I welcome the Minister for Justice to the Chamber.
Communications (Retention of Data) (Amendment) Bill 2022: Second Stage
Question proposed: "That the Bill be now read a Second Time."
I am pleased to introduce the Communications (Retention of Data) (Amendment) Bill 2022 to the House. The purpose of the Bill is to make certain priority amendments to the current Communications (Retention of Data) Act 2011, referred to in this Bill as the principal Act. To comply with rulings of the Court of Justice of the European Union, the principal Act provides for the general and indiscriminate retention of certain categories of communications data held by communication service providers but not the content of such communications.
Senators will be aware there has been a civil challenge to the principal Act arising from a high-profile criminal case. While it would be inappropriate for me to comment on the specifics of any case before the courts, it is necessary to refer to some aspects of that litigation. A High Court order was made in early 2019, which declared invalid section 6(1)(a) of the principal Act insofar as it relates to mobile telecommunications. This section provides for disclosure of retained traffic and location data for law enforcement purposes. Following an appeal of this decision by the State, the Supreme Court referred certain legal questions to the Court of Justice of the EU. On 5 April this year, the Court of Justice delivered its ruling. In essence, the court confirmed that general and indiscriminate retention of traffic and location data is permissible for the purposes of safeguarding national security only. Such retention is not permitted for the prevention, detection, investigation or prosecution of a serious criminal offence. The court added that access provisions for traffic and location data must incorporate prior judicial scrutiny other than in certain urgent circumstances, and in such circumstances there should be a post review.
Following the Court of Justice ruling, the State's appealed proceedings against the 2019 High Court ruling regarding the principal Act were resumed in the Supreme Court. Following case management hearings at the end of May, the Supreme Court order for the outcome of the appeal is expected to be handed down in the near future. While I cannot comment further on these proceedings, the immediate impact of the Court of Justice ruling is that there is now a significant degree of clarity on what is and is not legally permitted in relation to the retention of traffic and location data.
This has significant implications for communications service providers, An Garda Síochána and other relevant agencies. Communications service providers have expressed doubt as to the validity of continued general and indiscriminate retention of data currently held under the principal Act. They have called for legal certainty as to what their data retention obligations now are. In addition, An Garda Síochána and other relevant agencies require legal certainty as to the scope of their powers to seek disclosure of retained data for the prevention, detection, investigation or prosecution of criminal offences, for national security and other lawful purposes. As a result, I am proposing a series of urgent amendments to the principal Act, in advance of a more extensive reform of the law in this area. Apart from this Bill, it is my intention to publish an updated general scheme of a Bill before the end of this year, which will update and consolidate the law in this area.
In devising this Bill, I am seeking to balance a number of factors. First, I must adhere to the conditions placed on the operation of data retention by the Court of Justice while seeking to ensure that An Garda Síochána and other related agencies have effective and proportionate legal powers to support their vital role. Second, I must have due regard to the right to privacy of individuals and to the need for strong oversight of any data retention measures that are imposed. Third, I must at all times have regard to the needs of victims or potential victims of crime. There is a right to life and a right to personal safety of persons and, as Minister for Justice, I will always prioritise these rights.
I will now refer briefly to the main provisions of the Bill. Section 2 provides for a number of new definitions in the principal Act.
The term "user data" refers to general information regarding the user of an electronic communications service such as the mobile telephony number, the equipment identifier of the device used and the Internet protocol address in respect of the user. The Court of Justice rulings view the retention of these sorts of data as having a limited impact on privacy rights.
The term "Schedule 2 data" is intended to capture traffic and location data and is based on the type of data that is already retained by service providers under Schedule 2 to the principal Act. The Court of Justice rulings view the retention of this type of data as constituting a significant interference with privacy rights.
The term "internet source data" is a category of data already that can be used to identify Internet protocol addresses which may have accessed unlawful online content such as child abuse imagery. The retention of such data for both national security and other purposes is not precluded by the Court of Justice rulings.
Section 3 provides for an obligation on service providers to retain user data for a default period of 12 months. In this Bill, it is necessary to segregate the procedures governing retention of and disclosure of user data from the same procedures governing Schedule 2 data. Provision is made for this period to be varied to less than 12 months or a maximum of two years on stated grounds as the Minister may consider necessary or proportionate. This option is included as there are pending Court of Justice rulings on the issue of data retention periods for this type of data.
