This Bill was referred to the Select Committee on Finance, Public Expenditure and Reform and Taoiseach by Order of the Dáil on 8 November 2018. Subject to the agreement of the committee, if the Committee Stage proceedings have not concluded by 1 p.m., it is proposed that the meeting will be adjourned at that time. Is that agreed? Agreed.
Data Sharing and Governance Bill 2018: Committee Stage
Sections 1 to 6, inclusive, agreed to.
SECTION 7
Amendments Nos. 1 to 3, inclusive, are related and will be discussed together.
I move amendment No 1:
In page 10, lines 8 to 10, to delete all words from and including "excepting" in line 8 down to and including "data" in line 10.
These are technical amendments to section 7 concerning the interaction of this Bill with the Social Welfare Consolidation Act 2005. Members will be aware there was substantial discussion in the Seanad on the application of this Bill to the special categories of personal data specified in Article 9 of the GDPR. This is in respect of personal data revealing a person's racial or ethnic origin, political opinions, religious beliefs or trade union membership, as well as their genetic and biometric data and data concerning their health, sex life and sexual orientation. On foot of this, the Seanad agreed an amendment which inserted a new section, section 5, which specifically prohibits the use of this legislation to share the special category data referred to. I also accepted a number of amendments to section 7 that provide that in the event of any part of the public service identity constituted special category data it would not be possible to share that data under this Bill.
Having discussed the amendments further with the Office of the Attorney General, I am proposing a technical amendment to this section. Amendments Nos. 1 and 2 propose to delete the wording agreed in the Seanad and replace it with the wording proposed in amendment No. 3. The purpose of this wording is to create a specific definition of the public service identity for the purposes of this Bill that specifically excludes those special category data referred to. This has the same effect as provided for in the wording I am proposing be deleted but it has the advantage of making the application of the Bill to the public service identity easier to understand.
I ask the committee to support these amendments.
As mentioned by the Minister of State, amendments Nos. 1 and 2 are amendments agreed to by the Government in the Seanad. The Minister is now proposing to delete the wording of those amendments and to substitute it with the wording proposed in amendment No. 3. I do not understand the need for this change. The Minister of State said it is being done on the basis of advice he received from the Attorney General. Amendment No. 1 seeks to delete the words "excepting such parts of that public service identity which constitutes special categories of personal data" and amendment No. 2 seeks to delete "compliant with Article 9 of GDPR". Amendment No. 3 provides for a definition of "specified body" and "public service identity", which is already provided for in section 262 of the Act of 2005. I ask the Minister of State to explain how what is proposed in amendment No. 3 caters for what is being deleted by amendments Nos. 1 and 2.
We wanted to avoid any contradiction in the wording, especially considering the length of the deliberations in the Seanad. We also wanted to avoid a conflict with the Social Welfare Consolidation Act 2005. Having reflected on the matter and wanting to take on board the spirit of what was agreed to in the Seanad, we have decided to remove the wording as proposed in amendments Nos. 1 and 2 and go for a comprehensive measure in amendment No. 3. The most important line of that amendment, that the section will not include a reference to special categories of personal data, makes it explicit what the Bill will not include. The amendments are essentially a cleaning-up exercise by removing some wording in the first two amendments and replacing it in the third amendment.
The Minister of State is proposing to remove the wording on compliance with Article 9 of the GDPR. Special categories of personal data are being removed from the Bill’s provisions. Will he provide some reassurances in that respect?
The Deputy's question is pertinent because section 2 refers to the special categories of personal data and information referred to in Article 9 of the GDPR. The GDPR is inherently built into the Bill. In later sections there are clear references to it. However, in the Seanad we wanted to take on board the spirit of what had been proposed by Senator Higgins. We have discussed the matter with the Attorney General. Rather than have any potential contradiction in the wording regarding the special categories of data which will be included, we have decided to go with a new worded section to remove any doubt.
I would be happier to leave the amendments which were accepted on Report Stage in the Seanad. During that debate the Minister of State said:
I am accepting amendment No. 8 in the names of Senators Higgins and Ruane because it strengthens the language after the word “identity”. Similarly with amendment No. 9, where the Senators have drawn attention to Article 9 of the GDPR, it strengthens the language and I am prepared to accept it.
I am happy to leave the section as passed by the Seanad. Accordingly, I will not be supporting amendments Nos. 1 to 3, inclusive. I would be happy if the Minister of State withdrew them and returned on Report Stage with a more detailed explanation as to why he is removing any reference to Article 9 of the GDPR. I would prefer to see the original Seanad amendments remain until we have that more detailed discussion.
As I said on Second Stage, I have no difficulty with having further discussions with my officials. However, what was attempted to be achieved in the Seanad, which we accepted in principle, is actually strengthened by amendment No. 3. In fact, it is stronger than the Seanad amendment. It removes any contradiction and explicitly refers to how the processing of special categories of data will take place. I am quite open to further consideration of the amendments on Report Stage. I believe, however, that amendment No. 3 strengthens the original Seanad Report Stage amendment with greater clarity and the removal of the potential contradiction in the wording.
I share the concerns expressed by Deputy Jonathan O'Brien. In the Seanad the Minister of State committed to including special categories of data and amendments which would strengthen the Bill. However, his new amendments provide that they will not be included. He should return on Report Stage to provide greater reassurance on that point.
I have already made my officials available. We have extended an open invitation for people to engage with us on the matter, but, unfortunately, it has not been taken up. However, I am more than willing to have that level of engagement before Report Stage. The debate in the Seanad should be looked at in the round, rather than in isolation. Article 9 of the GDPR is referred to specifically later in the Bill. I do not want a contradiction to emerge between section 7 and later sections which would make the Bill’s passage difficult. I am happy to revert to these amendments again on Report Stage.
