for the performance of a function conferred on a person by or under an enactment or by the Constitution. I appreciate that this is very technical but the debate the last night was technical. I apologise for going on a bit. This amendment could have the effect of amending the Data Protection Act to permit the processing of special category data under section 38. This cannot be what the Senator intended when she made this amendment and I ask her to withdraw it.

Amendments Nos. 7 and 8 proposed for section 6 relate to interactions with the Social Welfare Consolidation Act 2005. These amendments seek to clarify that any elements of the public service identity, PSI, data set that constitute special category data cannot be shared in accordance with this Act. From the outset, we have been clear that the Bill does not provide a general basis for the sharing of special category data. That is an important point. We are reinforcing this with the proposed amendment to section 5, which I am adding on foot of the Senator’s comments on Committee Stage. This means that in the event that any part of the PSI included special category data, it would not be lawful to share that data under this Bill.

Can the Acting Chairman clarify whether we are also speaking to amendments Nos. 16, 22, 24, 34 and 82 in this group?

I thank the Minister of State and I acknowledge that there have been some significant steps forward on this, notably the provision in his amendment No. 2, which makes it clear that nothing in this Bill, except Parts 5 and 8 and Chapter 3 of Part 9 shall apply to special category personal data alleviates many of the amendments. Many of my amendments were submitted prior to the Government amendments. It is useful to see this. Several of my amendments which sought to address case by case the dangers of an inadvertent inclusion of special categories of personal data will no longer be necessary. That is very positive.

I have concerns about Chapter 3, Part 9. I addressed them here and that is why I propose that the Bill exclude special categories of personal data, not just from Parts 5 and 8 where I realise the case is strong in respect of pensions, in Part 5, and access to information on data breaches under Part 8. I do have some concerns on Chapter 3, Part 9, but I seek to address them in a later amendment in a different way and have had some indication from officials that they may be interested in considering that in another way so I might not need to press it.

My concerns were that because Chapter 3, Part 9, included several measures in respect of the grounds on which the Minister might be promoting data sharing, it would be important and probably inadvertent, if it were to suggest that the Minister is promoting data sharing in order to encourage data sharing, that it would not include special categories of personal information. There is a separate issue because it is a tautological argument. I am sure it will be addressed. I will leave it for now.

I recognise that amendments Nos. 3, 4 and 5 are perhaps not necessary in this case. In terms of amendment No. 6 I want particularly to recognise this was one of my deepest concerns in respect of the special categories of personal information and it was the danger that there could be an exclusion from section 38 of the Data Protection Act which would affect special categories of personal information and, as the Minister of State mentioned, there are suitable and specific measures involved. I am happy to withdraw that amendment.

I will press amendment No. 7 because it is important. This is an ongoing debate between me and the Minister for Employment Affairs and Social Protection, Deputy Doherty, with whom I agree on several issues but we disagree on photographs and biometric data. I would like the definition from the GDPR included in this Bill. I am happy to leave amendment No. 9.

Amendment No. 16 is a Government amendment. There would be no point in pressing amendment No. 22 because it seeks to replicate the measures in the Data Protection Act for clear procedures where public interest is invoked. I realise that given the location of my amendment it is no longer applicable to this section and to the Bill because special categories of personal data are no longer covered under that section.

I urge my colleagues in Sinn Féin and Fianna Fáil who supported the insertion of this measure into the Data Protection Act to ensure there is a similar measure which states that the Minister when invoking public interest, needs to set out very clear reasons for that public interest, and that it is placed in the appropriate section when the Bill goes to the Dáil.

My final amendment in this group is amendment No. 82 and is perhaps no longer necessary given the wide exclusion of special categories of personal data offered by the Minister. I sincerely thank his officials for engaging with me on that. It will narrow and clarify the function of this Bill in a constructive way.

I am accepting amendment No. 8 in the names of Senators Higgins and Ruane because it strengthens the language after the word "identity".

Similarly with amendment No. 9, where the Senators have drawn attention to Article 9 of the GDPR, it strengthens the language and I am prepared to accept it.

To go back to some of the commentary on section 22, the main issue, which the Senators will appreciate, is we do not want in any way to compromise the independence of the data commissioner. I know this is not what is intended but it would have that unintended consequence.

I am happy to accept amendments Nos. 8 and 9.

Amendment agreed to.

Amendment No. 3 has already been discussed and cannot be moved because amendment No. 2 has been agreed to.

Amendment No. 3 not moved.
Amendments Nos. 4 to 6, inclusive, not moved.

The Minister of State has indicated that he will accept amendment No. 8. If amendment No. 7 is agreed then amendment No. 8 cannot be moved.

On the basis of the Minister of State's clarification of his acceptance of amendment No. 8 I will not move amendment No. 7.

Amendment No. 7 not moved.

I move amendment No. 8:

In page 10, line 3, after "identity" to insert the following:

"excepting such parts of that public service identity which constitute special categories of personal data".

I second the amendment.

Amendment agreed to.

I move amendment No. 9:

In page 10, line 5, after "Act" to insert "and compliant with Article 9 of GDPR".

I second the amendment.

Amendment agreed to.

Amendments Nos. 10, 18 to 20, inclusive, and 35 to 37, inclusive, are related. Amendments Nos. 19 and 20 are physical alternatives to amendment No. 18. Amendment No. 20 is a physical alternative to amendment No. 19. Amendment No. 36 is a physical alternative to amendment No. 35. Amendments Nos. 10, 18 to 20, inclusive, and 35 to 37, inclusive, may be discussed together by agreement. Is that agreed? Agreed.

I move amendment No. 10:

In page 10, line 8, to delete "section 12(2)(a)(ii)(VIII)" and substitute "section 2(2)(a)(ii)(III) or (VIII)".

I second the amendment.

What is the grouping?

Amendments Nos. 10, 18 to 20, inclusive, and 35 to 37, inclusive, are in this grouping.

My concern is with regard to the only exemption to a specified body disclosing a person's public service identity information to another specified body. The intention of the amendment is to expand the grounds not to be considered appropriate for the sharing of somebody's personal information with a specified body. Avoiding the financial and administrative burdens that would otherwise be imposed on a second public body or another person where the amount is to be collected is mentioned. I recognise the Government has tabled its own amendment in this regard. Legal concern has been expressed at the highest European courts about the invoking of financial and administrative ease as the grounds on which personal information may be shared between specified bodies. The Government has tabled amendments with regard to avoiding a financial or administrative burden on the person. I recognise significant progress has been made in this regard because the Government now recognises that a financial or administrative burden for a body is not an adequate legal basis on which to share information and has reframed it to deal with financial and administrative burdens on a person. This is positive and I will support the Government's amendment in this regard.

I intend to press amendment No. 20. To make this meaningful, people need the option of being able to state they do not regard it as a financial or administrative burden to provide the information twice, and that it would be their preference to give each of the specified bodies the information separately rather than have them share it.

We cannot have an assumption that the preference of people is that their data would be shared between bodies without their explicit consent. They have to be asked. I do not go so far as stating they should be asked, which is what I would like to have included. I have tried to be reasonable and accommodate reasons of efficiency. I am simply looking to insert an opt-out so people can state they have given information to a particular public body and would prefer other public bodies that wish to use the information to ask them directly rather than having the information shared. It comes back to financial and administrative burdens. Some people will say it is convenient and wonderful that their data is shared between many bodies, that they do not have to think about it and that they have to be asked for it only once, but others will state that for them it is not burdensome to decide in each instance to give their information directly to a number of different bodies for the reasons and purposes they set out and to have control of their data. For some people it is more financially and administratively burdensome to trace retrospectively where their information has been exchanged. Some people will make a point of trying to track it.