Section 4 introduces two new sections into the principal Act. The new section 3A provides for amendments to the current rules on general and indiscriminate retention of Schedule 2 data. Such retention can only be permitted for national security purposes and where there is approval of a High Court judge. It will no longer be permitted for law enforcement purposes. This is a change from the current arrangement in the principal Act, which allows for general retention for both of these purposes. I wish to clarify the background to this measure. Confining general retention of Schedule 2 data to national security purposes is a requirement of the Court of Justice rulings. While Ireland and a large number of other EU member states made strong legal arguments against making such a distinction in the relevant legal proceedings before the Court of Justice, the Court did not accept these arguments. I respectfully disagree with the Court of Justice ruling in this respect. However, our laws must reflect the legal outcome and that is why this amendment is proposed. I will, however, continue to advocate at EU level for an EU-wide legal instrument that will support strong general data retention measures that deal with both national security and law enforcement concerns.
The new section 3B provides for a stand-alone obligation to retain Internet source data for a default period of one year. Provision is also made here for this period to be varied to less than 12 months or a maximum of two years, due to pending Court of Justice rulings.
Section 5 amends section 6 of the principal Act to confirm the authority of An Garda Síochána, the Defence Forces, the Revenue Commissioners and the Competition and Consumer Protection Commission to seek the disclosure of user data for national security, crime and for protecting life or personal safety. The provision reflects what is permitted by the Court of Justice rulings.
Section 6 provides for the insertion of new sections 6A to 6F into the principal Act. Section 6A provides for a disclosure regime for An Garda Síochána and the Defence Forces to obtain access to retained Schedule 2 data on national security grounds, provided the disclosure has been approved by an authorising judge.
Section 6B provides for a disclosure regime for An Garda Síochána and the Defence Forces where there may not be time to seek approval by an authorising judge. A system of post-approval by an authorising judge within a set period of time is also included.
Section 6C provides for a regime of disclosure of retained Internet source data to An Garda Síochána, the Defence Forces, the Revenue Commissioners and the Competition and Consumer Protection Commission on both law enforcement and State security grounds, where approved by an authorising judge.
Section 6D provides for a disclosure regime for Internet source data in urgent circumstances.
Section 6E provides for a disclosure regime for An Garda Síochána to access cell site location data linked to an electronic device in urgent circumstances, where needed to protect the life or personal safety of a person or determine the whereabouts of a missing person.
Section 7 provides for the insertion of new sections 7A to 7D into the principal Act. These sections introduce new legal provisions for preservation orders and a protection order to be sought in specific cases by An Garda Síochána, the Defence Forces, the Revenue Commissioners or the Competition and Consumer Protection Commission. The orders must be approved by an authorised judge and based on the need to respond to serious offences, national security or the saving of a human life. The possibility of deploying such measures to ensure the expedited retention of specific data in individual cases has been acknowledged by the Court of Justice in its rulings.
The new section 7A provides for a preservation order, which will require the preservation of specified Schedule 2 data by a service provider in connection with specific persons, locations or other indicators, for example mobile phone numbers. A preservation order will not in itself require the granting of access to data. The new section 7B provides for a production order, which, if approved by an authorised judge, will require the submission of specified data to An Garda Síochána and other agencies, and may include data which may already be the subject of a preservation order. The new sections 7C and 7D allow for the approval in urgent cases of temporary preservation and production orders by an appropriate senior official in each organisation, which must be notified to an authorised judge for affirmation within 72 hours.
Section 8 provides a number of supporting measures to be included in the principal Act, including an offence provision for failure to comply with a requirement to comply with legal requirements to retain, preserve or disclose data, the issue of guidelines to service providers, the making of regulations, the notification of data subjects in appropriate cases where their data have been disclosed, and the appointment of authorised judges.
Section 9 is a transitional provision that allows for a time-limited period where there can be disclosure, on national security grounds only where approved by an authorised judge, of Schedule 2 data already retained under the existing 2011 Act until the earlier of the expiry of a period of six months or the making of a first order by a designated judge under section 3A permitting the future retention of Schedule 2 data.
I look forward to hearing the contributions from Senators today. There will of course be an opportunity on Committee Stage to discuss in more detail any aspects of the Bill that Senators wish to explore further. I acknowledge the speed at which this Bill has come to the House. This is not the way I like to bring forward legislation. I stress that this is emergency legislation because of the fact that once we go on Dáil recess there will most likely be a final ruling, which would mean that certain aspects of the Act will fall. This provides a huge amount of uncertainty for the communications platforms and for An Garda Síochána. This is a measure to put into place to ensure that we have certainty for those various authorities. I also wish to confirm with and assure the Senators that I will be bringing forward the general scheme of a Bill for a more broad discussion later this year. I look forward to discussing and debating even more with the Senators then.