I apologise for being late. The Minister of State has made the point that he has taken on board the spirit of the Seanad Report Stage amendments. How then does he explain why Senator Higgins disagrees that their spirit has been taken on board? Surely, the proposers of an amendment are in a better position to understand its spirit than the Government.
As I said before the Deputy came into the committee room, my officials and I have made ourselves available to all Members to discuss this matter. Regrettably, we have had no engagement on it.
In fairness, the amendments only came out the other day. I spent nine hours in the Dáil Chamber yesterday dealing with the abortion legislation, and ten the day before. We will take up the offer of engagement before Report Stage. For that reason, we will not accept the amendments.
I acknowledge that Deputy Jonathan O’Brien has engaged with us before on the pre-legislative process.
Amendment, by leave, withdrawn.
Amendments Nos. 2 and 3 not moved.
Amendments Nos. 4, 7, 10, 11, 15 and 16 are related and will be discussed together.
I move amendment No. 4:
In page 10, between lines 21 and 22, to insert the following:
“(6) A specified body may not make presentation of a public services card or access to a person’s public service identity the exclusive basis by which a person may verify their identity in order to conduct a transaction or access a service.”.
I want to say a few words on the amendment, so I can resubmit it and speak on it in the Chamber. I want to acknowledge the huge amount of work done by Senator Higgins and her efforts to improve the Bill. I acknowledged on Second Stage that the Minister and his Department engaged with Senator Higgins and either accepted many of her amendments or came back with Government amendments to improve the Bill. There are still a lot of issues with the Bill as passed by the Seanad and our amendments seek to address these issues.
Many of the Minister's amendments today seem to seek to row back on the amendments he accepted in the Seanad. The problems with the Bill that our amendments try to address mostly relate to how our Bill, particularly in section 7, interacts with the Social Welfare (Consolidation) Act 2005. The Minister of State, when summing up on Second Stage, dismissed our arguments in relation to this Act but this Bill will, whether the Minister of State admits it or not, consolidates the State's prolonged attempt to coerce the citizens to agree to large scale processing of their data - the Government's attempt to finally provide a legal basis for this kind of data processing. A number of times during the Seanad debate the Minister openly admitted that the Bill was an attempt to provide a legal basis for something that was already happening. He openly admitted that the kind of large scale processing of personal data that the State has been engaged in for many years is, basically, still illegal. The GDPR, however, will still make this type of coerced consent illegal even if the Government passes this Bill without our amendments and the State will still be open to considerable fines for violation of the GDPR.
Prior to the GDPR, EU Directive 95/46 made coerced consent, illegal and the law around consent has been strengthened further with GDPR. Article 4(11) of the GDPR clearly sets out one of the requirements of valid consent in that it must be "freely given". The Article 29 Working Party published guidelines on consent in November 2017 to guide people in relation to the consent requirements in GDPR. It states: "[A]s a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid." The data subject must, therefore, have control over his or her personal data and must not be coerced into consenting. Withholding a pension payment from an elderly woman for 18 months because she refused to register for a public services card is clearly coerced consent and a form of State coercion. Withholding basic State services from people because they object to the "once-only" principle and large scale, ad hoc data sharing, is coerced consent.
I hear many people say they have nothing to hide and they do not care who has access to their data, so why should we be worried about this. We would argue they are missing the point. The Minister and many others will say that the administration of public services needs to be efficient. I totally agree with that. However, there is a basic legal and human right to privacy, for example, in the EU Charter of Human Rights, and even if people do not really care about this right or say they have nothing to hide, it still exists. We cannot be selective in how we respect and observe basic human rights. The State should not act illegally, and we should not tolerate the State wilfully and openly acting illegally, even if we do not specifically put much pass on data privacy. We should not tolerate State coercion, in any forms.
When explaining his decision to refuse Senator Higgins’s same amendment in the Seanad, the Minister explained his decision by saying that he could not accept amendments that would be in direct conflict with provisions relating to the public services card set out in existing legislation, referring to the Social Welfare Consolidation Act 2005. However, amendments Nos. 4 and 7 are not in conflict with the Social Welfare Consolidation Act.
This Bill interacts in a hugely significant way with the Social Welfare Consolidation Act 2005. Section 247C of the Social Welfare Consolidation Act, as amended, states that the Minister may require any person receiving a benefit to satisfy the Minister as to his or her identity. This, of course, is a completely reasonable requirement. Section 247C(3) of the Act specifies the manner in which the Minister of State may be satisfied. It essentially describes the Standard Authentication Framework Environment 2, SAFE 2, verification process for registering a person’s identity. The problem we have with what the State is trying to do here, however, is that the aim of the public services card and the SAFE 2 process is not just verification. The aim is to coerce consent to data sharing and to enable the creation of a massive database of citizens’ data, otherwise known as the single customer view.
However, section 247C(3) of the Social Welfare Consolidation Act does not state that the purpose of going through the verification process, or SAFE 2, is to have one's data entered into a national database or that one's data will be shared with 150 other public, specified bodies. Section 247C(1) also makes it clear that the purpose of the verification process described is "to satisfy the Minister as to his or her identity". Once the person’s identity has been verified and once the Minister is satisfied as to the person’s identity, there is absolutely no legal basis for any more processing of that person’s data, unless one has obtained that person’s consent. This Bill is the Government’s way to establish this legal basis.
The point of our amendments Nos. 4, 7 and 16 is provide a solution to this practice of coercing consent, so that a person does not have to register for a public services card or agree to the processing of their public service identity dataset to access basic services. There has to be an alternative.
