Data Sharing and Governance Bill 2018: [Seanad Bill amended by the Dáil] Report and Final Stages

This is a Seanad Bill which has been amended by the Dáil. In accordance with Standing Order 148, it is deemed to have passed its First, Second and Third Stages in the Seanad and is placed on the Order Paper for Report Stage. On the question, "That the Bill be received for final consideration", the Minister may explain the purpose of the amendments made by the Dáil. This is looked upon as the report of the Dáil amendments to the Seanad. For Senators' convenience, I have arranged for the printing and circulation of the amendments. The Minister of State will deal separately with the subject matter of each related group of amendments and I have also circulated a proposed grouping in the House. Senators may speak only once on each grouping. The Minister of State has tabled a number of amendments which arise from the changes made to the Bill by the Dáil. In view of the number of amendments and to avoid repetition of debate, I propose that amendments made by the Dáil and related amendments tabled by the Minister of State will be taken together in related groups. Decisions on the amendments tabled by the Minister of State will be taken when discussion on all groups of amendments has concluded. I remind Senators that the only matters that may be discussed are the subject matter of each grouping of amendments made by the Dáil and the amendments tabled which arise out of the amendments made by the Dáil.

Am I right that the four amendments on the supplementary list are to be discussed subsequent to the other groupings?

No, amendment No. 4 will be discussed with group 1 and amendments Nos. 1 to 3, inclusive, will be discussed with group 3.

Question proposed: "That the Bill be received for final consideration."

I ask the Minister of State to speak on subject matter of the amendments in the first group.

I thank the Seanad for the opportunity to return to the House. I am dealing with amendments Nos. 1, 2, 24 and 25. Is that correct?

And Seanad Report Stage amendment No. 4.

As the House knows, the legislation is key to delivering on the public service reform commitments, expanding digital delivery of services and making greater use of data. It also provides for stronger governance and transparency by public service bodies in the way they share and manage data. The Bill was initiated in the Seanad and we had a very useful and constructive debate in the course of its passage through the House, to which I referred in the Dáil. I took a lot of consideration of the debate in the Seanad and I look forward to the continuation of that today.

The first group of amendments is in respect of the Long Title of the Bill, the Taxes Consolidation Act 1997 and the National Shared Services Office Act 2017. Amendments Nos. 1 and 24 relate to the inclusion of a new section, section 74, which has the effect of amending the Taxes Consolidation Act to allow other public bodies to accept the Revenue online service digital signature when providing services to the public. These signatures are used extensively by businesses for the filing and payment of taxes and duties, and these amendments should allow for a greater number of transactions between businesses and public bodies to be carried out online.

Amendments Nos. 2 and 25 provide for a technical amendment to the National Shared Services Office Act 2017 to correct an error in that Act with the Irish translation of the name of the office. Amendment No. 2 also adds a reference to the Ministers and Secretaries (Amendment) Act 2011 to the Long Title of the Bill to reflect that this Act is amended by section 73 of the Bill.

Senator Paddy Burke will be bringing a further amendment to section 74, which I hope the Seanad is in a position to support.

The grouping is predominantly technical and deals with the issue of what may be included, the language and so forth. Some of the concerns in the supplementary amendments will arise on group 3. I had one question on amendment No. 24 in respect of the digital signature but I have had clarification from the Minister of State's officials, which I am sure he will confirm, that this is only a digital signature in respect of the Electronic Commerce Act and does not extend to any other digital signatures that may be used in other contexts. The phrase is used in other contexts although the meaning seems clear here. While I am satisfied, the Minister of State might reconfirm that fact.

It is as the officials have communicated to the Senator.

That concludes the first group. I ask the Minister of State to speak on subject matter of the amendments in the second group.

Group 2 comprises amendments Nos. 3 to 5, inclusive, which relate to section 7 of the Bill. The Seanad will recall that in regard to a number of the amendments made on the floor of the House, I said there may be a need to make technical amendments to ensure the wording is completely sound from a legal point of view. Most of the amendments we are considering today fall into this category; they are technical in nature and the changes proposed are being made on foot of the advice that I and the Department have received from the Office of the Attorney General.

In respect of this group of amendments, the Seanad will recall that it approved two amendments to section 7 that were intended to make explicit that if any part of the public service identity were to contain special category data, it could not be shared under this legislation. In fact, that was a fundamental part of the discussion we had. An issue arises with these amendments in that they only apply to subsection (2) of that section of the Bill and it is not clear if they apply to any other subsections, even though subsection (3) also refers to public service identity. Therefore, to avoid any doubt, the Dáil has agreed to delete the original two amendments and instead create a specific definition of "public service identity" in section 7(5) that explicitly excludes special category data which had applied to the entirety of this section of the Bill.