Cuirim fáilte roimh an Aire. Is é cothromaíocht atá i gceist ag an mBille seo idir, ar lámh amháin, An Garda Síochána, an Stát, agus an Stiúrthóir Ionchúiseamh Poiblí a gcuid oibre a dhéanamh agus, ar an lámh eile, an duine pearsanta agus an pobal.
The issues in this Bill have been aired extensively in the Oireachtas Committee on Justice, in public and in private. I very much welcome the Minister's acknowledgement, at the conclusion of her remarks, the Bill has had a rapid accession through the Houses of the Oireachtas. We all agree that this is undesirable in the circumstances but I acknowledge where this is coming from. I also believe the explanation given by the Department of Justice in the committee around the reasons why earlier action was not taken on data protection rules. We were waiting for the law in this area to crystallise so that we were not passing multiple items of legislation to deal with an evolving situation. I accept that explanation and I believe it makes sense on all of the levels. Unfortunately, it leaves us as legislators in an invidious position because we find ourselves at the last minute trying to go through what is very complex and comprehensive legislation that deals with a whole load of issues.
That is why I say this is a balancing act. This Bill is about balancing, on the one hand, the need to give the powers and equipment to An Garda Síochána, the DPP and the State and its organs to do their job in detecting prosecuting and solving crime, especially the kind we are talking about, that serious element of the criminal spectrum, namely, gangland crime and the very subversive element that can exist within the criminal underworld. On the other hand, there are individual rights and the rights of people to their privacy and knowledge in regard to their material that the State has nothing to do with.
We could not at any point tolerate the mass surveillance of the citizenry in the way that exists in other countries, even ones we see as democratic countries. I look, for example, at the US and the extent to which the US Government and law enforcement agencies are entitled and empowered under its legislation to surveil the population, investigate it and look into the privacy of it in a way we would consider completely unwarranted. That is very much distinct from the scheme that is being put forward in this Bill. I am highly conscious of concerns brought forward by groups like the Irish Council for Civil Liberties about mass surveillance or unwarranted invasion of the privacy of individuals. I am conscious of them and have looked at the Bill with a critical eye in that regard. I do not know if this Bill is the right answer or if it is the answer that is the right balance between those two aspects that the Department of Justice in particular must always grapple with. However, I am satisfied there are enough protections in here to deal with the potential issues that have been identified even to this stage in the scrutiny of this Bill.
I am also conscious many of the measures in this Bill are going to require much ongoing measuring, monitoring and surveillance by the Minister's Department and by the appropriate agencies within the State to ensure none of our law enforcement agencies oversteps the mark in their zealousness to get an answer or to find a particular person or evidence against a particular person or group. Issues that were raised in the justice committee were in the context of misuse of information An Garda Síochána might have through various data that are retained by it. I recognise, for example, many provisions are put in place in this Bill and elsewhere to protect information kept on PULSE and information kept by An Garda Síochána from being used in a way not warranted or not appropriate in the context of the kind of investigations discussed in this Bill. I welcome the protections that are there. I am not qualified enough to say definitively whether they are sufficient but I confess I am satisfied that what is described in this Bill is sufficient, provided that on an ongoing basis it is maintained and all of the safeguards discussed are maintained at a high level to protect individual citizens. Not even the most zealous of the people I am talking about in law enforcement want a situation where we have mass surveillance of our citizens. I do not think this Bill provides for that. I recognise the legitimate concerns of people but there are safeguards built in that should satisfy people that this is something that will empower An Garda Síochána and the other law enforcement agencies to do the job they need to do but also to protect us all.
Very often when we talk about the investigation of crime people perceive themselves as potentially the victims of crime instead of potentially the falsely accused person or the person whose privacy is incorrectly or unwarrantedly invaded. All the provisions we put in place - those aspects of the law that prevent the Garda or whoever it might be from doing that - are protections that are there for us as citizens, for every citizen and every resident of this State, and they are appropriate and necessary.
I recognise as well that to a large extent An Garda Síochána will feel its hands have been slightly tied by this legislation and that is undoubtedly the case. The mass availability that might have been there in the past is now gone but that must be seen in the context of a necessary evolution of data protection law in this country arising from the judgments that have been discussed in the Court of Justice of the European Union. On that basis, I welcome the legislation on behalf of the Fine Gael group. I accept the bona fides of the Minister and her Department on the protections set into it but I call for a robust, ongoing engagement on those protections to protect all citizens of this country and to ensure there is no unwarranted overstep. Not only is that illegal and wrong but it massively compromises faith in the organs of the State that do it, so it is important to maintain those protections in place.