As I said, we do not have a problem with the SAFE 2 verification process per se. Verification of identity is obviously essential. However, the State has, with the public services card, created a bizarre situation where verification of identity leads inevitably to large scale sharing of personal data. We either need to separate the two, verification of identity and large scale data processing, or we need to provide an alternative to the public services card as a processing of verification.
Amendment No. 5 proposes to use the definition of data sharing provided by Digital Rights Ireland and Castlebridge Associates in their joint submission on the proposals for the Bill. One of the bigger problems with the Bill, as initiated, was that it failed to distinguish whether the sharing to which it referred was a case-by-case exchange of data for a specific purpose, or the creation of large scale databases like the single customer view with no specific purpose. The Minister introduced a Government amendment on Report Stage in the Seanad that I acknowledge went some way towards addressing the lack of specificity in terms of an understanding of what constitutes data sharing. Section 19 of the Bill, which states what a data sharing agreement shall contain, now states that the agreement must specify whether the information being shared relates to individual data subjects or classes of data subjects, and whether the sharing will be on a once-off or an ongoing basis.
We are dealing with amendments Nos. 4, 10, 11, 15 and 16.
Amendment No. 5 is as well.
Amendment No. 5 is separate.
My apologies. I thought they were all together. That is my mistake. We are dealing then with amendment Nos. 4, 7, 10,-----
-----11, 15 and 16.
I will finish up. I better not keep the committee here all day.
Amendments Nos. 10 and 15 are essentially the same as an amendment submitted previously by Senator Higgins. These amendments also try to address the problem of coerced consent. It is vital that the Bill gives people a mechanism to opt out of the "once-only" principle and to indicate that it would be their preference to give each of the specified bodies their data separately and that they do not find it a burden to provide their data to specified bodies on a case by case basis. In response to what was essentially the same amendment on Report Stage in the Seanad, the Minister provided three defences of the Government’s position, and none of them was relevant to the problem Senator Higgins was trying to address.
Firstly, he referred to the right to object to the processing of one’s data as specified in the GDPR. The right to object is not a remedy for coerced consent. If we do not provide the option for a person to opt out of ad hoc processing of his or her data, then that person will not be able to access public services or welfare services without first consenting to large scale reusing of his or her data. The right to object in the GDPR is a right to object to already existing processing. On the basis of this Bill, a person’s consent would, by that point, already have been coerced. The right to object as a process or mechanism to opt out of ad hoc processing or as a way to choose providing data to specified bodies would involve recourse to the courts system and the Data Protection Commission.
It is an odd suggestion from the Minister. He wants citizens to have to go through an arduous and difficult court process to access their basic human rights. In any case, the right to object would not even address the problem for coerced consent. With all due respect, listening to the Seanad debates, I am not sure if there is a full understanding around the problems of coerced consent. During that debate, the Minister said that when a person presents to the Department of Employment Affairs and Social Protection to apply for a social welfare payment that "it could be inferred that there is consent already contained in that by virtue of the fact that they have presented themselves to look for that particular support or service from the State”.
I mentioned this in my Second Stage speech and I mention it here again because it shows a fundamental failure to understand the nature of consent. That is a worrying statement as far as we are concerned. People apply for social welfare support because they are vulnerable and need help so it is strange that the Minister of State could extrapolate from that that at the same time these vulnerable people automatically consent to such widespread sharing of their data with approximately 150 other public bodies, via the single customer view database. It is amazing that the Minister of State who has responsibility for the biggest data sharing project in the history of the State should reveal such a fundamental understanding of the nature of consent.
In refusing to accept Senator Alice-Mary Higgins's amendment on the data sharing agreements that the Bill makes necessary, the Minister of State referred to: "A fairly protracted public consultation process that goes on well in advance of the agreements being set out." The public consultation process that the Minister of State mentioned is of course welcome but it is irrelevant to those people, no matter how rare they are, who would want to provide their data on a case by case basis. The public consultation process may permit the individuals in question some kind of input into the process on data sharing agreements and it may provide some welcome assurances on data processing but it would not address the specific problem of coerced consent.
The Minister of State rejected Senator Higgins's amendment on the basis that: "We do not want to have a situation where every single individual would have to be contacted in advance of the data being used." Maybe the Minister of State misunderstood the nature of Senator Higgins's amendment; if not we would see this as disingenuous. There would be no reason whatsoever to contact every single individual in advance of the data being used. Most people would prefer the once only principle and have no problem with their data being shared with all of the listed, specified bodies. Clearly most people will see it as easier, handier and vastly more efficient to just have to provide their data once but when a person's data is first collected, which at that moment is via registration for a public services card, but a person must also then be able to opt out of further processing without their consent. To make access to the State's services dependent on consent is a form of safe coercion.
This is a data sharing and governance Bill. Implicit in the Bill is a governance mechanism on the sharing of information which currently takes place without governance and the Deputy accepts that. At the very start of this Bill, it is important to say that data sharing is currently taking place in this country legitimately, which people want to take place, including at the birth of a child for instance. When a child is born, social welfare becomes aware of that child's existence and the parents can derive a social welfare payment from that. Nobody would expect that we would try to undermine that, neither should anybody expect that we would undermine a situation where a person works in seven or eight different elements of the public sector, that information on their pension entitlements should not be collated and that consent is inferred.
I stand over what I said in the Seanad which has been accurately referred to here. Public sector data sharing is taking place in this country for which there is no legal basis but which people want to continue because they want the services that derive from same. In order to make sure that we get a legal basis for that, we want to put a legal floor underneath it. In doing that, we have a data sharing governance board, which is referred to later on. That will give a statutory entitlement for people who have an issue around consent. When the data sharing agreements are being drawn up, and there will be many of them, they will have an entitlement to have their comments and referrals made.