I recognise that the exclusion of special categories of personal data as defined under Article 9 of the GDPR is a concession the Minister of State has made following our debate in the Seanad. I was very happy when he was able to accept the amendments in the Seanad and I, of course, had concerns when I saw they were being revised.

The removal of the phrase "and compliant with Article 9 of GDPR" is perhaps not necessary, although we need to be cognisant of it. There is a concern that the amendment proposes that "public service identity" has the same meaning as it has in section 262 of the Act of 2005 and shall not include a reference to special categories of personal data. While I understand this might be addressed again later, I would like to have it clarified. My concern is that what the Minister of State is inserting simply states that there will not be a reference to special categories of personal data within the Social Welfare Consolidation Act 2005. I have had extensive debates with the Minister, Deputy Regina Doherty, about what do or do not constitute special categories of personal data, specifically around the question of what does or does not constitute biometric data. The Minister and I are not in agreement at this point but I believe a time will come when that will be clarified by rulings in the European Court of Justice because it is an issue in regard to photographs in particular.

My concern is that the original changes to the legislation referred in a wider sense to the special categories of personal data whereas amendment No. 5 proposes that the section "shall not include a reference to special categories of personal data".

I do not anticipate that the Minister will seek to include a reference to special categories of personal data but if special categories of personal data are there, for example, as determined by the European Court of Justice or others, I would want that additional security. The Minister of State might clarify whether, when he says references to areas of public service identity that constitute special categories of personal data shall not be included in this data sharing Bill, that will have a wider meaning than that they will not be referenced in social welfare legislation.

There is an important difference between special categories as defined under the GDPR, the interaction of which is yet to be determined, and special categories as referenced within our national legislation. The Minister of State might clarify this in regard to amendment No. 5. I do not have a material problem with amendments Nos. 3 and 4, apart from the fact that I would like to insert references to Article 9. I am happy to let them go.

As I said in the Dáil and the last time I was here, I am not making any changes to the Social Welfare Consolidation Act, and nor can I. In this Bill I am trying to reflect what is in that Act and, in doing so, it is not our intention to create any special categories of data. The Senator will be aware of some of the discussion we had in the Dáil around this issue. We came up with amendment No. 5 to reflect both the intention of the existing legislation not to create any categories of special data and the Attorney General's advice.

The GDPR is one of the cornerstones of the legislation. We have had regard to existing legislation and have had long discussions on the premise of this Bill. We have no intention of deviating from the existing Social Welfare Consolidation Act. I understand the concerns of Senators and I am sure they will come up again in relation to some of the other amendments.

I have a procedural question.

The Senator may only speak once on each grouping.

It is a technical question to the Chair. We have two amendments on the same lines on Report Stage. Is there any material interaction between those amendments?

We are dealing with each of the amendments in groupings.

I want to clarify if what happens to amendment No. 5 will have any impact in respect of amendment No. 6. They are placed in the same location within the Bill.

We will either pass or not pass the Dáil amendments as a block. Amendment No. 5 is being dealt with in group 2 while amendment No. 6 is being dealt with in group 3.

In that case, amendment No. 6 will not be affected if amendment No. 5 is passed.

We are passing them as a block. They are not up for individual decision.

I take the point. There is no danger of an intersection.

I will not pre-empt the result but it is all or nothing.

In respect of those amendments, I am happy for the issue of Article 9 definitions to continue at the European Court of Justice.

That concludes group 2. I ask the Minister to speak on the subject matter of the amendments in group 3.

Group 3 comprises amendments Nos. 6, 7 and 13.

It also includes Seanad Report Stage amendments Nos. 1 to 3, inclusive.

Yes. Amendments Nos. 6, 7 and 13 provide that public bodies cannot ask for a public services card or access a public service identity as the exclusive basis by which a person may verify his or her identity in order to conduct a transaction or access a service. It is crucial to the construction of the legislation that the public service identity includes some of the following: PPS number; name; address; date of birth; place of birth; and any other data that can be used to identify a person. The advice of the Attorney General is that any of these data that are collected are public service identity data. These amendments mean that the Government would have to provide services to citizens who choose not to provide basic information such as a name, an address or a date of birth. People could choose not to use their public services card, passport or driver's licence as forms of identification, as they all contain elements of the public services identity, and still expect to access a service. This will effectively grind certain key services to a halt. Services that are not popular, such as the collection of taxes, local authority rents, accident and emergency charges, jury duty, recouping social protection and agriculture overpayments and the application of penalty points, all rely on the public service identity set. The fundamentals of this legislation could have a cascading effect and unintended consequences for other legislation.