I accept there is progress. I recognise the default measure will be an assumption that people are happy to have their information shared but I ask for a mechanism, and perhaps it is something that may be considered in the Dáil, to allow those probably quite few individuals who do not want their information shared without their knowledge to have the option to state they would prefer to engage directly with each body. It is a very small point but it is important for the dignity and element of choice of the person. This is with regard to amendment No. 20, which is the only amendment of particular concern to me in this grouping.

Amendment No. 35 makes the same point. In amendments Nos. 20 and 37 I have given two approaches and it would be good if the Minister of State was able to indicate whether one of the approaches is more amenable to him. In amendment No. 20, I suggest a person could give instruction that he or she does not regard collection of personal data directly by a public body as burdensome. In amendment No. 37, I suggest a mechanism might be provided to allow a person to whom a service is about to be delivered to give instruction that he or she does not regard collection of personal data directly as a burden. These are the two approaches and I am very happy to press only one.

The Minister may have a suggestion as to how to address the issue but he will understand the point I am trying to get to.

Government amendments Nos. 18 and 35 arise directly out of discussions we had with Senator Higgins on the previous occasion, and they clear up some of the issues.

On amendment No. 20, Senator Higgins referred to mechanisms that would be available to the individual. There is a right to object enshrined in the GDPR process. There is also a fairly protracted public consultation process that goes on well in advance of the agreements being set out. In addition, the public can avail of the data protection complaints process. One of the concerns - I have gone through this in detail with the officials in my Department and I know it would not be an intended consequence - relates to the fact that the genesis of the Bill is to allow for data sharing. We do not want to have a situation where every single individual would have to be contacted in advance of the data being used. and I know that is not what the Senator intends either.

All data sharing under the enactment of the legislation goes through a rigorous governance process which has been identified and which has been accepted by the House, which includes a public consultation inviting the public to make submissions on the proposed data sharing. Also under GDPR, the right to object applies, giving data subjects the right to object to the processing of their individual data at any time. A data subject may also lodge a complaint with the Data Protection Commissioner if he or she feels that his or her personal data is being processed inappropriately. The purpose is to remove the financial or administrative burden placed on them as a person. This is a positive thing for citizens as I am sure the House will agree. However, as I have outlined there is also ample measure in place for citizens to make an objection if they see fit. I ask the Senator to consider withdrawing amendment No. 20 on the basis of the thrust and the spirit of what is envisaged to be captured in it already being available through other mechanisms.

As the Minister of State, Deputy O'Donovan made clear, there is a right to object, but I hope a better way of dealing with it will be found in the Dáil. This amendment is not simply about objecting to the processing of personal data because in many cases people do not object at all but they may object to an automatic mechanism being put in place as to how their data will be processed. People may say they have absolutely no problem with a sports authority or another body having their data but may want them to ask them individually. There is a letter in one of today's newspapers from a large number of ex-academics from Maynooth, Digital Rights Ireland, the Irish Council for Civil Liberties and Data Compliance Europe explicitly addressing the concerns about the automatic mechanism, the idea that one should not assume that people want to give their data once to the system and have it go on its journey forevermore. A mechanism will have to be found, not to object to the data use because in many cases people do not want to object to the data, but to object to the mechanism deployed. It may only involve a small number of people but the simplest way to address it is to put a measure in place for those involved.

I accept that my wording and my approach to this might not be perfect. It would neither serve the State nor the citizen well if the only means by which people can address what is in fairness a very small but, for many people, deeply personal concern, is through laborious journeys through our court system, through objections and the full mechanisms of the Data Protection Commissioner. Yes there are hefty complaint mechanisms in place but I think mechanisms of consent would be an easier way to deal with the issue.

I ask the Minister of State to reconsider my wording. I absolutely acknowledge that there has been a shift in this area. If we say we are concerned for the individual, we need to follow through by allowing a person to express concern.

I will accept Senator Higgins's suggestion that I reflect further on this in advance of the Bill going to the Dáil. I think the Senator understands the reason I cannot accept the amendments today. I noted the contents of the letter that was published in the newspaper. I hope that some of the clarifications that have been given here today on the existing legal mechanisms that are in place will ease the concerns of the academics who have voiced them.

I hope the Senator will appreciate the constraint I have. Further amendments along the line may address some of the points she has raised.

Before I proceed with the Bill, I wish to welcome Deputy Charlie McConalogue and his guests to the public Gallery.

Is Deputy Higgins pressing amendment No. 10?

No. I will withdraw it.

Amendment, by leave, withdrawn.

Amendment No. 11 in the names of Senators Higgins and Ruane arises out of committee proceedings-----

Apologies, have I missed my opportunity to press amendment No. 10?

Yes. Unfortunately I have moved on to amendment No. 11. Amendment No. 11 in the names of Senators Higgins and Ruane arises out of committee proceedings. Amendments Nos. 11, 17 and, 38 to 41, inclusive, are related. Amendments Nos. 40 and 41 are physical alternatives to amendment No. 39. Amendments Nos. 11, 17, and 38 to 41, inclusive, may be discussed together by agreement. Is that agreed? Agreed.

I move amendment No. 11:

In page 10, between lines 14 and 15, to insert the following:

“(6) A specified body may not make presentation of a public service card or access to a person’s public service identity the sole or exclusive basis by which a person may confirm their identity in order to conduct a transaction or access a service.”.

I second the amendment.

The Senator may discuss the other amendments that are grouped with No. 11.

Amendments Nos. 11 and 17 relate to the concern about the public service card and the single customer view dataset. Again the measure we are looking to tackle here has become more important because we now have the Social Welfare Consolidation Act included in the rubric and it is now explicitly implicated in this Bill.

We have major questions around the public service card and legal concerns have been raised. There is a report on this, which is not yet published but due to be published under a section 10 investigation by the Data Protection Commissioner. There have been numerous stories during the summer since our last discussion, highlighting the very serious concerns, including potential legal concerns, on this matter. On that basis, amendment No. 11 is very reasonable. It simply proposes that while a public service card might be presented as a basis for conducting a transaction or accessing a service, it cannot be the sole or exclusive basis for so doing. While there are still question marks over this mechanism and a serious concern that has not been addressed, it should not be the case that it is the only basis on which a service user can be identified. One is effectively forcing people to comply because many of these services are vital. We have seen very positive movement from the Minister for Transport, Tourism and Sport in respect of the driver's licence because there was a situation whereby one could not access a driver's licence. In some cases a person's employment would be precarious if they could not drive unless the individual was willing to agree to the exchange of data or joining the single customer view dataset. This is again around the options for the individual. It is particularly important at a time when we cannot robustly stand up and say the single customer view dataset is adequately and completely to the satisfaction of the Data Protection commissioner in terms of the legal basis for sharing how information is stored. It may be the case that we get to that point, but at present we do not have that assurance. That is the basis for this amendment, which is simply saying if one wants to access a bus or other service, one should not have to have a single customer view dataset card as the only acceptable identification.

That causes a lot of distress for people. These issues can be abstract but they can be deeply personal as well, as we know from the large number of people who were distressed at having to get a PSC as a condition to attend college or access child benefit. This is particular to other bodies outside of the social protection system. So much for amendment No. 11. Amendment No. 17 effectively addresses the same issue.

I turn to amendments Nos. 38 to 41, inclusive,. Amendment No. 38 provides that the Minister will "have regard to whether provision is made for a person’s right to verify their identify using an

alternative process". We have been told that the PSC is not an identity card. Surely there must be another mechanism by which a person can prove their identity. Amendment No. 39 is the Minister of States and I will respond when he has contributed.