I welcome the Minister to the House. Much of the criticism of the Government that followed this decision from the European court was around the issue that the Government seemed to have sat for a very long time on an uncomfortable reality that there had been a decision as far back as 2014 against the country in the context of the Digital Rights Ireland case. When the decision in the Graham Dwyer case was handed down by the European court those who followed that case and took a strong view of privacy rights more or less said "We told you so", that they saw this coming and that the 2011 law, as it stood, envisaged a measure of data retention that simply was no longer acceptable under European law. I cannot speak for all the citizens of this country but I think many ordinary people will be concerned at the idea An Garda Síochána will not in future be in a position to access all possible information necessary for the investigation of serious crime, including murder.
This legislation is being rushed through in a very unsatisfactory way. We saw what went on at the very truncated pre-legislative scrutiny stage. I accept what the Minister said in that this is a piece of holding legislation and that she had to act quickly to safeguard such rights as may be capable of being safeguarded in terms of the need to access data but from what I can read the position is data may still be retained, although only for national security purposes. Data may be obtained for the investigation of crime if it is certain kinds of data but it is not that long ago that people were congratulating the painstaking and forensic Garda investigation work that led to the conviction of Mr. Dwyer. It seems to me what is going on here is a complete capitulation to a European decision and accepting an unpleasant and unacceptable reality that in the future this kind of access to location data from mobile phones specifically will not be possible in future.
I note Mr. Justice Hunt's decision in recent days. Among the many points he made was the fact that it related to the accessing of mobile phone records in 2019 and that therefore he was not in some sense bound by the recent decision of the Court of Justice of the European Union. However, consider the judge's language in describing the European court's decision and its prioritisation of a particular vision of privacy rights. He caught the mood of many people when he effectively criticised, as it were, the priorities of the Court of Justice of the European Union.
I note what Senator Ward said about the necessary evolution of data protection law but that is effectively the language of capitulation. How come there has been no national discussion in the media, no questions asked of Government and no statements of intent by Government to go back to our European partners and say it is an unforeseen and undesirable consequence of this decision that cold-blooded murder, should it take place in future, cannot be investigated to the fullest possible extent? It seems to me people are failing to distinguish between the legitimate protection of data rights and privacy rights. Legitimate protection should entail that information can only be accessed in certain cases subject to certain safeguards, for example, involving the requirement of going before a judge and so on but the principle should be that such information may be retained and may in the future potentially be accessed for the purposes of investigating and prosecuting serious crime.
Am I on another planet to be the only person I have heard so far to express this concern in the Houses of the Oireachtas? Is there something I do not understand about the way European negotiations go on - that a government cannot talk to its fellow governments at European level and say, "This is something undesirable"? We have seen in the past in the context of our own Constitution that where people did not like rulings, they brought forward referenda to change things. We have seen in the past that where legislation is interpreted in such a way as to entail unforeseen consequences, there is remedial legislation. The Government's approach here seems to be, "Oh we're just going to put our hands up and salvage as much as we can". Can we not ask the fundamental question? Should it not be possible to envisage the retention of such data, including location data, and access it in certain circumstances in the future subject to certain rules about how it can be done in order to prosecute and eventually criminalise murderers? Could anything be as serious as that? I have not heard the Government is going to do its utmost to restore us to a situation where good detective work can go on, information can be obtained and data can be accessed for a good purpose - not for the purpose of breaching people's privacy but for the higher purpose of preventing and prosecuting serious crime.
I congratulate the Minister and her husband, Paul, on their good news. While I am not a barrister like Senators Mullen, Ward and Martin, I have looked at this Bill and have certainly taken on board their comments. Far be it from me to need to defend the Minister but I note that in her speech, she said that she will continue to advocate at EU level for an EU-wide legal instrument that will support strong general data retention measures to deal with national security and law enforcement concerns.
I know we must be very cautious about referring to specific cases and I know there is a balance between data protection, the GDPR and freedom of information but there is a higher purpose, as Senator Mullen alluded to, in terms of allowing our gardaí to get evidence that exists and allowing that evidence to be used to prosecute people and for these people to go in front of a judge and jury and be convicted. Of course, nobody wants a false conviction but equally people do not want people to get off when the evidence is there that confirms or certainly supports the idea that they are guilty. I certainly want to ensure An Garda Síochána is fully equipped with laws and modern technology to fight crime.