On top of all of that, we continue to have the Data Protection Commissioner. The data sharing and governance board will be obliged under this law, if enacted, to publish the agreements in advance and to make sure that they are properly constructed and will then make reference to the Minister. What we are doing at the moment around the sharing of information for the development of public services is questionable and I acknowledge the Deputy's point on that.
We are signatories to the Tallinn Declaration and the once only principle and I recently met with a group of ordinary citizens recently. They were randomly selected by the Office of the Government Chief Information Officer and everybody universally agreed that when they are deriving public services, they feel this obligatory necessity to constantly provide the same level of information. In the once only principle, which is referred to as one of the bases for the construction of this Bill, we are giving people an opportunity, under a safe system, namely myGovID and others, through the public services card which the Deputy refers to, which is already in the Social Welfare Consolidation Act, 2005, and the Deputy will know from the debate on this in the Seanad that this Bill does not impact in any way on the Social Welfare Consolidation Act, 2005, nor can it.
Many of the services that we want to actually make sure are done, are being done already but we want to create a safe, legal mechanism for these. As I have said, one of those is the collation of pensions across the public sector. Nobody would be disagreeable to that. If a person moves from an education and training board to the Civil service and on to a semi-State company before working for a primary school, should he or she not have access to a system where all of their information can be shared? There are likely to be thousands of agreements put in place, overseen by a board which is laid out in the Bill. We have to ask ourselves if the current system is better or worse than having an independent governance board which will oversee the building, examination and implementation of all of those data sharing agreements which are currently taking place in a vacuum because there is no legal basis for it.
On consent, article 6 of the GDPR provides for consent as one of the lawful reasons for the processing of data. Other reasons include compliance with existing legal obligations. As well as that, in the Seanad we took on board Senator Higgins's suggestion on it being necessary and proportionate. I have no problem in saying here that it was a very good suggestion and it has now been incorporated into the Bill. The construct of what we are trying to do will be the thrust of these amendments. Do we want a safe mechanism for the collation of data for public services or do we not? It is currently taking place. Do we want an independent governance board that will oversee it? Do we want the public to have a right to have an involvement in the drawing up of agreements that will be put in place, have a public consultation and have those consultations published?
We do not have any of that at the moment. We have an ad hoc system which is not legally sound. A pensioner or a social welfare recipient such as the mother of a newborn child, should have access to the once only principle. It is only right and fair that a person who deals with the Government of Ireland has access to the once only principle when he or she engages with the Government on services that are governed by an independent governance board, set out in an agreement that is put in place after protracted public consultation. It is perfectly reasonable also that the Data Protection Commissioner will oversee the implementation of same.
I do not disagree with the option being there and it makes a lot of sense. We are saying that people should have the option of opting out. The vast majority of people will be very happy with what is being put in place but the option of opting out has to be given if people do not want to have their data shared. If a person does want the laborious job of having to go through the rigmarole of presenting their data to all of these different agencies on a singular basis they should have that right. There is a lot of sense to the-----
In terms of the principle of consent, a new mother would have to fill out a form saying that she has no problem with consent. That would actually be the net result of what we are doing and then there would be no point in having this in the first instance. The public service sharing of data that is happening as we speak will be completely undermined and not only for people who currently avail of public services. I would use the example of people in receipt of third level grants who may need to have information shared between Revenue and the Department of Employment Affairs and Social Protection. We will end up placing a major burden on the consumer of public services if we do not give a legal floor to what is currently taking place. I do not believe that Members of the Oireachtas want to create a scenario in which users of public service are inundated with bureaucratic overload. We would not be thanked for doing that.
I am not suggesting that we introduce a bureaucratic overload. The vast majority of the population will sign up to what the Government is creating and will agree to it.
The Deputy is asking that they will have to sign up to it.
All I am asking is that individuals will have the right to opt out.
The Deputy is asking, in effect, that individuals sign up to it. Let us say an individual is applying for a SUSI grant. The application could contain an element related to the Departments of Employment Affairs and Social Protection and Agriculture, Food and the Marine and an element related to the Revenue Commissioners. On the basis of what Deputy Wallace is suggesting, that individual might have to carry around all of those elements. I am not knocking the proposal for the sake of it because this is something that we discussed at length in the Seanad. We will have people in a bureaucratic swamp if we go down that road and we will undermine the principle of what we are trying to achieve here, which is to make legal the sharing of data between body A and body B. Everyone accepts that the situation that currently pertains is not acceptable but with this provision, we would end up putting people in a very difficult and ambiguous position. Pensioners in the public sector would be in a very difficult situation and I do not think anybody wants that. There are 320,000 people in receipt of various public sector pensions. The net result of the Deputy's amendment would be to place them in a very difficult legal position.
We can debate this further in the Chamber. I do not see why this would lead to additional bureaucracy. I do not see why we cannot put in place what the Government seeks while also giving the individual the right to opt out. Furthermore, we cannot do anything that contravenes the GDPR or we will end up in big trouble.
We have exhaustively gone through this with the Attorney General. All of the questions that Deputy Wallace asks have been clarified. As constituency Deputies we all deal with people who are applying for SUSI grants. Imagine what life would be like in the month of August if those people had bundles of forms under their arms going around the country from body A to body B to body C because there is no legal basis for those bodies to share information with one another.
That is not the issue.
We are not recommending that.
They will have to give written consent to each individual public body involved.
No. We will deal with this again in the Chamber.