Given the changes that he is making, I will not speak to amendments Nos. 40 and 41 yet. Amendment No. 40 will no longer be necessary if the Minister's amendment is successful, as I am sure it will be. I acknowledge that it represents progress, but it is not fully clear to me. I find it hard to see what it means. I was concerned about this Part of the Bill because it seems to suggest that in cases where information is stored in a base registry, the public body would be obliged to go to the registry to access the data and would not have other mechanisms or opportunities. I recognise that there has been a change. Perhaps the Minister of State can explain how this change addresses my concern, namely that there are instances in which the best practice is to gather information from a person. I am particularly thinking of some of the social and other services that may involve particular vulnerabilities. Sometimes the very act of asking for consent or information has an empowering and sociologically necessary function. I am genuinely not sure about this. I can see that the Government has changed it. I am not exactly sure how it addressed my concerns, and I apologise that I need clarification on that.

Finally, amendment No. 41 still stands. It is perhaps a little more bluntly worded. It inserts the wording, "other than where that information may be sought or collected on the basis of direct consent of the person or data subject". There might be times when someone should be personally asked for a name or address, for example, for inclusion in a Christmas list or a therapeutic project. Whatever the reason might be, this allows for human engagement, which is one of the indicators of success for social work. It is quite technical. I apologise, but I am not clear on amendment No. 39.

The Senator has raised some of the points I wished to raise about amendments Nos. 11, 17 and 38. The basic issue relates to the Social Welfare Consolidation Act 2005, to which the Senator has referred. It is pre-existing law, whether we like it or not. I cannot accept amendments that would be in direct conflict with provisions relating to the PSC set out in existing legislation.

In regard to amendment No. 39, which amends altering section 42, I note that the third last line of the amendment is the most important in figuring out what it is about - "the information so collected is collected for the purposes of enabling that public body to access information". The information is an enabler. It is the first piece of data, accessed before the dataset is even compiled. It was referred to earlier as the key rather than the lock itself. It is the initiating piece of data, which allows the public body to collect the initiator, as opposed to the subsequent pieces of data that will be collected thereby.

Senator Higgins is correct about amendments Nos. 40 and 41. If amendment No. 39 is accepted, amendments Nos. 40 and 41 will be nullified. I appreciate the issues the Senator has raised about the PSC in the amendments. In respect of section 6, the Senator is proposing to provide that the card, or the underlying public services identity data associated with the card, cannot be "the sole or exclusive basis by which a person may confirm their identity in order to conduct a transaction or access a service". Similarly, the Senator proposes to amend section 12 to provide that the data may be shared "as one non-mandatory means to verify the identity of a person".

Amendments Nos. 38 and 41 provide for the person receiving the service to decide for themselves what is an appropriate means of identification. Current legislation clearly sets that out. Service providers must put in place necessary and proportionate requirements for identity verification to ensure services are provided to the right person and to protect personal data.

The Senator will appreciate that in light of the GDPR and the importance that Government places on the protection of personal data, it is more important than ever that we ensure the providers of public services are certain they are dealing with the correct people. This is only fair, given that in many cases it is not only a question of dealing with the right person but also one of dealing with large sums of the State's money. That is an important part of the security with which the State wants to be surrounded. The State has invested significant money and resources in the PSC MyGovID and the underlying safe registration process and it continues to do so. It is a result of the safe registration process that the card and MyGovID are the most robust and assured means of establishing a person's identity when he or she accesses a public service. In this context, it is a matter for each service provider to decide the most appropriate means by which it verifies a person's identity. That is why I referred to the Social Welfare Consolidation Act 2005, because in that case it is identified. This should be necessary and proportionate to each service. I know we will discuss the words "necessary and proportionate" later. It is something the Senator referred to a lot. One never knows; there might be further good news. It is not appropriate to place a blanket restriction on how the PSC or public services identity data can be used to facilitate data protection. On that basis, I do not propose to accept the amendments and I ask for consideration to be given to their withdrawal.

Does Senator Higgins have anything further to outline on the amendments?

I refer to amendment No. 11.

The Senator is entitled to contribute once more.

I realise we have much to get through so I will not speak at length. Given that the Social Welfare Consolidation Act 2005 is referred to in this Bill, it is opened up to this suggested interpretation. Amendment No. 11 is compatible with that Bill. The Social Welfare Consolidation Act 2005 provides that there may be a requirement for the Minister to be satisfied. Amendment No. 11 complies with this requirement. It simply suggests that there may be other mechanisms by which the Minister may be satisfied.

There is no point in having the social welfare debate here. There are serious concerns around that. We need to be clear, because there is a misapprehension, that contrary to what anybody may have seen on the side of a bus, a significant incidence of identity fraud does not affect public services. There are instances of it. There have been one or two high-profile cases, which have been covered extensively. Error within the Department of Employment Affairs and Social Protection constituted a large and probably larger proportion of the concerns expressed in the reports. There are also more instances of data breaches. There are some instances, and I can see the Minister of State's officials passing him notes on some. However, the savings on identity fraud come nowhere near recouping the significant cost of the public services card, which I acknowledge is being investigated by other committees in this House.

I will press amendment No. 11 while recognising that amendments Nos. 40 and 41 fall.

We have noticed that there are several additional buses on the road in the past week, with a lot of data on their sides. I wonder if that is covered in this legislation. Is amendment No. 11 being pressed?

Amendment put and declared lost.

As amendments Nos. 12, 27 and 28 are related, they may be discussed together.

I move amendment No. 12:

In page 10, to delete lines 24 to 32 and substitute the following:

"Data-sharing: meaning

8. (1) In this Act, "data-sharing" means the execution and operation of defined processes for the exchange of information between one or more entities for the purpose of supporting the delivery of statutory public sector services, or the execution of obligations under EU law.

(2) The basis on which data sharing processes may operate include—

(a) a case by case basis for the validation and verification of data,

(b) on a defined batch processing basis for the validation, verification, and updating of specific populations of data, or

(c) as once-off consolidation and integration of disparate data sets to form a new, shared, master data repository.".

I second the amendment.

I could debate at length the differences between what I am proposing in amendments Nos. 12 and 28 and the Government's exact proposal in amendment No. 27. It is important to acknowledge that the Government has gone a considerable way towards clarifying the basis on which data is being shared, the impetus for data-sharing and the kinds of ways in which data is shared. For example, clarification has been provided regarding whether the information relates to individuals or to classes of data subject, and regarding whether it is being collected on a once-off or ongoing basis. I have sought to spell out a number of these issues in amendments Nos. 12 and 28. In light of the movement from the Government in this regard, I think I will withdraw amendment No. 28. Amendment No. 12 might involve duplication. I would like the definition of "data-sharing" that is set out in amendment No. 12 to be included in the Bill. I recognise that it is not in it at present. Maybe it can be considered. Amendment No. 12 proposes that "In this Act, "data-sharing" means the execution and operation of defined processes for the exchange of information". I would like if that part of the amendment could be included in the Bill. I recognise that the rest of the amendment might not fit. For that reason, I am not going to press my amendments. I suggest that my colleagues in Sinn Féin and Fianna Fáil might take up the definition issue. I acknowledge the Government's amendment and, on that basis, I will not pursue my amendment.