By withdrawing the element of the public service identity, we could find ourselves being forced to provide services and, in some cases, financial supports to people who choose not to provide basic information. The amendments place an obligation on every public body to provide an alternative method of identity verification which does not include the public services card or the public service identity. On account of the broad definition of the public services identity, as provided by the Attorney General, there will be no way to provide services to people who refuse to provide the information. This will create significant confusion across a range of public services, including social protection, housing, health and all other services that rely on the public services identity data to provide services. The provisions in the Bill place an impossible obligation on public bodies to find alternative ways of establishing identity. I note that the amendments have been tabled to delete these provisions and I ask that the Seanad support them.

There is a fundamental misapprehension here and there is a danger of misleading people. I commend Deputies Wallace and Clare Daly on their work in respect of the amendments. The amendments were put forward in response to the issues of coercive consent and the importance of people being able to use another way when they choose to have their information used for verification.

One amendment refers to the public services card and a person's access to the database where the public service identity and information dataset is currently compiled. It proposes that this should not be the exclusive basis by which a person can verify his or her identity. There is an onus on persons to verify their identity and in many of our services, such as the application for a driver's licence since the changes were made in respect of certain grants by the Minister for Transport, Tourism and Sport, Deputy Ross, people verify their identity to the satisfaction of the relevant authority or Minister without reference to the public service identity dataset. Government has a goal to ensure that the public service identity dataset becomes the main, and perhaps the exclusive, reference for this but, at the moment, there are other options in a number of areas. The situation is described as catastrophic by the Minister but it already exists.

We have a number of situations in which persons are accessing services and they have one option. This is not true for every case because not all public bodies are specified bodies. Not all public bodies or Departments are currently covered by the Social Welfare Consolidation Act and have access to the public service identity dataset. Persons are accessing services and their identity has been verified possibly by the public services card or by another means, and it only has to be by one other means. For example, the Government is very attached to the SAFE 2 mechanism of identity verification, which was invented by it and the Department of Public Expenditure and Reform. If that is deemed satisfactory then there is nothing to stop legislation saying, "by public service identity ... by reference to ... by access". If I am an official who wishes to verify somebody's identity to my satisfaction or if a Minister wishes to verify somebody's identity to his or her satisfaction, I may have reference to and access the public service identity dataset or I may, for example, accept a passport or another form of verification. I may ask for bills or I may even require that the person would go through a full SAFE 2 identification process on a case-by-case basis. Few people will take that option but there is nothing to preclude such an option.

I hate to challenge the Attorney General directly. However, the reading, as determined by the Attorney General is wrong in terms of GDPR because the wording suggests that a person's name and date of birth are information that belongs to the public service identity dataset. My name, address and date of birth may well be in a dataset or on a database that can be accessed but the database does not own that information because one of the fundamental core principles of GDPR, which takes precedence - and the Minister of State has acknowledged that the GDPR takes precedence in this case - is the principle that a person's information is his or her information. If it was the case that we could not look for somebody's name, address or date of birth other than by accessing this dataset, I could not sign up for a gym membership or get a video rental card because my name is, theoretically, not something that can be verified separately; it is something that can only belong to this dataset. That is a chilling argument and is why I must push back on it as an argument. The idea that each of those elements of information, which are personal to the individual, are somehow intrinsically linked to, and belong to, this dataset does not stand up and it is a concern. I met the Minister of State's officials and that is why I tabled a number of amendments. It is disappointing to see some of my amendments rolled back but I accept, in good faith, that there was an attempt to work with them and with the principles that we agreed on. However, this particular argument does not stand up and it is a concern.

I am sure that 99.9% of people are happy to have their information stored on the public service identity dataset and to have that be a speedy and easy means by which their identity is verified. However, a number of people are concerned about the matter. Their concerns are reasonable because the DPC has concerns in respect of how the dataset is accessed and used. We do not know the detail of what the resolution of those concerns have been because the Government has declined to publish, as has the commissioner, the reports of her section 10 inquiry into the public services cards and public service identity. There is a big question mark over the mechanism by which people authenticate their identity and many unknown concerns in respect of data protection. The amendments in the Dáil, particularly amendment No. 6 because it is so reasonably worded, simply ask that this mechanism not be the only and exclusive mechanism. Let us remember that persons may be on the dataset due to being in receipt of social welfare services, for example. The amendments mean that even if the dataset is there that an official accessing it - this does not undermine the existence of the dataset - might not be the exclusive method for verification. I am confident that the provision does not prevent somebody accessing information such as birth certificates, proof of address, utility bills, date of birth or any of that other information. An official may choose to access other information pertinent to the person who seeks a service without logging into and accessing this particular dataset. The provision is clear and, therefore, I cannot support the changes in that regard.