Our party is certainly supporting this legislation. I acknowledge that it is not ideal that it comes through at this speed but we all understand why. We certainly do not want a situation where An Garda Síochána is hampered in doing what it does. We all want to make sure that if the evidence is there, if wrongdoing has been done and it can be proved that wrongdoing has been done, the evidence that supports that can be used. Nobody wants mass surveillance, to be tracked for everything or to have various agents of the State just looking at people's information for their own interest. However, it is really important that we make sure we give An Garda Síochána and other law enforcement agencies access to information that is there in their ongoing inquiries generally.
We do not want a situation where somebody who is guilty can use these types of loopholes to end up not being prosecuted and found guilty of crimes he or she has committed. Again, I am conscious of not referring to a particular case but hypothetically if people are guilty and the evidence is there, I think the general public would want our law enforcement agencies to be able to use all of the tools at their disposal to make sure those guilty of wrongdoing are convicted so I certainly support the Bill. The Minister made a very comprehensive opening statement. I do not intend to repeat what is happening in each section as there is no need for that. My party and I will be supporting this Bill and I thank the Minister for bringing it to the House.
Once again, I welcome the Minister to the House. She is a frequent visitor. It is always great to see her in the House. I thank her for her opening statement. It was comprehensive and full of candour but it was very depressing. In her opening remarks, the Minister said:
On 5 April this year, the Court of Justice delivered its ruling. In essence, the court confirmed that general and indiscriminate retention of traffic and location data is permissible for the purposes of safeguarding national security only. Such retention is not [I repeat, "is not" and the Minister was very frank with us] permitted for the prevention, detection, investigation or prosecution of a serious criminal offence.
We have clarity from the Minister. On foot of the judgment, the Minister accepted that we have a significant degree of clarity on what is and is not permitted. I sympathise with the Minister and anyone in the Government who has to square this. Looking at what the Minister said, this is clarifying an exceptionally fair, honest and decent approach on the part of the Minister to this dreadful proposed legislation. The Minister said, "While Ireland and a large number of other EU member states made strong legal arguments against making such a distinction in the relevant legal proceedings before the Court of Justice, the court did not accept these arguments". She then said, "I respectfully disagree with the Court of Justice ruling in this respect".
I do not think the Minister could be any more honest. For a serving Minister to say that is a breath of fresh air but it is about the only breath of fresh air on a very dark day for this Bill to be read a Second Time. I accept the Minister's good faith and I accept what she said when she said our laws must reflect the legal outcome, which is why this amendment is proposed. I have the utmost respect for the adviser to the Government, Paul Gallagher SC. He has a different job to me or any legislator. From recollection, he was probably representing Ireland in some of these cases.
I commend Ireland for taking such a forthright stance on these cases. I say this as a proud European and someone who believes in the European process. I understand that one takes the good with the bad but this is not bad. If one wants alarm bells to go off, on a scale of one to ten, this gets 11. Before we can support this legislation and before it goes through the House, I need clear detailed assurances and evidence that everything else was tried first. Some would say that the court in Luxembourg is out of control while others would ask why people would say it has gone out of control recently and argue that it has been out of control for quite some time.
Every case falls on its own unique circumstances and facts. I fear I know the answer because Mr. Gallagher would have tried everything possible in the world of legal and mental gymnastics and he is a very decent, highly intelligent and respected leader of the Bar but one must bring people with one. There is a disconnect at the moment and I need to be assured that we have tried everything humanly possible to fight a court that has gone out of control.
Regarding all the talk about preservation orders, they do not come into play in certain circumstances so that is a palaver in respect of criminals who are not identified at present. I do not think that people fully appreciate yet that if a serious crime is committed today, if it is not an issue of national security, after 90 days, evidence that could be very supportive and corroborate a prosecution is not just inaccessible, it is destroyed. After 90 days, one cannot get it for a serious offence like murder or rape.
How can a preservation order possibly be obtained if the person is unidentifiable and we do not know where we are looking for it? We know, without mentioning any cases, that the tracking and location data can be vital in putting murderers and rapists behind bars after affording them a fair trial. Is there no way around that? Can we try harder to perhaps keep the data alive but under strict safeguards in order that if anyone abuses or exploits the data, the penalties are most severe, including custodial sentences? Could we say that if we want further balances, checks and safeguards, that no one gets to the data, even if there is a criminal investigation? In other words, we would throw away the key except in one instance, namely, where the Supreme Court can find the key and reopen the matter.