Government amendment No. 27 reflects the discussion we had in this House on Committee Stage. As I do not accept the proposal in amendment No. 12 to alter the definition of "data-sharing", I do not propose to accept the amendment. A simple definition of "data-sharing" is required here and that is what we have provided for in the text of the Bill. Section 12 sets out the purposes for which data sharing may be carried out. The wording proposed by Senator Higgins directly conflicts with that. I imagine that this is not what she intends. Amendments Nos. 12 and 28 are very similar. Amendment No. 27 certainly covers the intention of what was identified on Committee Stage. I suggest that it covers what is intended in amendments Nos. 12 and 28 without the unintended consequences of those amendments.

Senator Higgins has indicated that she does not wish to press amendment No. 12.

Amendment, by leave, withdrawn.

As amendments Nos. 13 to 15, inclusive, and amendment No. 79 are related, they may be discussed together.

I move amendment No. 13:

In page 10, to delete lines 34 to 38, and in page 11, to delete lines 1 to 30 and substitute the following:

"9. (1) In this Act, "public body" is given the same meaning as a public body and a public authority as set out in section 2 of the Data Protection Act.".

I second the amendment.

This is a somewhat technical issue. I do not think there is a point in belabouring it. I know the Minister of State and his officials are very aware of the difficulties being caused by the inconsistency between the definition of "public body" in this Bill and the definition set out in the Data Protection Acts. There are public authorities and public bodies under the Data Protection Acts and there will be another definition under this data-sharing legislation. The effect of this will be that certain bodies which are authorities for the purposes of the Data Protection Acts will be public bodies for the purposes of this legislation. I feel that the potential for confusion exists. I appreciate that it might be difficult to unravel this one. This amendment is noting that and putting a marker down.

Amendment Nos. 14 and 15 are included in this grouping. There is concern about the fact that the definition of "public body" in this Bill includes commercial or private companies that may be contracted to deliver public services or functions. Amendment No. 14 attempts to ensure "the Minister will make and publish regulations on suitable and specific" measures to make sure it is not the case that commercial activities taking place within companies that have contracts for the delivery of public services, which will be considered to be public bodies under this Bill, are not suitably corrected. Amendment No. 15 seeks to address situations in which bodies that are considered to be public bodies under this legislation may also have commercial interests. It is the same concern.

I will let the Minister of State speak on amendment No. 79 because it is a Government amendment. I know he has looked at this key issue. I appreciate that it is difficult to reconcile the Data Protection Acts and the Bill before the House. I am very concerned about the commercial companies. This matter will arise at a later stage of this debate when we talk about the data governance board. I note that this Bill proposes to give the Minister the power to hire consultants, for example, in respect of the data governance board. We need to be very careful when commercial actors are operating in a public service delivery and public regulatory space.

I will respond in simple language to what the Senator said in proposing amendment No. 13 about the difference between how public bodies are defined in existing legislation and in this proposed legislation. To put it simply, there must be a definition in this Bill to facilitate the sharing of information between body A and body B. That is why we have taken the approach we have taken. Otherwise, we could get into an even more difficult situation. If we were to provide for a loose definition of the bodies that are sharing information, organisations and public bodies that need to have data-sharing agreements might unintentionally fall outside the scope of it as an unintended consequence. I do not think that is something anyone would want.

The Senator is seeking to align the definition of a "public body" in this Bill with the definition that is already set out in the Data Protection Acts. I understand the logic of the Senator's proposal and I do not disagree with it. However, I cannot accept it because of the language that is used in her amendments and the way in which they are constructed. The primary reason for the difference between the definition of "public body" in this Bill and the definition in the Data Protection Acts is the need for this Bill to specify a legal person or entity that can sign the data-sharing agreements. No similar requirement applies in the case of the Data Protection Acts, which means that a different approach to the definition can be used. The two definitions do not have to be identical. The differences between them reflect the different requirements of both pieces of legislation. The important point here is that we are talking about sharing between body A and body B. In any event, the Data Protection Acts and the GDPR will continue to apply to all public bodies that come within the scope of this legislation and, therefore, will capture the issues to which Senator Higgins has referred.

In addressing amendment No. 14, I should point out that amendment No. 79 came out of the discussions we had on Committee Stage. I intimated at the time that I was prepared to come back and do something. In that context, amendment No. 79 proposes to amend section 64 of the Bill to allow the Minister to issue rules, standards and procedures in respect of "the processing of personal data by a public body designated in an order made under section 9(4)". I believe this will have the effect the Senator is seeking here. I ask her to consider withdrawing her amendments on the basis of the context in which we had our previous discussions. Amendment No. 15 would have the perhaps unintended effect of excluding public bodies from data sharing in the furtherance of any commercial activities in which they may be involved. While I can see where the Senator is coming from with these amendments and I support the principle of what she is trying to achieve, there are a number of technical difficulties with the wording.

For instance, commercial interests are not defined. I ask the Senator to withdraw the amendment, and I will propose an amendment with the same effect on Committee Stage in the Dáil. My amendment proposes an change to section 64. It adds a requirement that a Minister can issue rules, standards and procedures in respect of the processing of personal data by a public body designated in an order made under section 9(4). This will have the effect that the Senator is trying to achieve, and I ask her to consider withdrawing her amendment and supporting mine instead.

I will support the Minister of State's amendment and I recognise it as progress. My only concern is that it states the Minister may introduce regulation in this area but it does not require that regulations would be put in place, as my amendment would have done. That is still a concern and I imagine it might be taken up by others. Senator Devine will know that the difference between "may" and "shall" is important in many cases. I recognise, however, that this is significant progress and there will be capacity for regulatory measures to be put in place in this regard. I accept the Minister of State's amendment and withdraw mine. I would also like to thank the Minister of State for indicating that he will look to reframe my other amendment on Committee Stage. On that basis, I will not press that either.

Amendment, by leave, withdrawn.
Amendments Nos. 14 and 15 not moved.
Government amendment No. 16:
In page 13, lines 31 and 32, to delete “(other than special categories of personal data)”.
Amendment agreed to.

Amendment No. 17, in the names of Senators Higgins and Ruane, arises out of committee proceedings. It has been discussed with amendment No. 11. Is it being pressed?

I move amendment No. 17:

In page 14, to delete lines 5 and 6 and substitute the following:

“(I) as one non-mandatory means to verify the identity of a person, where the first or second mentioned public body is providing or proposes to provide a service to that person, without prejudice to a person’s right to seek to verify their identity by other means;”.

I second the amendment.

Amendment put and declared lost.
Government amendment No. 18:
In page 14, to delete lines 9 to 12 and substitute the following:
“(III) to avoid the financial or administrative burden that would otherwise be imposed on a person to whom a service is being or is to be delivered by the first or second mentioned public body were the second mentioned public body to collect the personal data directly from that person;”.
Amendment agreed to.
Amendments Nos. 19 and 20 not moved.

Amendment No. 21, in the names of Senators Higgins and Ruane, arises out of committee proceedings. Amendments Nos. 21 and 30 are related and will be discussed together.

I move amendment No. 21:

In page 15, line 4, to delete “body.” and substitute the following:

“body, and

(f) the sharing of personal data is necessary and proportionate.”.

I second the amendment.

Amendments Nos. 21 and 30 relate to the issue of necessity and proportionality. One of the core requirements of the GDPR is that sharing be done in a way that is both necessary and proportionate in order that it does not exceed what is required. We debated these two points at such length on the previous Stage that we do not need to go over them again. The Minister of State has indicated progress on the inclusion of the concern of "necessary and proportionate" in the Bill. On that basis, I would like to hear from him before proceeding with these amendments.

The Senator will be glad to know her efforts last night were not in vain. While she had reason to suspect I was trying to be obstreperous or difficult, I have taken on board what she advocated. Considering it is in line with other European legislation, I propose to accept amendments Nos. 21 and 30.