I thank the Senator for her contribution. I do agree at all with her assertion about the Attorney General and her sweeping statement that "the Attorney General is wrong".

In this small respect, the advice seems to be.

The Senator made the assertion that "the Attorney General is wrong". I disagree because the Attorney General has given us advice on what constitutes a public service identity, and I have outlined the elements that would construct a public service identity.

The most important part of the section that we are dealing with is not the exclusive means. Section 7(6) states:

A specified body may not make presentation of a public services card or access to a person’s public service identity the exclusive basis by which a person may verify their identity in order to conduct a transaction or access a service.

The most important words are "to conduct a transaction or access a service". Conducting a transaction could be adding penalty points to someone's licence, assessing a tax liability, a demand from the Department for Agriculture, Food and the Marine for the return of an overpayment or a request to undertake jury duty. If the amendment was accepted and the Bill was sent to the Phoenix Park to be signed by the President, the criminal justice system would collapse in the morning because we would be unable to call people for jury duty. Some people might relish the opportunity of being unable to call people for jury duty. In general, we would not like that to happen because people could avail of this provision as a loophole and say that they will not provide their names, addresses, PPS numbers and dates of birth. A person may decide not to provide any information to the State in order for that transaction to be transacted between me and the State. The transaction could be defined as me participating, for instance, in jury duty, repaying underpaid tax or recouping an overpayment from the Departments of Employment Affairs and Social Protection or Agriculture, Food and the Marine. As a Minister of State, I must take the advice of the Attorney General on this matter and he has been explicit in this regard. These amendments were discussed at length in the Dáil. I acknowledge that outside interests are intensively lobbying, in good faith, for these amendments to be made. However, I must take the advice given by the Attorney General and the net effect of the amendments would be the grinding to a solitary halt of our public services to deliver services in some cases if people decided that they would not co-operate.

The Senator said that we could co-operate by other means, for instance, by showing one's passport. How would one get a person's passport in the first place if he or she has decided not to provide his or her birth certificate? If a person walks into a Garda station but has decided not to provide proof of evidence, because it is covered in the public service identity that has been defined by the Attorney General, which Senator Higgins disagrees with and is entitled to do so-----

To clarify, the amendments do not prevent somebody being required to verify his or her identity; they refer to the means by which a person is identified.

We need to be very clear.

The legislation clearly states: "A specified body may not make presentation of a public services card or access to a person’s public service identity the exclusive basis". What would be the basis if that provision was deleted? Are we supposed to be vague and describe a person as living five houses up from the second house on the left? If a person decides not to co-operate because of what has been provided for in the amendment under the definition of "exclusive means", then there are no other means.

There are multiple means that are already in use.

I do not want to have an exchange over and back with the Senator but she has already said that someone could come forward with a passport. How would he or she get that passport in the first instance if he or she was not going to accept that the public services identity card is one of the exclusive means? There has to be a means for the State to engage with the citizens who are availing of services or, in some cases, are being pursued by the State. With the greatest respect, it is a bit like Brexit. They are taking out the stuff we use at the moment but are not providing us with any means. It is a bit like the backstop, "We do not like it-----

On a point of order, nothing is removed in this. What is provided for in these amendments are additions so let us be clear. That is not removed as a mechanism from the-----

It makes it very clear that it ties the hands of the State in terms of trying to identify a person because it makes it very clear that we cannot use on an exclusive basis the public services card or access to a person's public services identity.

In respect of my accepting the definition of a public services identity, which is name, address, PPS number, date and a whole pile of things like a mother's maiden name, nobody has provided me with a mechanism as to how I can provide public services tomorrow if this Bill was enacted and nobody has come up with a suggestion if that was to be simply walked over. It is on that basis that I am looking for support.

That concludes group 3. I call on the Minister of State to speak on the subject matter of the amendments in group 4.