The Minister of State is misunderstanding what is being proposed. What is being proposed is that if someone opts into the once-only principle and submits his or her data, there is an implied consent that the data can be shared. These amendments seek to ensure that there is some mechanism in place that allows an individual to opt out. Deputy Wallace will correct me if I am wrong but it is my understanding that there would be an implied consent once a person opts into the once-only principle and there would also be an option available to opt out. It is not the case that everybody will be walking around with bundles of paper under their arms for different bodies because once an individual gives his or her data, those data can be shared under the provisions of the Bill. However, there must be some opt-out provision for individuals who do not want their data to be shared.
A personal access portal would be put in place through which an individual could view what data have been shared and could also request that the data be deleted but that is after the fact. It is my understanding that an individual could only ask for data which had been shared to be deleted after they had already been shared. I can completely understand Deputy Wallace's position. In fact, Sinn Féin will support his amendments if he decides to press them. If he does not press them, a discussion of this issue will be needed before Report Stage. We are not legislative draftspersons and we do not have access to the Attorney General but we are telling the Government, as public representatives, that we want some mechanism put in place that would allow individuals to opt out of data sharing right across the system, if they so choose. We do not know how many people would opt out. It could be a very small number but the option should be available.
I am not trying to dismiss the concerns of Deputies Wallace and Jonathan O'Brien. I, too, have legitimate concerns, particularly about the way data are being handled in the private sector. There have been recent examples of problems in that area. Deputy Wallace has done a lot of very positive work on the penalty points issue, for example. Imagine a situation where a driver would not give his or her consent to have penalty points information shared between one arm of the State and another, namely, between the Department of Transport, Tourism and Sport and An Garda Síochána. No one would want this but we could have a situation whereby an individual does not consent to have his or her penalty points data shared between An Garda Síochána, via a garda on the side of the road, and the driver licensing authority. Under the amendment that Deputy Wallace has asked me to accept, we could have a ridiculous scenario where an individual does not give consent to or seeks to withdraw consent from one public body sharing information with another. We could also have another ridiculous scenario in which a person who is not tax compliant does not give consent to the sharing of his or her data between agencies of the State. Bodies such as the Departments of Employment Affairs and Social Protection and Agriculture, Food and the Marine as well as other State bodies responsible for payments would not have access to that information. This could also include the sheriff's office, the Companies Registration Office, CRO, and any other arm of the State that could be affected by financial fraud. Revenue is currently in a position to share information but under this provision the ridiculous situation would arise whereby we tie the hands of gardaí on the side of the road, the Revenue Commissioners and so on. I cannot accept these amendments on that basis.
I do not believe the scenario outlined would happen but I find it interesting that the Minister of State mentioned penalty points because that reminds me of the PULSE system, about which I have serious reservations. I met a man last Sunday who was stopped at a checkpoint about six years ago. An individual who was in the car with him happened to be a suspected dissident IRA member. The information went up onto the PULSE system but he knew nothing about it. He discovered very recently that his name was on PULSE because he was in a car with a person who was suspected of being engaged in illegal activity. How mad is that?
I support the amendments. The argument made by the Minister of State regarding penalty points is spurious. It is clearly not the intention of Deputy Wallace that provision can be made for that.
It may not be the intention but that would be the net outcome of the change.
In that case, let us draft it appropriately to ensure it does not apply in instances where the sharing of information is necessary. Clearly someone should not have the ability to refuse consent in such circumstances but in other cases, we should provide for an effective opt-out. We must make that real and ensure that people are giving informed consent and that they know what will happen to their data. The essential idea of a one line sign-off and then an opt-out is a good way to achieve that.
I will ask a rhetorical question. Who is going to consent in this type of arrangement?
There will probably be thousands of these agreements. How many does the Deputy suppose would consent to data sharing agreements with the Revenue Commissioners and other agencies on that basis?
I believe a rhetorical question is one that does not seek an answer.
Perhaps the Deputy might like to enlighten me on how many people he would expect not to agree to such agreements.
The point is that people would not be allowed to opt out.
That is not where we are going with these amendments.
It is the net result.
I have looked at the amendments tabled by Deputies Wallace and Jonathan O'Brien. Deputy Jonathan O'Brien's says, "A public body may disclose personal data to another public body". The full wording suggests it would be done on a case by case basis.
It is not a perfect amendment. We tabled it to have this discussion. We are saying express consent would have to be received from a data subject before the data would be shared with certain public bodies. Obviously, there is an issue in terms of the data to be shared with the Garda or the Revenue Commissioners. We need some mechanism in that regard.
From the amendment as drafted, it appears that on each occasion express consent would be required. On the amendments which deal with consent, the Minister of State has given a reasonable explanation of the practical effect of such changes in the case of particular State agencies. It is incumbent on members to bring forward amendments to provide for an effective opt-out, where possible, but it would have to be balanced with the practical requirements of the different agencies of the State which the Minister of State has mentioned.
Amendments Nos. 4 and 16 in the names of Deputies Wallace and Clare Daly are reasonable in their drafting. They would mean that a public services card or access to a person's public service identity could not be the exclusive basis for the purposes of verification. That is reasonable in conducting a transaction or seeking access to a service. I know that there have been difficulties with identity cards. Requiring a public services card could be exclusionary. Amendments Nos. 4 and 16 are reasonable and I would like to hear what the Minister of State has to say about them. I know that we have primarily discussed the other matter, but amendments Nos. 4 and 16 are included in this grouping and we have not discussed them.