The legislation destroys evidence of a person unknown. We all celebrate cold cases. We may forget about this extremely important evidence gathering because a few years down the road, we cannot benefit from such evidence because it will be gone. Even in the case of a terrorist, where national security is at stake, the evidence could theoretically be gone after one year. This is an abomination. The fact is that it happens to be in compliance with EU law, which I respect. Ireland is a democracy. I accept that the Minister finds herself in a difficult position. I emphasise that this is no criticism of her or her hard-working officials, some of whom kindly addressed us in a private session at the joint committee, and were very frank, forthright and fair. This is no criticism of the Government, but it is a criticism in the context of what we do next. I just cannot accept this in its current format until I am absolutely convinced and reassured that there is no alternative.
Like most, if not all, people in here, I value liberal thinking and liberal treatment, but in spite of my liberal leanings, there can be countervailing rights. Sometimes I put my liberal leanings in abeyance if I think we can help our country convict and put away murderers and rapists. That is at a different level of countervailing rights to privacy, for which I have so much respect and for which I would fight.
I thank the Acting Chairperson for his indulgence. The bigger right of assisting prosecution teams in convicting rapists and murderers must take precedence in order to protect our country, people and children.
Cuirim fáilte roimh an Aire, agus an seal labhairt ar an mBille tábhachtach seo atá os ár gcomhair inniu. This Bill puts a focus on an issue that has long needed to be addressed by the Government, yet by the sound of things, the Government has failed to effectively deal with it. A proper approach to law reform in this area requires thoughtful and considered planning. I accept that there are great complexities in data retention, but with the right approach these difficulties can be resolved and overcome.
I am yet to be convinced otherwise, but as I understand it the Government is indicating that this Bill is unlikely to provide the solution that is ultimately required. That message will hardly instil confidence where it is most needed: the justice committee; the justice system; the Garda; and the general population. Indeed, the Data Protection Commission has concerns arising from data protection audits of these proposals. The EU law regarding data protection is problematic because of its strict adherence to the idea that only threats to national security merit the retention of data. This outlook could lead to serious criminals evading justice. An Garda Síochána is on record as stating that data retention is a challenge for it and for the police forces in many other European states that are investigating crime. In its submission to the joint committee, the Garda Síochána stated:
Under the scheme of the Bill, whilst AGS will be able to utilise Preservation and Production Orders to secure evidence, this process will be forward-looking and not retrospective. This will cause significant difficulties in criminal investigations, which usually commence post incident. However, this restriction does not arise in relation to matters relating to National Security matters.
There is a balance to be struck between EU and domestic law, between civil liberties and the need for justice. A stable regime is required to provide certainty to prosecutors, the courts, the Garda and ordinary citizens. For the front-line agencies, there is little in the Bill that sets out the when, how and where of data retention. Improvising in these areas is not something these agencies should be asked to do. The consequences of them getting it wrong are very worrying indeed.
The rights of ordinary citizens need to be heard right the way through this process. The Irish Council for Civil Liberties outlined a number of its concerns. It is clear that the Bill will lead to further legal uncertainty and legal challenge. Those directly affected deserve better than this. Furthermore, indiscriminate data retention with little legal certainty or process poses a great threat to privacy. Proper supervision of access arrangements is important but of course the best protection is always to not collate data in the first place - followed by collating it for specified reasons - with a clear legal basis and grounding. The Bill allows for a one-year retention period, which can be reviewed. This could see data being retained indefinitely, which is not a desirable outcome. The functions of the judge who grants access to this data must be expanded. Nonetheless, despite the Government's inertia, there is a clear need to address the issues that arise from this Bill.
Like other colleagues, I commit to working as hard as I can to ensure that it is got right. I do not think I could outline any more eloquently, comprehensively, or with the level of concern that Senator Martin outlined to the House. Moving forward through the process in this House, I hope we can get to the point where this legislation is as strong and positive as it so clearly needs to be.
I welcome the Minister. I will be brief. I do not want to rehash any of the key events that have resulted in us dealing with this legislation here today. I echo the concern at the lack of speed with which pre-legislative scrutiny was carried out in respect of the Bill. The Data Protection Commissioner only received a finalised version of the general scheme of the Bill less than 24 hours before appearing before the justice committee as part of the pre-legislative scrutiny process. I am uncomfortable with the speed at which that had to be done, although I understand that it was as a result of a reaction.
The Minister said it is an emergency measure in response to court rulings, and that there will be fuller reforms soon, following on from the general scheme of an amendment Bill that underwent pre-legislative scrutiny in 2017. The emergency Bill also does not meet conditions of the Court of Justice of the European Union ruling, so would still be potentially illegal and open to legal challenge. Recommendations that emerged from the 2017 pre-legislative scrutiny process are not reflected in the Bill.