Group 4 consists of amendments Nos. 8, 9, 11 and 22. Amendment No. 8 concerns the issue of commercial activity. It provides that public bodies may not share data where the body receiving the data is involved in commercial activity where the use of that data could give the body concerned a commercial advantage over other operators in the same market. When we debated this in the Seanad, there was broad support so I hope that is the case again today. The House will recall that I gave a commitment to add a provision to this effect when the Bill was before the Dáil and this is what I have done.

Amendment No. 9 to section 13 of the Bill sets out an explicit requirement that data sharing under this legislation shall not be lawful unless it is necessary for the performance of the functions of the public bodies concerned and that any sharing is proportionate to the functions of the public bodies involved and to the GDPR rights of the data subjects concerned. I know the Senator spent a lot of time on this the last time I was here.

Similarly, amendment No. 11 to section 19 requires that as part of the data sharing agreement, the parties to the agreement must provide a statement setting out why the data sharing is necessary and proportionate. That is worthwhile as well. These amendments strengthen the wording regarding the necessity for proportionality regarding sharing originally proposed and accepted by the House.

Amendment No. 22 concerns the clarification of the data sharing agreements. It is a technical amendment to section 55 to make explicit that the data protection officer shall certify that any data sharing agreement is in accordance with Article 5.1 of the GDPR where the data protection principles are set out.

I am happy to support amendment No. 7.

We are not dealing with amendment No. 7. We are dealing with amendments Nos. 8, 9, 11 and 22.

Amendments Nos. 8, 9 and 10.

No, amendments Nos. 8, 9, 11 and 22.

I acknowledge that the Minister of State is seeking through amendment No. 8 to address the concern we debated in the Seanad previously, which was my concern that the definition of "public body" effectively include private companies that are under contract to the State. There is quite a wide scope in terms of "public body" and there were concerns.

To an extent, this measure is positive. The provision addressed by the Minister of State seeks to ensure that there would be no distortion in competition in trade. For example, a private company providing a public service would not be able to use that information to have an advantage over another private company. I recognise that the Minister of State is addressing my concern a little in respect of the distortion of trade. However, I would have liked if we had not only addressed it in terms of the potential victim being another company but in terms of the rights of the data subject.

Even where there is no competitor in sight and, therefore, no distortion of competition or trade, there is a question of ensuring there is no inappropriate use of data gathered. Obviously, that should not be happening anyway but it is a concern. I am conscious that we have framed it in terms of competition law, which is positive, but I feel there might be scope for strengthening it in terms of rights law as well. I accept it as a positive step.

Amendment No. 9 is fine. I have one concern about amendment No. 11. This replaces the question of necessary and proportionate, as had been worded originally. I respect the fact that the tests of necessity and proportionality are core to the GDPR and that much of what we did in the Seanad and what has been done in the Dáil is around copper fastening that. My concern is the way it has been replaced in amendment No. 11. It applies the proportionality test not only to the disclosure of information but the safeguards applicable. I want to be very clear. I need the Minister of State to clarify and reassure us in the House that a situation will not arise in which we are told that the safeguards need to be proportionate and that we need to limit the safeguards that are put in place. I do not want to create any perverse pressure against safeguards which are, of course, core. Could the Minister of State clarify matters? In general, I am happy that the Bill has been strengthened in terms of the issue of necessity and proportionality. In terms of proportionality in general, it is very important that we do not go to anything like the idea of a once-only principle because they have been misused in the past but instead have a strong principle of consent to each purpose.

Amendment No. 11 can be read in conjunction with amendment No. 22, which inserts the words "is satisfied that the agreement is consistent with Article 5(1) of the General Data Protection Regulation". I understand that there has been a lot of discussion about necessity and proportionality. Having reflected on it with the Attorney General, we have strengthened the Bill in terms of the references to the GDPR and pre-existing legislation that have been inserted.

Regarding the test for and definition of proportionality, it refers to balancing two competing priorities - the needs of public bodies and the needs of the customer, for want of a better word, the person engaging with the public body. The data sharing agreement has been put out for public consultation and has gone through the governance board arising out of the possibility that observations are sent in from people.

On top of that layer regarding necessity and proportionality, there is reference to the GDPR and a strengthening of governance as well by way of the board that will assess the data sharing agreement to which all of this will be subjected in the first place. Having reflected on it, which was primarily due to the debate that took place here as opposed to the other House, and I said this in the other House, the Attorney General has strengthened the legislation and has taken on board many of the concerns.