To reply to Deputy Jack Chambers, it is up to each service provider. The Bill makes it clear that it is up to each service provider to use the mechanism it believes is the most appropriate to determine the identity of the data subject, customer or citizen. If I were to accept the amendment in the names of Deputies Wallace and Clare Daly on the issue, I would undermine this and it would be in direct conflict with other existing legislation which would then have to be unwound as otherwise it would be unenforceable. Other legislation, including the Social Welfare Consolidation Act 2005 introduced by a previous Government, would be made unworkable because, as identified in that Act, use of particular mechanisms such as the public services card has been specified for certain services. It is not the intention of this Bill to prescribe what should be used and, as importantly, it is not its intent to prescribe what should not be used. We are not prescribing what an individual service provider must or must not use. That is not the intent of the Bill; it is a matter for each individual service provider to determine. It is also up to each individual service provider to seek legislation, if required, to put in place the mechanism it wishes to use. It will be up to each service provider to have regard to the Bill, particularly in the context of data sharing arrangements and the consultation that will have to take place on them. On that basis, I cannot accept the amendments. They would put the Bill in direct conflict with existing legislation as specific ways by which data must be collected have been spelled out for service providers. For instance, a family farm uses a herd number. I cannot state in this Bill that from here on herd numbers cannot be collected or used as an identifier, any more than I can say the public services card cannot be used.
If the Minister of State looks at the actual wording of amendment No. 4, he will see it reads, "A specified body may not make presentation of a public services card or access to a person’s public service identity the exclusive basis by which a person may verify their identity". That language gives flexibility to allow the public services card to be used where provision of an additional form of identity is also allowed. Deputy Wallace has focused mainly on the other aspects of the amendments in the grouping. Does he want to say anything about this matter?
I am okay for the moment. We will address the points the Minister of State is making and take them on board. Perhaps it might need to be a little tighter. Some of the things the Minister of State says I am saying are things I do not want to say. Consent to data sharing must be freely given according to the GDPR. That is at the core of much of what we are trying to get around. We will look at the amendment again and reintroduce it in the Chamber.
I will add a point on law enforcement information being shared. As far as I know, that matter is covered in the Data Protection Act 2018 which transposed the law enforcement directive. That Act deals with the area and explains the circumstances in which law enforcement information can be shared with other necessary bodies. Nothing that is being proposed would undo it.
We have had a good discussion. To go back to what Deputy Jack Chambers said, if we were in any way to undermine the public services card, as the amendment would because it would prevent it from being used as an exclusive means to verify identity, where would it leave the people who are using it to access free travel? I do not think that is the intention.
As I said in the earlier part of the debate, Article 6 of the GDPR provides for consent as one element, but it also provides for compliance with legal obligations as set out in law. In addition, it should also be noted that under the GDPR, public bodies should not rely on consent as the lawful basis for processing a person's data. There are other elements that have to be relied on in the processing of data. Consent is one, but it is not the sole element. Compliance with the law is also one. I am not suggesting, as I do not think anybody else here is, that we should not have a law that allows it to be the case.
The Minister of State is talking about compliance with the law. He is asking what would happen to people who are already using the card for various purposes. We are not convinced that the card is legal. Saying it would cause problems if people who already use the card for various purposes could no longer use it does not stack up, if it is illegal.
Is the Deputy withdrawing amendment No. 4?
If I press it, will I be allowed to reintroduce it on Report Stage?
I understand the Deputy would be allowed to do so.
As long as an issue is mentioned on Committee Stage, it can be raised on Report Stage.
Amendment put:
The Committee divided: Tá, 3; Níl, 2.
Tá
- Chambers, Jack.
- Murphy, Paul.
- O'Brien, Jonathan.
Níl
- Burke, Peter.
- O'Donovan, Patrick.
Amendment declared carried.
Question proposed: "That section 7, as amended, stand part of the Bill."
It is my intention to bring an amendment on Report Stage.
Question put and declared carried.
Section 8 agreed to.
SECTION 9
Amendments Nos. 5 and 6 are related and may be discussed together.
I move amendment No. 5:
In page 10, lines 32 and 33, to delete “means the disclosure of information, including personal data, by a public body to another public body” and substitute the following:
“is the execution and operation of defined processes for the exchange of information between one or more entities for the purpose of supporting the delivery of statutory public sector services, or the execution of obligations under EU law”.
I started on this before and I will start again. Amendment No. 5 proposes to use the definition of data sharing proposed by Digital Rights Ireland and Castlebridge Associates in their joint submission on proposals for the Bill. One of the bigger problems with the Bill as initiated was that it failed to clarify whether the sharing to which it referred was a case-by-case exchange of data for a specific purpose or the creation of large-scale databases like the single customer view with no specific purpose.
The Minister introduced a Government amendment on Report Stage in the Seanad that I acknowledge went some way towards addressing the lack of specificity around what constitutes data sharing. Section 19, which states what a data-sharing agreement shall contain, now states that the agreement must specify whether the information being shared relates to individual data subjects or classes of data subjects, and whether the sharing will be on a once-off or an ongoing basis. That is progress, even though these specifications or details might also be included in the definition of data sharing in section 9. The changes or improvements to this part of the Bill were a result of another amendment submitted by Senator Higgins who, like ourselves, was relying on the Digital Rights Ireland and Castlebridge Associates definition of data sharing.
In the Seanad the Minister said that a simple definition of data sharing is necessary without really explaining why simplicity in the definition is so important to him. This amendment proposes to define data sharing as a process, not just as a set of actions. The Bill's current definition is not very different from the original definition in the proposals for the Bill, which was just a circular statement essentially saying that data sharing is the sharing of data. We are proposing a definition that suggests a system which might be subject to governance. The definition of data sharing at the moment is broad to the extent that it will inevitably lead to further functional creep, as we have seen with the public services card and its expansion.