My main purpose in contributing is to put on record the intention behind some amendments we will table between now and Committee Stage. One relates to a sunset clause on the Bill. As the Minister has acknowledged, this Bill is an emergency measure, and fuller reform of this area needs to follow quickly. The idea then that this Bill would be introduced and allowed to operate indefinitely, until such reforms are ready, is unacceptable. It has been known since 2014 that our 2011 Data Retention Act was no longer in line with EU law, yet here we are in 2022, eight years later, rushing through emergency legislation to respond to a Court of Justice of the European Union ruling. Where was the urgency in reforming this over the past eight years? It is essential that a sunset clause is introduced to ensure that the Government maintains a sense of urgency around the fuller reform of our data retention law, and to ensure that flimsy legislation like this does not end up running on for years, as we know it may well do. A sunset clause is the minimum level of safeguard we need to put in place.
In terms of the definition of "national security", in order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measure and must indicate in what circumstances, and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary. These conditions are not met by the current legislation, which means that it is still illegal. The vague term "national security", which is not accompanied by a definition, cannot possibly provide the necessary reassurance.
We also intend to table amendments on the removal of the one-year rolling retention of data, which is still illegal under the Court of Justice of the European Union ruling. The court ruled that the duration of each data retention measure must be limited in time to what is strictly necessary and that such measures, while they can be renewed, cannot be systematic in nature.
Thus, each case must be individually assessed and the period of data retention should be prescribed specifically for the necessities of each case. The current mechanism of the Bill, which grants blanket one-year retention to all cases, is, therefore, blatantly illegal. It is, again, inexplicable that we would rush through emergency legislation to address an illegality and that an emergency Bill would itself be illegal. It is quite unbelievable that this House is being asked to do this and that we are being asked to waive proper parliamentary procedure to replace one form of illegality with another slightly diluted form of illegality. Special protections for journalists’ data is another area in which we intend to submit an amendment. It is a requirement under the European Convention on Human Rights, ECHR, that surveillance aimed at identifying journalistic sources should go through a heightened screening process, including prior independent judicial approval.
I hope we get time this week to have some level of scrutiny when we return to this Bill and also to the amendments that will be tabled in the House. We are obviously happy to engage between now and then if time permits.
I welcome the Minister to the House. The general data protection regulation, GDPR, often gets a bad rep but Europe should be rightly proud of the fact that we place a great emphasis on data protection and data privacy. I do not think anybody intended when GDPR was being designed that we would have seen a case like the Dwyer case where, essentially, the data privacy protection regimes would be used in the circumstances that happened. I have no doubt we will face many debates around the issues of data, data retention and how we use our data over the years ahead.
What we certainly do not want to see is a move towards a Chinese-type society which is, effectively, a surveillance society or, indeed, a US-type arrangement where the Government can access all of our data for particular reasons. Questions have to be asked, however. I would agree with what Senator Mullen said earlier around whether this was the intention of GDPR at a European level. Questions need to be asked about whether the various EU data privacy regulations need to be reviewed so that in circumstances like this concerning serious crime, national agencies are not inhibited in any way from investigating what happens.
I am conscious that this is a temporary piece of emergency legislation. I have some sympathy with Senator Ruane's view about a sunset clause on this. I agree with Senator Ward that it is important we have a comprehensive piece of legislation to address these questions to ensure we get the necessary limitations and proportionality in which everyone can have confidence. As Senator Ward said, it will require an ongoing monitoring of the retention and use of data that is gathered. There must be some concerns around getting that balance right, however. I would certainly have concerns around, for instance, the Department of Justice's approach to facial recognition technology and the recent public call that went out. It does not seem to be in line with the Government's artificial intelligence, AI, strategy, which very much puts human rights and an ethical framework at the basis of AI. I would, therefore, have certain concerns.
We also need to review the office of the Data Protection Commissioner, which the commissioner herself said is necessary. It is certainly my strong view that we should have three commissioners making some of the key decisions. I appreciate that these points are not perhaps directly related to the legislation but it speaks to the data protection and data privacy regime in which we need to operate.
What citizens need is an assurance that they will not be constantly monitored or subject to surveillance while at the same time have confidence that there will be the necessary investigation where a serious crime is committed. It is best to say that I am reluctantly supporting this legislation on the basis that emergency legislation is required, but a more comprehensive debate around data protection and data privacy is necessary.