Regarding necessity and proportionality, we do not want to put in a subjective test that might present a difficulty around assessing whether one side is right and the other wrong. On foot of the Senator's request the last time I was here, we have strengthened it by way of the tests to which she referred as well as strong linkages with the GDPR, on top of the existing strong reflection on governance of each of the individual agreements that will be put in place.

Notwithstanding the concerns the Senator expressed, in general, the Bill is far stronger now. We may fall out over the dataset or some other issue but I am sure we will reach an agreed conclusion at the end of it.

That concludes the discussion on group 4. I call on the Minister of State to speak on the subject matter of the amendments in group 5.

Group 5 consists of amendments Nos. 10, 21 and 23, which concern the reporting requirements under the Bill. I accepted an amendment to section 17 in the Seanad that will provide that an Oireachtas committee could request the Minister to furnish it with a copy of any data sharing agreement made under the legislation. Accepting this amendment has an unintended consequence of removing the original requirement under section 17 that the data sharing agreements be made in writing. Amendment No. 10 reinstates the original wording that it provides for this.

As regards the provision for sending data sharing agreements to the Oireachtas committees, I decided this was better placed in section 60, which covers the Minister's obligation to publish all data sharing agreements. This is provided for by way of amendment No. 23.

Amendment No. 21 is technical in nature. It refers to section 52 to improve clarity and readability of the section.

Does anyone want to speak on Group 5?

As these amendments reflect the strength and reporting we looked for, they are fine.

That concludes the discussion on group 5. I ask the Minister of State to speak on the subject matter of the amendments in group 6.

Group 6 relates to amendments Nos. 12, 19 and 20. Amendment No. 12 deletes section 21(6) which provides that this section is without prejudice to the rights of the data subject in respect of any or all data controllers. This has been deleted on account of significant concerns raised by the Attorney General that the wording, "This section is without prejudice to", introduces legal uncertainty as regards whether data subjects would have full access rights under the GDPR in respect of any data sharing agreements made under the legislation. Basically, it implies that there is prejudice in other sections of the Bill and that gives an erroneous impression that the GDPR does not apply in its entirety to the legislation. I know that is not the intent of the House.

Acting on the Attorney General's advice, the Dáil has agreed to delete the provision. I assure this House that the deletion of the provision does not in any way affect the data subject's right to access, rectify or delete his or her personal information as provided for under the GDPR. A person wishing to exercise these rights in respect of a data sharing arrangement made under the Bill would be entitled to apply to any of the public bodies that are parties to such an arrangement in accordance with their rights under the GDPR.

Furthermore, as the Seanad is aware, the Bill has a number of specific provisions that uphold and enhance these rights, in particular, the personal data access portal provided under Part 8 of the Bill. In addition, I will ensure that the data governance board issues guidance that emphasises that people can exercise their GDPR rights directly with any public body that is a party to the data sharing agreement.

Amendment No. 19 removes the provision at section 46(6) that any contract the data governance board enters into in respect of consultancy shall be subject to public competition. This provision was deleted on foot of significant issues raised by the Attorney General. Public procurement law applies across all public bodies and it is not the norm to specify in legislation that it particularly applies to one type of contract. The Attorney General's advice was that this provision could call into question whether other procurement law applies to some public bodies but not to others or to some types of contracts but not to others. For this reason, the provision was deleted by the Dáil. I reassure the House that the public procurement laws apply to the data governance board in the same manner that all laws of the land would apply to such a body.

Amendment No. 23 relating to the data governance board is a technical amendment to section 47(6) concerning the membership of the data governance board to add the word "persons" which is inadvertently omitted from the text.

I thought we were dealing with group 6, which relates to amendment No. 12.

The Minister of State made reference to amendment No. 23, but I thought we had done that already.

I am sorry. This is amendments Nos. 12, 19 and 20.

We were on group 6, which is amendment No. 12.

Yes, I also addressed amendments Nos. 12, 19 and 20.

We were to deal only with amendment No. 12.

I have one concern, which is in respect of the data controller. I appreciate the concerns of the Attorney General regarding the wording and the need to avoid the implication that there is prejudice elsewhere. Nonetheless, in this legislation we are setting out a clear process whereby individuals can seek information and redress and a clear pathway whereby they should contact the lead agency. This applies in circumstances where there may be two or three data controllers or two or three different bodies that are sharing data and are party to an agreement under the GDPR. Obviously, a person can go to any one of those parties. However, if the concern was that we would be seen to close things off elsewhere, the fact that we specify how they can go to the lead agency and outline the steps to do that, without mentioning anywhere in the Bill that they can go to other data controllers, there is a concern about persons being even aware of that.