Amendment agreed to.

Amendment No. 22, in the names of Senators Higgins and Ruane, arises out of committee proceedings. It has been discussed with amendment No. 2. Is Senator Higgins pressing the amendment?

I move amendment No. 22:

In page 15, between lines 5 and 6, to insert the following:

"(4) Where special categories of personal data are disclosed by one public body to another public body for reasons of public interest, regulations shall be made—

(a) by the Minister following consultation with such other Minister of the Government as he or she considers appropriate, or

(b) by any other Minister of the Government following consultation with the Minister and such other Minister of the Government as he or she considers appropriate.

(5) The Minister or any other Minister of the Government shall consult with the Commission before making regulations under subsection (4).

(6) The Commission may, on being consulted under subsection (5), make observations in writing on any matter which is of significant concern to it in relation to the proposed regulations and, if the Minister or any other Minister of the Government proposes to proceed to make the regulations notwithstanding that concern, that Minister shall, before making the regulations, give a written explanation as to why he or she is so proceeding to—

(a) the Committee established jointly by Dáil Éireann and Seanad Éireann known as the Committee on Justice and Equality or any Committee established to replace that Committee, and

(b) any other Committee which that Minister considers appropriate having regard to the subject matter of the regulations.

(7) Regulations made under subsection (4) shall specify—

(a) the personal data that may be processed,

(b) the circumstances in which the personal data may be processed, including specifying the persons to whom the data may be disclosed, and

(c) such other conditions (if any) as the Minister or any other Minister of the Government, as the case may be, considers appropriate to impose on such processing.".

I recognise that if I moved this it would be in conflict with an amendment that has been accepted in respect of the sections to which special categories of information apply. While I strongly believe in the spirit of this amendment, I will not press it at this time. It was originally a Sinn Féin amendment, supported by Fianna Fáil, and I hope it can be relocated constructively.

Amendment, by leave, withdrawn.
Government amendment No. 23:
In page 15, line 7, to delete "(1) This section applies to personal data, other than special categories of personal data.".
Amendment agreed to.
Government amendment No. 24:
In page 16, lines 31 and 32, to delete "(other than special categories of personal data)".
Amendment agreed to.

Amendments Nos. 25 and 26, in the names of Senators Higgins and Ruane, arise out of committee proceedings. The amendments are related. Amendment No. 26 is a physical alternative to amendment No. 25. They will be discussed together.

I move amendment No. 25:

In page 17, to delete line 6 and substitute the following:

"16. (1) A data-sharing agreement shall be published and made available to any Oireachtas committee on request.

(2) An opinion of the data sharing-agreement by the Data Protection Commission must be published before the date of commencement of the agreement and made available to any Oireachtas committee on request.".

I second the amendment.

This relates to an issue of transparency. My concern is that currently line 6 states that the formal requirement in a data-sharing agreement is simply that it must be in writing. It certainly cannot exist in thought alone and, therefore, the requirement that it be in writing is good and clear but we need more than that. I am sure it is probably the intention, but the data-sharing agreement should not only be written but also published. The question then arises as to where it should be published, accessed and shareable. The proposals I make in these amendments are that it could be published and made available to any Oireachtas committee on request. For example, if a committee is dealing with local government and sport, a data-sharing agreement might be implied and the relevant committee should be able to access it. If there was a data-sharing agreement between an educational body and another body, the relevant committee would be able to access it and it would be made available.

I recognise that this will be pushed back. My original proposal had been that an opinion on each data-sharing agreement should be sought from the DPC and published before the date of commencement of the agreement, and made available to Oireachtas committee on request. I can anticipate the concerns there might be about that as I know the Government wishes to ensure the independence of the commissioner's role. I am happy to review this but my intention is not that the commissioner would be consulted in advance of the data-sharing agreement, rather, that following the agreement between the public bodies, there should be an advance opportunity to give an opinion on it prior to its commencement. It will make the life of the DPC's office easier if it does not have to respond following commencement, and mistakes could be avoided. The commission will not be involved in the preparation of the data-sharing agreement but, following the conclusion of the agreement, it should be given the opportunity to express an opinion prior to commencement. If issues arise, we would anticipate the problem rather than retrospectively seeking to address it. My preferred version, therefore, is No. 25.

Amendment No. 26 has the same intent. It is a simple amendment relating to the publication of data-sharing agreements, but I am also happy if the Minister of State has another way to address that issue.

During the early stages of the drafting of the Bill, officials in my Department had extensive engagement with the Data Protection Commission. My office took the view that it would not be appropriate for it to have a role in scrutinising at that point. I have no difficulty accepting amendment No. 26. I draw attention to section 60(2), which states that the Minister shall cause copies of the documents received by him or under subsection (1) to be laid before each House of the Oireachtas and to be sent to the board. It is already catered for, but I do not see a difficulty in accepting the amendment as it is proposed.

Amendment, by leave, withdrawn.

I move amendment No. 26:

In page 17, to delete line 6 and substitute the following:

“16. A data-sharing agreement shall be published and made available to any Oireachtas committee on request.”.

I second the amendment.

Amendment agreed to.
Government amendment No. 27:
In page 17, between lines 26 and 27, to insert the following:
“(f) specify whether the impetus for the disclosure of information under the agreement will come from a data subject or a public body,
(g) specify whether, where information is disclosed under the agreement, the disclosure will be of information in relation to individual data subjects or classes of data subjects,
(h) specify whether the disclosure of information under the agreement will be on a once-off or ongoing basis,”.
Amendment agreed to.
Amendment No. 28 not moved.

Amendments Nos. 29 and 31 to 33, inclusive, are related and may be discussed together by agreement. Is that agreed? Agreed.

Government amendment No. 29:
In page 17, between lines 30 and 31, to insert the following:
“(h) include an undertaking by the parties to the agreement to comply with Article 5 of the General Data Protection Regulation in disclosing information under the agreement,”.

Amendment No. 32 in the name of Senator Higgins is very similar to amendment No. 29, which arises out of Committee Stage proceedings. Amendment No. 29 provides that, as part of the data-sharing agreement, public bodies will formally undertake to share data in accordance with the principles of data protection in the GDPR. This was agreed on Committee Stage and I indicated that I would revisit the matter. I ask the Senator to reflect on the matter and withdraw her amendment.

The subject matter of amendment No. 31 is already provided for in section 18(1)(i), which requires a data-sharing agreement to “specify the security measures to apply to the transmission, storage and accessing of personal data in a manner that does not compromise those security measures”. Accordingly, the amendment is unnecessary and I ask the Senator to withdraw it.

I do not have a difficulty with amendment No. 33 because it is proposed in the context of GDPR. We discussed the matter to which it relates at length on Committee Stage. Without prejudice, it does not limit the right of a person or data subject in respect of any data controllers in the data-sharing agreement. I do not have a difficulty with that and I propose to accept the amendment.

Amendment agreed to.

I move amendment No. 30:

In page 18, between lines 11 and 12, to insert the following

“(n) demonstrate necessity and proportionality of sharing.”.

I second the amendment.

Amendment agreed to.
Amendments Nos. 31 and 32 not moved.

I move amendment No. 33:

In page 19, between lines 38 and 39, to insert the following:

“(6) This section is without prejudice to and does not limit the rights of a person as a data subject in respect of any or all data controllers in a data sharing agreement.”.

I second the amendment.