This is linked with amendment No. 6, is that correct?
Yes. Amendments Nos. 5 and 6 are related.
With regard to amendment No. 6, while data sharing is defined in the Bill, there is no definition of data governance, which is odd. In their submission on the proposals for the Bill, Digital Rights Ireland and Castlebridge Associates, based in Wexford, highlighted this problem, particularly the fact that without such a definition there may be variances or discrepancies between Departments and between public bodies. These discrepancies may arise not only in how each body defines data governance but maybe more importantly on how the principles of data governance are applied. Digital Rights Ireland and Castlebridge Associates, groups with considerable expertise in this area, believe there should be a clear, centralised, standard definition of the term in the Bill. We are offering the example they put forward in their joint submission as a possible definition. The definition they have suggested defines governance as the system that determines who defines the processes and methods of data sharing, what data may be shared, how often, to whom, and under what legislatively supported circumstances. They also make the point that governance must involve not only decision rights but also accountability to ensure the systems and processes under governance operate effectively.
Amendment No. 5 seeks to change the definition of data sharing in section 9. The definition of data sharing was the subject of considerable debate in the Seanad, and the proposed definition here is ambiguous. A simple, unambiguous definition of data sharing is required, and that is what we have provided for in the text of the Bill in consultation with the Attorney General.
Section 13 sets out the purposes for which data sharing can be carried out. This section was amended following debate in the Seanad to provide specific purposes. The wording proposed in this amendment directly conflicts with that section. Accordingly, I do not propose to accept the amendment.
Amendment No. 6 seeks to create a definition of data governance. While I do not have a problem with this is principle, the specific term is not used anywhere in the Bill and therefore does not need to be defined. As the Deputies know, we are establishing a data governance board under the legislation. Its functions are set out in section 46(1). One functions of the board, specified in section 46(1)(a), is to "advise the Minister in relation to the prescribing of rules, procedures and standards under section 64". This is a definition of governance. These rules, procedures and standards will in effect be the agreed-upon models which describe who can take what actions with what information and when, what methods can be used and under what circumstances. These are the questions the Deputies refer to in the proposed amendment. Unfortunately, because the term "data governance" is not specifically used in the Bill, I cannot accept the amendment.
Will Deputy Wallace press the amendment?
I will. There has been a lot of discussion about all this in the past 18 months or so. Digital Rights Ireland and Castlebridge Associates have proven that they know more about it than any of us. I am happy to be guided by them.
Amendment put and declared lost.
We will reintroduce an amendment on Report Stage.
Section 9 agreed to.
NEW SECTION
I move amendment No. 6:
In page 10, after line 39, to insert the following:
“Data governance: meaning
10. In this Act, “data governance” means a system of decision rights and accountabilities for information-related processes, executed according to agreed-upon models which describe
who can take what actions with what information, and when, under what circumstances, using what methods.”.
Amendment put and declared lost.
SECTION 10
Question proposed: "That section 10 stand part of the Bill."
I have a couple of questions about section 10. It deals with the meaning of "public body". Section 10(4) reads, “The Minister may, at the request of a body that would not otherwise be included in the definition of “public body” in subsection (1) and with the consent of the Minister of the Government in whom functions in relation to that body are vested, by order designate that body as a public body where”, and it goes on to provide cases in which the Minister may so designate, including cases where a body “is financed wholly or partly, whether directly or indirectly, by means of moneys provided, or loans made or guaranteed, by a Minister of the Government or the issue of shares held by or on behalf of a Minister of the Government”. Are we talking about private companies here?
Are we talking about private companies that may have a service contract with a Department or that provide a public service and are therefore being partly funded by Government through a contract? They are in receipt of public moneys.
No. We discussed this in the Seanad as well. Part of the reason for this section is that we do not know what other types of public bodies may be constructed in the future. Rather than having to come back and amend this legislation if a new public entity is established, we are allowing the situation to develop in the future. This is really a "just in case" provision. It is there just in case there are public bodies that are not covered by the Bill. As I say, this is a data-sharing and governance board between public bodies. Those public bodies are defined under the Bill. As such, private entities are not covered by this. That would be a public body sharing information with a private body, which is not the intent or provision of the Bill.
Under the Bill, is it possible that legally a Minister could designate a private company as a public body for the purpose of sharing data?
No. The Bill is explicit on this in the subsection to which the Deputy referred. It states:
The Minister may, at the request of a body that would not otherwise be included in the definition of “public body” in subsection (1) and with the consent of the Minister of the Government in whom functions in relation to that body are vested.
Such a body would have to have its functions vested with a Minister, and to do so, it would have to be constituted under an Act of the Oireachtas.
Question put and agreed to.
Sections 11 and 12 agreed to.
SECTION 13
I move amendment No. 7:
In page 14, to delete lines 14 and 15 and substitute the following:
“(I) as one non-mandatory means to verify the identity of a person, where the first or second mentioned public body is providing or proposes to provide a service to that person, without prejudice to a person’s right to verify their identity other than by the presentation of a public services card or access to that person’s public service identity;”.
Amendment put and declared lost.
I move amendment No. 8:
In page 15, between lines 7 and 8, to insert the following:
“(d) in a case in which the second mentioned public body is engaged for gain in the production, supply or distribution of goods or the provision of services, the use by that public body of the personal data could not lead to the distortion of competition in trade in those goods or services in the State or in any part of the State,”.