One of the obligations under the GDPR is to make sure that people can get practical access to information on how to exercise their rights. For example, if the Department of Employment Affairs and Social Protection was a lead agency in respect of a local bus service such as LocalLink, it should be the case that a person knows he or she can go to another body that may be much more local and more relevant, rather than believing the only route is to go to the lead agency. I know that, realistically, we will end up with a few lead agencies within very large networks. In the previous debate, the Minister of State mentioned potentially thousands of data sharing agreements. It is neither efficient nor satisfactory for persons to feel they have to go right to the top with a query when a smaller party to the agreement closer to them might be the relevant person to contact. This Bill does not take away their right to do that but our hope when we inserted this change was to make them aware that they can do that. If the Minister of State is removing that clarification which states that people can go to other parties and the four other signatories to this data sharing Bill, I ask him to indicate how he intends to ensure, first, that individuals are made aware that they can go to any of the parties in a data sharing agreement and, second, that the smaller parties in the data sharing agreement which may not be lead agencies are aware they have a responsibility to answer questions from individuals and do not simply shunt people up the line to a lead agency.

To go back to what individuals will know and when they will know it, one of the provisions we included in the Bill, and one I was very keen on at the outset, is the personal access portal. This will give a person real-time information in terms of what information, if any, a body has accessed about him or her. I also said that when the Bill becomes law, as I hope it will, it is my intention that guidance will be issued by the board to agencies, including the lead agencies, setting out what they must do.

The Senator is right. I envisage thousands of agreements will be required. As I said previously in the House, we are in limbo at the moment regarding the collection and sharing of information.

In terms of what will be done by way of clarity, as sought by the Senator, I noted previously the construct of the data governance board and the requirement on it to provide guidance and information to agencies. In addition, real-time information will be available to citizens and will make a major contribution and will be part of the scaffolding that will make all aspects of the Bill work. If the Senator and I can see in real time what information relating to us is being accessed, what information about us is available and the type of information about us that is being shared, to borrow a phrase she used, that will have a chilling effect and create the deterrent the agencies need. Unfortunately, historically and recently in this State we have seen that data have not been properly handled. That is the reason we want to try to mitigate that.

I discussed this in the Dáil at length with Deputies. The deletion of the subsection clears up the position in respect of the maintenance and management of the dataset.

I understand the concerns about the number of these agreements, the management of them, people having their say and being able to keep on top of matters. It will be difficult, there will be many of them, they will be onerous and require considerable attention from people who are interested in this area, but that is what is required. We need put this on a legal footing. We need to start by acknowledging that thousands of these agreements could be put in place. I hope that allays the Senator's concern.

That concludes the discussion on matters relating to group 6. I call the Minister of State to speak on the subject matter of amendments in group 7, which comprises amendments Nos. 19 and 20.

I took the opportunity earlier to refer to procurement contracts. I will not repeat what I said but it is the advice of the Attorney General that procurement law applies to all bodies and that rather than specifying that in Bill that we would delete it because it would cause confusion for everybody else.

Regarding amendment No. 20, the governance board is technical in nature and that was a typographical error.

Does Senator Higgins wish to speak to the amendments in group 7?

I accept the rationale for the removal of the issues relating to procurement but nonetheless those issues stand. I look forward to engaging with the Minister of State on this matter because I will be bringing forward legislation in respect of procurement in the future. These issues can be tackled within the wider scope of procurement law. In that context, I am happy to leave the matter to one side.

I welcome the Minister of State's acknowledgement that there issues relating to data and the governance of data. We have seen it recently in respect of the hospitals and persons accessing services. It is important that we have a very robust governance system. That system will be strengthened somewhat from here on.

That concludes the discussion on group 7. I do not think the Minister of State wants to come back in at this point.

We will move on to the amendments in group 8. I call the Minister of State to speak on the subject matter of the amendments in that group.

Amendments Nos. 14 to 18, inclusive, are technical amendments to section 44, which relates to the personal data access portal. Amendment No. 14 is a minor rewording of the provisions for users to view data sharing agreements, and taken with amendment No. 15, to move the text to section 44(2)(c), which is a more appropriate location for it. Amendments Nos. 16 to 18, inclusive, are technical amendments, to make reference to the new section 44(2)(c) so that public bodies have a basis to provide the data sharing agreements to the portal and that the provision of the data sharing agreement only occur on request from the data subject.

We are dealing with amendments Nos. 14 to 18, inclusive.