Amendment agreed to.
Government amendment No. 34:
In page 31, to delete lines 14 to 17.
Amendment agreed to.
Government amendment No. 35:
In page 31, to delete line 34, and in page 32, to delete line 1 and substitute the following:
“(b) avoiding the burden that would otherwise be imposed on a person to whom a service is being or is to be delivered by a public body if the information concerned was collected directly from that person, and”.
Amendment agreed to.
Amendments Nos. 36 and 37 not moved.

I move amendment No. 38:

In page 32, between lines 26 and 27, to insert the following:

“(5) The Minister shall, when making an order under subsection (1), have regard to whether provision is made for a person’s right to verify their identify using an alternative process.”.

I second the amendment.

Amendment put and declared lost.
Government amendment No. 39:
In page 33, to delete lines 32 to 35, and substitute the following:
“(1) Subject to subsection (3), where the information contained in a base registry meets the qualitative requirements of a public body in respect of the purpose for which it intends to use that information, the public body shall not collect such information for that purpose from a source other than the base registry, save where the information so collected is collected for the purposes of enabling that public body to access information on the base registry relating to the information so collected.”.
Amendment agreed to.
Amendments Nos. 40 and 41 not moved.

Amendments Nos. 42 to 56, inclusive, are related and may be discussed together by agreement. Is that agreed? Agreed.

Government amendment No. 42:
In page 34, line 15, to delete “system,” and substitute “system”.

These amendments, some of which are technical in nature, provide for an extension of the scope of the personal data portal so that it can be used as one means by which public bodies may communicate data breaches to data subjects in accordance with what is provided for under Article 34 of the GDPR. This is on foot of amendments proposed and agreed in principle at Committee Stage with a number of Members, including Senators Higgins and Ruane. I note that Senator Higgins has proposed similar amendments and I ask that she might consider withdrawing her amendments and accept those I am proposing.

I thank the Minister for the amendments he has put forward. They address the concern we had, including that the data portal would be a space where people could fully access their information as it related to data breaches. In light of amendments Nos. 42 to 45, inclusive, put forward by the Government and relating to the same issue, I am happy to withdraw my amendments. One of the most fundamental issues for any person is that he or she is made aware of the position when his or her personal data has been breached, and that he or she has a mechanism to access it. What is proposed strengthens the data portal. I acknowledge the work of the Minister of State and his engagement on that issue.

I welcome Deputy Jackie Cahill and his guest to the Public Gallery.

The issues that are not, perhaps, as comprehensively addressed in the Bill are those relating to the content of data-sharing agreements where data is shared with public bodies. In that context, I have tabled amendment No. 50. While data-sharing agreements can be accessed, it is sometimes difficult for people to know where to look or which agreement is relevant. There is transparency in the context of data-sharing agreements as such, but the provision could still be strengthened for the individual seeking to access information about the agreements which impact upon him or her. Given the very good spirit with which the Minister of State has addressed the majority of concerns in this area, I am not going to press my amendments.

I thank Senator Higgins for that. Earlier, I neglected to say that I propose to accept amendment No. 50, which relates to section 44.

Is amendment No. 46 a Government amendment or is it in the names of Senators Higgins and Ruane? It is a bit confusing. Is there a typo?

It is in the names of the Government and Senators Higgins and Ruane.

Amendment agreed to.
Government amendment No. 43:
In page 34, lines 15 and 16, to delete all words from "to" in line 15 down to and including line 16 and substitute the following:
"to—
(a) exercise his or her rights under the General Data Protection Regulation, and".
Amendment agreed to.
Government amendment No. 44:
In page 34, between lines 16 and 17, to insert the following:
"(b) view information in relation to the personal data breaches, if any—
(i) which affect his or her personal data, and
(ii) in respect of which a notification has been made for the purposes of Article 34(1) of the General Data Protection Regulation.".
Amendment agreed to.
Government amendment No. 45:
In page 34, line 22, to delete "and" and substitute the following:
"(b) view information in relation to the personal data breaches, if any—
(i) which affect his or her personal data, and
(ii) in respect of which a notification has been made for the purposes of Article 34(1) of the General Data Protection Regulation,
and".
Amendment agreed to.
Government amendment No. 46:
In page 34, line 24, after "18," to insert "19,".
Amendment agreed to.
Amendments Nos. 47 to 49, inclusive, not moved.

I move amendment No. 50:

In page 34, between lines 25 and 26, to insert the following:

(c) view the contents of the data-sharing agreements under which his or her data has been shared between public bodies.".

I second the amendment.

Amendment agreed to.
Government amendment No. 51:
In page 34, line 30, after "(2)(a)" to insert "and (b)".
Amendment agreed to.
Government amendment No. 52:
In page 34, line 34, to delete "subsection 2(b)" and substitute "subsection 2(c)".
Amendment agreed to.
Government amendment No. 53:
In page 34, lines 37 and 38 and page 35, line 1, to delete all words from and including "of" in line 37 down to and including page 35, line 1 and substitute the following:
"of—
(a) providing the information referred to in subsection (2)(a) or (b), or
(b) facilitating or responding to a request referred to in subsection (2)(c).".
Amendment agreed to.
Government amendment No. 54:
In page 35, line 4, after "(2)(a)" to insert "or (b)".
Amendment agreed to.
Government amendment No. 55:
In page 35, line 5, to delete "subsection 2(b)" and substitute "subsection 2(c)".
Amendment agreed to.
Government amendment No. 56:
In page 35, between lines 18 and 19, to insert the following:
"(9) In this section "personal data breach" has the same meaning as it has in the General Data Protection Regulation.".
Amendment agreed to.

Amendments Nos. 57 to 59, inclusive, are related and will be discussed together.

Government amendment No. 57:
In page 36, between lines 11 and 12, to insert the following:
"(5) The Minister may enter into an arrangement for the provision of consultancy, advice or other services to the Board.".

Amendment No. 57 is an amendment to section 46 in respect of the functions of the data governance board to provide that the Minister may enter into an arrangement for the provision of consultancy, advice or other services to the board. This is a standard provision given to most boards. I would expect that the skill sets each member will bring to the board will be sufficient for it to carry out its functions internally most of the time. However, I foresee circumstances where it would be appropriate for the board to seek external advice and assistance on specific matters. We discussed this during a previous debate on the Bill. This particularly arises where the board is developing data management rules, procedures and standards and may need to draw on specialised technical advice on certain matters. Nobody would want a situation where we tie the hands of the board so it could not get external advice.

I propose to accept amendment No. 58.

With regard to amendment No. 59, I understand where the Senators are coming from but the phrase "annual review and expiry" would mean we could have a situation where consultancy advice required for more than one calendar year would have to be procured every year. That is not intended. As the Minister of State with responsibility for public procurement, I am aware of the level of administration that has to be dealt with by public bodies and by those tendering who hope and aspire to secure public contracts. Given that amendments Nos. 57 and 58 are accepted, the Senators might consider withdrawing amendment No. 59.

Amendment No. 59 is a response to the question of private companies that may be contracted. It is a transparency mechanism. We do not want a consultant to become a de facto member, which we know sometimes happens. An adviser or consultant can be there for ten or 15 years, effectively managing a board while members come and go. I know this is not the intent of the Minister of State. Given his generosity in accepting amendment No. 58, I will not press amendment No. 59. Amendment No 58 will, in itself, require clear parameters of service and will address the concerns I was dealing with in amendment No. 59.

Amendment agreed to.

I move amendment No. 58:

In page 36, between lines 11 and 12, to insert the following:

"(5) Any contracts in respect of consultancy, advice or other services to the board shall be subject to public competition.".

I second the amendment.

Amendment agreed to.
Amendment No. 59 not moved.