I thank all Senators for their contributions. I will start with the last point and reassure Senators that this is not about mass surveillance or retaining data for indiscriminate purposes. From our point of view, what this Bill does is reduce the amount of data that can be retained in comparison with what is currently the case. It increases the number of safeguards of judicial oversight and other types of discretions in terms of An Garda Síochána. This is the very least we should have, to be honest, and this is the base from which we should be working.
I firmly believe, and it seems to be the view of the House, that a person's right to privacy should never overrule a person's right to safety, this country's national security or the right to ensure a person is brought to justice for committing a serious crime or, indeed, as Senator Ward and others said, to ensure that a person can be exonerated and that this type of information can be used to exclude somebody from a particular case. We all need to work hard, not just here in this Parliament but across the EU, to try to get this right.
I cannot stress enough how much I did not want to bring this legislation forward in this timeline. Many Senators mentioned the timeline and how this came about. We might look at the sequence of events. A Bill was drafted back in 2017 and we had the Oireachtas report, which was presented in 2018. We then had that significant case in 2019. A decision was taken at that point by the then Minister not to progress with the legislation because of the evolving nature of the various different rulings. I know that was not the case in some other countries such as France, Belgium and a few others where they changed their laws and must now change them again because they are not compliant with the most recent court ruling. We had changes to rulings as recently as October 2020 and then finally the Court of Justice of the European Union ruling on 5 April. It was through a case management hearing that we discovered that it was not likely to change in the upcoming Supreme Court ruling. I brought a memo to Cabinet the following week. I moved as quickly as I could, working closely with the Attorney General and engaging with the Data Protection Commission, DPC - just to assure colleagues - and the Joint Committee on Justice, although I appreciate not in a way that I nor any of my colleagues would like. Obviously, we are continuing to engage with the DPC.
As well as that, we have been engaging with the various different communications platforms, which wrote to me a number of weeks ago and were very concerned that if this legislation was not clarified and the Supreme Court ruling finalised, and if certain parts of the current Act lapsed, they would have no choice but to potentially get rid of all the data they had. Obviously, that was quite concerning and something we certainly did not want to happen.
Senator Mullen has left the Chamber but I reassure colleagues that there has been a huge amount of discussion at a European level, obviously, from the various court cases where we have strenuously tried to protect and uphold what we have in terms of our legal response but also at an EU level. At my most recent Justice and Home Affairs Council meeting last month in Luxembourg, we had a different item on the agenda. I raised directly with Commissioner Reynders the need to not tie the hands of any of our police services behind their backs for the sake of privacy where there seems to be that imbalance and was supported by a number of colleagues. I was reminded that it is not just about setting law at an EU level but that this is how the European courts are interpreting the human rights charters, not necessarily GDPR legislation. There is much more work we need to do. It is something on which I am absolutely committed to engaging further with my colleagues.
As I said, I think we are all of the same view that An Garda Síochána should be able to do its job. The Court of Justice of the European Union was very clear in what it said, which was that platforms cannot save data to investigate or prosecute serious offences or save certain types of data indiscriminately. We have gone as far as we possibly could with this Bill following legal advice from the Attorney General and his team. As I said, without it, I would have huge concerns about what data companies may or may not do because they feel they do not or would not have the clarity. This Bill provides a certainty and clarity for platforms at the same time.
Again, I commit to working with colleagues as we bring forward a general scheme later this year. We must obviously allow a much greater timescale in terms of engagement, not just with colleagues here and in the Dáil but with all those potentially impacted by this, including the various communications platforms, the DPC, An Garda Síochána and many others.
When I had this debate with colleagues in the Dáil, my biggest concern was the sunset clause. One might say there is a slight chance it will happen, but a sunset clause means everything in this would fall should a new Bill not be enacted within that timeframe. We all know things happen in politics, intended or not, and I have a concern that should a new Bill not be enacted and the sunset clause lapse, we would find ourselves in the position we are potentially in if we do not do this now, in that these measures would lapse and there would be uncertainty for service providers and An Garda Síochána.
I absolutely commit to the general scheme by the end of this year, progressing new legislation while working with our European colleagues to try to identify how we can deal with some of the implications of this, in particular when it comes to being able to investigate and prosecute serious crime.
I thank colleagues. We all want to get the balance right between protecting people's personal rights and privacy while protecting people's rights to security and safety. I look forward to working with colleagues to ensure we get that balance.
Question put and agreed to.
When is it proposed to take Committee Stage?
Dé Céadaoin.
Is it this Wednesday?
Dé Céadaoin seo chugainn, yes.
Is that agreed? Agreed. I thank the Minister for coming in and wish her well on her good news.
Committee Stage ordered for Wednesday, 13 July 2022.