The data portal is a core element and it is a positive. The GDPR gets thrown in as if it is an obstacle, something complicated or a reason we cannot do things. In fact, the regulation is - and should be at its a core - an empowering element. One matter the European Union has got right is ensuring that people have the right to access their information and data.

I appreciate the position in respect of the data-sharing agreement. This again comes to back to the supplementary amendment No. 2 and the fact that we are dealing with bodies that provide services and those that propose to provide them. There is a concern in that regard. The Minister of State might confirm that those who access data portals will not simply be able to just search for a data sharing agreement that they know they might be part of but data sharing agreements that might not know they might be part of. One of the concerns is the language in certain parts of the Bill to the effect regarding circumstances were public bodies propose to provide services to people. It is important to ensure that it will be made transparent and that the mechanisms for persons to take action will also be made clear. I acknowledge that the Minister of State has strengthened the Bill by ensuring, as I requested, that it deals with data breaches. That is important, particularly in the context of the very concerning data breaches which occurred in hospitals and elsewhere and by which individuals were affected.

Does the Minister of State wish to respond?

That concludes the discussion on group 8. I ask the Minister of State to speak on the subject matter of Group 9, namely, amendment No. 26.

This is a technical amendment to delete the Dún Laoghaire Harbour Company from the Schedule to the Bill. As Senators are no doubt aware, the Dún Laoghaire Harbour Company was dissolved on 3 October 2018 and its assets and liabilities transferred to Dún Laoghaire-Rathdown County Council. Since the company is no longer in existence, we have removed it from the Schedule.

Is Senator O'Higgins satisfied with that?

That concludes our discussion on group 9.

We will move on to Report Stage amendments to the Bill, as passed by Dáil Éireann. Amendment No. 1 is a Government amendment. It arises out of amendments made by the Dáil. It has already been discussed with group 3.

Government amendment No. 1:
In page 10, to delete lines 25 to 27.
Amendment put:
The Seanad divided: Tá, 23; Níl, 8.

  • Burke, Colm.
  • Burke, Paddy.
  • Butler, Ray.
  • Buttimer, Jerry.
  • Byrne, Maria.
  • Clifford-Lee, Lorraine.
  • Coffey, Paudie.
  • Conway, Martin.
  • Hopkins, Maura.
  • Horkan, Gerry.
  • Lawless, Billy.
  • Lawlor, Anthony.
  • Leyden, Terry.
  • Lombard, Tim.
  • McFadden, Gabrielle.
  • Mulherin, Michelle.
  • Noone, Catherine.
  • O'Donnell, Kieran.
  • O'Mahony, John.
  • O'Reilly, Joe.
  • Ó Céidigh, Pádraig.
  • Reilly, James.
  • Richmond, Neale.

Níl

  • Black, Frances.
  • Conway-Walsh, Rose.
  • Devine, Máire.
  • Gavan, Paul.
  • Higgins, Alice-Mary.
  • Mac Lochlainn, Pádraig.
  • Ruane, Lynn.
  • Warfield, Fintan.
Tellers: Tá, Senators Gabrielle McFadden and John O'Mahony; Níl, Senators Rose Conway-Walsh and Alice-Mary Higgins.
Amendment declared carried.

Amendment No. 2 is a Government amendment. It arises out of amendments made by the Dáil. It has already been discussed with group 3.

Government amendment No. 2:
In page 14, to delete lines 15 to 19 and susbtitute the following:
“(I) to verify the identity of a person, where the first or second mentioned public body is providing or proposes to provide a service to that person;”.
Amendment put and declared carried.

Amendment No. 3 is a Government amendment. It arises out of amendments made by the Dáil. It has already been discussed with group 3.

Government amendment No. 3:
In page 33, to delete lines 25 to 27.
Amendment put and declared carried.

Amendment No. 4 is a Government amendment. It arises out of amendments made by the Dáil. It has already been discussed with group 1.

Government amendment No. 4:
In page 51, to delete lines 12 and 13 and sustitute the following:
“by the substitution of “An Oifig Náisiúnta um Sheirbhísí Comhroinnte” for “Oifig Náisiúnta Seirbhísí Comhroinnte”.”.
Amendment agreed to.
Question, "That the Bill, as amended, be received for final consideration", put and declared carried.
Question proposed: "That the Bill do now pass."

I wish the Minister of State well with the legislation. It is an important item of legislation.

I wish the Minister of State and everybody concerned well with the enactment of the legislation.

Question put and agreed to.
Sitting suspended at 4.10 p.m. and resumed at 4.30 p.m.