Amendments Nos. 60 to 68, inclusive, are related. Amendment No. 64 is a physical and logical alternative to amendment No. 63. Amendment No. 66 is a physical alternative to amendment No. 65. Amendments Nos. 60 to 68, inclusive, will be discussed together.

I move amendment No. 60:

In page 36, between lines 13 and 14, to insert the following:

"(2) Of the members of the Board, an equal number shall be male and female.".

I second the amendment.

These amendments relate to the composition of the data governance board, which plays a key role in the data-sharing Bill and the proposed new system of data governance. I acknowledge the Minister of State has addressed the majority of the concerns I have regarding gender balance, composition and ensuring clarity on the time people might sit on the board. In this regard, I will not press the majority of my amendments. There is only one area in which we will come to a slight conflict, which is with regard to amendments Nos. 63 and 64. My concern is that the overall positive amendment No. 63 allows the Minister to appoint no fewer than two and no more than four people who are not employees or holders of an office or other position in a public body. If the number of members of the board is increased in the future, the cap of no more than four people who are not employed by a public body could be an issue. I agree with every other word of the amendment. Amendment No. 64 also proposes no fewer than two members who are not employees of a public body but removes the cap of having four such people. This is the only difference, otherwise the wording is identical. I acknowledge the thought that has gone into these amendments on the part of the Minister of State. Amendment No. 64 is slightly better worded and could address a concern that might arise.

I do not disagree with the Senator. With the consent of the House, I will withdraw amendment No. 63 and accept amendment No. 64. I ask that the remainder of the amendments in the Senators' names be withdrawn.

Amendment, by leave, withdrawn.
Amendment No. 61 not moved.
Government amendment No. 62:
In page 36, line 17, after "Board" to insert ", including in relation to the protection of personal data".
Amendment agreed to.

I move amendment No. 63:

In page 36, between lines 17 and 18, to insert the following:

“(4) When appointing members of the Board, the Minister shall have regard to—

(a) the objective that at least 40 per cent of members of the Board shall be women and at least 40 per cent shall be men, and

(b) the guidelines, if any, prepared by the Minister in relation to appointments to boards of State bodies.

(5) The Minister may, following consultation with the Minister, if any, in whom functions in relation to the public body are vested, appoint a person who is an employee of, or holds an office or other position in, a public body to be a member of the Board.

(6) The Minister may appoint not less than 2 and not more than 4 persons who are not employees of, or the holders of an office or other position in, a public body to be a member of the Board.

(7) The Minister shall ensure, where practicable, that not less than one third of the members of the Board are appointed pursuant to subsection (6).”.

Amendment, by leave, withdrawn.

I move amendment No. 64:

In page 36, between lines 17 and 18, to insert the following:

"(4) When appointing members of the Board, the Minister shall have regard to—

(a) the objective that at least 40 per cent of members of the Board shall be women and at least 40 per cent shall be men, and

(b) the guidelines, if any, prepared by the Minister in relation to appointments to boards of State bodies.

(5) The Minister may, following consultation with the Minister, if any, in whom functions in relation to the public body are vested, appoint a person who is an employee of, or holds an office or other position in, a public body to be a member of the Board.

(6) The Minister may appoint not less than 2 who are not employees of, or the holders of an office or other position in, a public body to be a member of the Board.

(7) The Minister shall ensure, where practicable, that not less than one third of the members of the Board are appointed pursuant to subsection (6).".

I second the amendment.

Amendment agreed to.
Amendment No. 65 not moved.
Government amendment No. 66:
In page 36, lines 20 and 21, to delete ", including the term of office,".
Amendment agreed to.
Government amendment No. 67:
In page 36, between lines 21 and 22, to insert the following:
"(6) Subject to subsection (7), each member of the Board shall hold office for 3 years from the date of his or her appointment.
(7) A person's appointment under subsection (5) shall be terminated with effect from the earlier of—
(a) the date on which the person ceases to be employed by, or to hold an office or other position in, the public body concerned, and
(b) the date that is 3 years from the date of their appointment.
(8) A member of the Board whose term of office expires by the effluxion of time or whose appointment is terminated in accordance with subsection (7) shall be eligible for reappointment to the Board, but the total period of membership of the Board of a person shall not exceed 9 years.".
Amendment agreed to.
Government amendment No. 68:
In page 36, lines 22 and 23, to delete all words from "by" on line 22 down to and including "in" on line 23 and substitute "by, or does not hold an office or position in,".
Amendment agreed to.

Amendments Nos. 69 to 72, inclusive, are related and will be discussed together.

Government amendment No. 69:
In page 36, after line 37, to insert the following:
"(5) A committee established under subsection (1) shall prepare and submit a report on its activities to the Board on a regular basis.
(6) A report prepared and submitted by the Board under section 52 shall include a summary of the activities of the committees, if any—
(a) established under subsection (1), and
(b) in existence in the period to which the report relates.
(7) A committee established under subsection (1) may be dissolved by a resolution of the Board at any time and shall stand dissolved on the date that is 2 years from the date of its establishment, unless the Board resolves that the committee is to continue in existence.".

Amendment No. 69 was requested by Senator Higgins on Committee Stage. The amendment imposes a requirement on committees established by the board to make regular reports on their activities and for the board to report on the activities of its committees in its annual report to the Minister. It is straightforward. The amendment also sets a time limit for the time a committee may remain in existence unless this time is extended by way of a resolution of the board.

Senators Higgins and Ruane make a similar proposal in amendments Nos. 70 and 71. I ask that they consider withdrawing them.

Amendment No. 72 is a technical amendment to insert the words "its committees". I propose to accept that.

Some of my amendments were tabled prior to seeing the Government's amendments. I am happy to withdraw amendments Nos. 70 and 71 and support the Minister of State's amendment. Amendment No. 72, as he said, is technical.

Amendment agreed to.
Amendments Nos. 70 and 71 not moved.

I move amendment No. 72:

In page 38, line 16, after "it" to insert ", and its committees,".

I second the amendment.

Amendment agreed to.

Amendments Nos. 73 to 75, inclusive, are related and will be discussed together.

Government amendment No. 73:
In page 39, between lines 13 and 14, to insert the following:
"(c) where no data protection impact assessment has been carried out in relation to the processing proposed to be undertaken under the proposed agreement, a summary of the reasons why no data protection impact assessment has been carried out,".

The amendment arises out of earlier discussions. Amendment No. 73 has the same effect as amendment No. 74, and is probably even stronger.

Amendment No. 73 provides that public bodies, where they have not carried out a data protection impact assessment, shall set out the reasons in the public consultation documents they are required to publish under section 55, which was a moot point here on the previous occasion but which I accepted and said that I would revert on. It, basically, requires them to state why they would not do it. I note that Senator Higgins has proposed a similar amendment, and I ask that she, together with Senator Ruane, might consider withdrawing it in favour of my proposal.

I propose to accept amendment No. 75. Given that we are providing for the signatories to the data-sharing agreement to comply with Article 5 of the GDPR, to which amendment No. 29 refers, I accept the amendment.

I will support amendment No. 73 and withdraw amendment No. 74. I thank the Minister of State for accepting amendment No. 75.

Amendment agreed to.
Amendment No. 74 not moved.

I move amendment No. 75:

In page 39, between lines 19 and 20, to insert the following:

"(iii) is satisfied that the agreement adheres to the principles of data protection as specified in Article 5 of the General Data Protection Regulation and is necessary and proportionate,".

I second the amendment.

Amendment agreed to.

Amendments Nos. 76 to 78, inclusive, are related. Amendment No. 78 is a physical and logical alternative to amendment No. 77. Amendments Nos. 76 to 78, inclusive, will be discussed together.

I move amendment No. 76:

In page 42, to delete line 23 and substitute the following:

"(a) the time periods referred to in:

(i) section 55(1)(d)(iii) setting a minimum of two weeks;

(ii) section 56,

and".

The amendment intends to ensure there will be a time period. I acknowledge that the Minister of State has in amendment No. 77 met that. Of course, I pushed the boat out with a further ambition that there would not simply be a 14-day, but a 30-day, concession or time period. However, given that he has moved towards me on the 14 days, I will not press the 30 days. I hope that colleagues may take that up to further increase our ambition in terms of consultation.

I acknowledge amendment No. 77 and I will withdraw amendment No. 76 in that context. I will not press amendment No. 78.

I second the amendment.

Senator Higgins was pushing her luck. We agreed two weeks and that was explicitly stated on the previous occasion. I ask that she might consider withdrawing amendments Nos. 76 and 78.

Amendment, by leave, withdrawn.
Government amendment No. 77:
In page 42, between lines 24 and 25, to insert the following:
"(2) The time period specified by the Board for the purposes of section 55(1)(d)(iii) shall not be less than 14 days.".
Amendment agreed to.
Amendment No. 78 not moved.
Government amendment No. 79:
In page 43, between lines 7 and 8, to insert the following:
"(e) the processing of personal data by a public body designated in an order made under section 9(4),".
Amendment agreed to.

Amendments Nos. 80 to 81 are related. Amendment No. 81 is a physical alternative to amendment No. 80. Amendments Nos. 80 to 81 will be discussed together.

I move amendment No. 80:

In page 43, to delete lines 13 to 16.

I second the amendment.

This is the most fundamental amendment. There was confusion in the Bills Office that three amendments due to be made in this section, the third of which would also include lines 13 and 14.

These are the grounds. This is probably the final substantive concern that we have. It relates to the fact that the purposes under which the Minister may prescribe rules and promises, procedures and standards relating to base registries, for example, and how information is recorded in public databases, include "to promote increased sharing of information between public bodies in accordance with this Act". We could end up with a tautology whereby one could share data to share data so that there is a kind of self-fulfilling loop. It could undermine much of the positive work that has been done on the rest of the Bill if we had a situation whereby promoting "increased sharing" became a value that we were pressing rather than the sharing of information being something that was necessary and proportionate given all the other excellent concerns that have been addressed in the Bill, which have made it more robust. It may be an oversight in that section.

I am conscious also that Chapter 3 of Part 9 reflects special categories of personal information. As the Minister of State pointed out earlier, what is set out in that section on governance under Chapter 3 extends much wider than this Bill. Effectively, it relates to much of what the Minister of the day might do in many areas. In that regard, lines 13 and 14 are a serious concern.

There are also concerns in respect of lines 15 and 16. The language is broad in terms of ensuring "a consistent approach to the management of information by public bodies so as to facilitate the exchange of information between them". Given that we have a number of other areas where performance of the functions, modernisation and appropriate management are addressed, I do not know what is added by that caveat. There is a danger that we fall into that same trap of administrative concerns being the driver in this regard.

I will probably press is the amendment providing for the removal of lines 13 to 16, inclusive, but my primary concern relates to lines 13 and 14.

It would be very positive if the Minister of State could indicate that he will move on these issues. If not, I will press the amendment proposing the removal of lines 13 to 16. The section has a very wide impact and it does not just relate to personal information but to special categories of personal information.

The proposed amendment seeks to remove a number of the purposes under which rules, procedures and standards may be prescribed by the Minister regarding data management. I will address each of the purposes in turn. First, the Senator proposes to remove the following purpose, "to promote increased sharing of information between public bodies in accordance with this Act and any other enactment providing for such sharing of information". It is not the intent of this Bill to promote the sharing of information as an end in itself. It is merely the means to achieving a modern and safe infrastructure for the delivery of public services. As such, I accept this part of the amendment.

The Senator also proposes to remove the following purpose, "(c) to ensure a consistent approach to the management of information by public bodies so as to facilitate the exchange of information between them". With the sharing of data between public bodies for the delivery of public services, it is essential that such sharing is performed in a consistent and secure manner. This provision allows the Minister to ensure that public bodies follow best practice when undertaking such sharing. The removal of this purpose would unintentionally limit the ability of the Minister to ensure that sharing is performed in a safe and reliable manner and, as such, I cannot accept this part of the amendment.

Lastly, the Senator proposed to remove the following purpose:

(d) to increase the usefulness of information held by public bodies for the purposes of—

(i) performing their functions,

(ii) modernising and developing public services,

(iii) evaluating the effectiveness of services provided by public bodies, and

(iv) evaluating the effectiveness of expenditure by public bodies;

This purpose is limited by a set of sub-purposes where it is clear there is a benefit to citizens and businesses. It behoves the Government to increase the usefulness of data to continue to improve and modernise our public services. As such I cannot accept this part of the amendment.

As I have said, I would be willing to remove section 64(2)(b) but unfortunately, for the reasons I have given, I cannot accept the amendments that propose removing other parts of section 64(2). If the Senator will withdraw the amendment, I will propose an amendment on Committee Stage in the Dáil to remove section 64(2)(b), ensuring the most contentious word, that is, "promote", is removed from the Bill.

That is the substantive concern and it is not the intention of the Bill. In light of that, and in faith that the Minister of State will remove the two lines, I will not press the amendments.

Amendment, by leave, withdrawn.
Amendments Nos. 81 and 82 not moved.
Government amendment No. 83:
In page 48, after line 2, to insert the following:
“Amendment of Social Welfare Consolidation Act 2005
73. Schedule 5 to the Act of 2005 is amended by the insertion, in paragraph 1(4), of “the National Shared Services Office,” after “the National Council for Special Education”.”.
Amendment agreed to.
Bill, as amended, received for final consideration.
Question proposed: "That the Bill do now pass."

I thank the Minister of State for bringing the Bill through the House. It will prove to be a very important piece of legislation. I also thank him for the co-operation he has shown to Members of the House and for accepting amendments. He has accepted many amendments to the Bill which will enhance it. I am delighted the Bill has been passed by this House and I look forward to it being enacted in due course.

I thank the Minister of State and his officials for their engagement with me between the Stages of the Bill. We made significant progress together and the Bill is strengthened by that. I look forward to watching the further debates from a distance. I am sure that it will move very quickly when it comes back with the amendments that have been committed to on Committee Stage in the Dáil.

I am normally my own party's spokesperson on this issue but I cannot say much because I am in the Chair. I thank the Minister of State and his officials and I thank Senator Higgins for her input. She has put a lot of time and effort into it.

It is 45 minutes ahead of time.

That is a lot more than I thought. I thank Senators for their co-operation and my officials from the Department of Public Expenditure and Reform. I thank those Senators who engaged with the Bill, particularly Senator Higgins who has engaged a lot. After Second Stage and Committee Stage, she may have thought I would come back with no amendments on Report Stage and without having listened to anything she suggested. It was a very constructive debate and a lot of what was discussed on Committee Stage worked successfully. I agree with Senator Paddy Burke that further legislation could be initiated in this House. Given some of the showboating one sees in the other House from time to time, it might make for a better quality debate. I look forward to going into the Dáil with the Bill but I look forward to being back in the Seanad with it too, because there are amendments to which I have committed and there may also be Dáil amendments.

This is the Upper House. We are very civilised here.

Question put and agreed to.
Sitting suspended at 2.46 p.m. and resumed at 3.30 p.m.