This amendment provides that public bodies may not share data where the body receiving the data is involved in commercial activity - it relates to the matter raised by Deputy Jonathan O'Brien - where the use of that data could give the body concerned a commercial advantage over other operators in the same market. It is a logical follow-on from the provision of section 10(3) that the Minister may exclude a public body involved in any commercial activity from being able to share data under this legislation. The proposal arises from an amendment proposed by Senator Higgins on Report State in the Seanad. I gave a commitment to her that I would propose an amendment to this effect when the Bill reached Committee Stage in the Dáil. Therefore, I ask that the committee would look favourably on the amendment.
Amendment agreed to.
Amendments Nos. 9 and 13 are related and may be discussed together.
I move amendment No. 9:
In page 15, to delete line 14 and substitute the following:
“(f) the disclosure of the personal data is—
(i) necessary for the performance of the functions in relation to which the information is being disclosed, and
(ii) proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subjects concerned.”.
A core requirement of GDPR is that any processing of personal data, including data sharing, is necessary and proportionate. This was discussed at length in the Seanad. I gave a commitment then that it would not exceed what is required. During the debate in the Seanad, several Members expressed a strong preference that wording of this legislation should reinforce the requirement under the GDPR. I accepted several amendments to this affect in sections 13 and 19. I now propose to strengthen the wording further with these amendments to sections 13 and 19.
Amendment No. 9 to section 13 sets out an explicit requirement that data sharing under this legislation shall not be lawful unless it is necessary for the performance of the functions of the public bodies concerned and that the disclosure of the information concerned is proportionate in the context of the performance of the functions of the public bodies concerned and the GDPR rights of the data subject whose personal information is being shared. This is why I will come back on Report Stage to the amendment lost by the Government. It will also give clarity to the Opposition that, in many cases, this strengthens the issues to which Deputy Wallace referred, with the tests of being necessary and proportionate. That is why I signalled my intention to the Acting Chairman my intention to revert to the amendment lost earlier on Report Stage.
Similarly, amendment No. 13 to section 19 requires that as part of a data-sharing agreement, the parties to that agreement must provide a statement setting out why the data sharing is necessary and proportionate. It is a test that will have to be passed when the data-sharing agreement is put out to public consultation and when the agreement is first drawn up.
The effect of these two amendments is to strengthen the obligation of the public bodies to ensure that any data sharing they carry out is necessary and proportionate and to provide greater clarity on what tests should be applied to achieve this. I ask the committee to support these amendments. It also outlines why I wish to return to the earlier amendment on Report Stage.
We are happy to support both amendments. They are consistent with the terminology relating to necessary and proportionate in the GDPR articles and the data protection legislation, and the Minister of State committed to the Seanad to do so.
Amendment agreed to.
I move amendment No. 10:
In page 15, between lines 14 and 15, to insert the following:
“(3) A mechanism shall be provided to allow a person to whom a service is being or is to be delivered by a public body to instruct that public body that they do not regard collection of their personal data by any public body directly or on a case by case basis as burdensome and in such an instance subsection (2)(ii)(III) shall not apply.”.
I put it to the Minister of State during the break earlier that the issue of the Revenue Commissioners and penalty points being in the public interest would not arise. GDPR allows for public interest issues. There is no obligation to consent on matters of public interest.
Amendment put and declared lost.
I will bring it back in on Report Stage.
Amendment No. 11 not moved.
Section 13, as amended, agreed to.
Sections 14 to 16, inclusive, agreed to.
SECTION 17
Amendments Nos. 12, 24 and 26 are related and may be discussed together.
I move amendment No. 12:
In page 17, lines 14 and 15, to delete “published and made available to any Oireachtas committee on request” and substitute “in writing”.
These are technical amendments which concern reporting requirements under the Bill. In the Seanad, I accepted an amendment to section 17 which would provide that an Oireachtas committee could request that the Minister furnish it with a copy of a data-sharing agreement made under this legislation. It is a good initiative as it allows the Houses of the Oireachtas as well as members of the public to have a say in any data-sharing agreement that will be published. Accepting this amendment had the unintended consequence of removing the original requirement under section 17 that the data-sharing agreements be made in writing. Therefore the purpose of the amendment is to reinstate the original wording that provides for this.
The provision to provide data-sharing agreements to an Oireachtas committee is better placed in section 60 which covers the Minister's obligation to publish all data-sharing agreements and lay them before the Houses of the Oireachtas. This is provided for in amendment No. 26. The expectation is that Members of the Oireachtas would also be able to make submissions during the consultation. As was pointed out in the Seanad, it is the norm in any legislation concerning submission of information to committees to exclude the Committees on Members' Interests, and the amendment provides for that.
On amendment No. 24, I accepted several amendments to section 52 regarding the Minister's reporting obligations under the Bill in the Seanad. This is technical in nature to improve the section's clarity and readability. Therefore I ask the committee to approve the amendments.
Why are the Committees on Members' Interests for the Dáil and Seanad excluded? The Minister of State said that it is normal practice but why is that the case?
I presume that it is a ruling of the Houses of the Oireachtas, based on the advice from the Attorney General. I can clarify on Report Stage that that is the ruling of the Houses of the Oireachtas, that is, our own rulings.
Amendment agreed to.
Section 17, as amended, agreed to.
Section 18 agreed to.
SECTION 19
I move amendment No. 13:
In page 18, to delete line 33 and substitute the following:
“(r) include in a schedule to the agreement a statement summarising the analysis of the parties in relation to the extent to which—
(i) the disclosure of the information is necessary for the performance of the functions in relation to which the information is being disclosed, and
(ii) the disclosure and safeguards applicable to that disclosure are proportionate in the context of the performance of those functions and the effects of the disclosure on the rights of the data subjects concerned.”.
Amendment agreed to.
Section 19, as amended, agreed to.
Section 20 agreed to.
SECTION 21
I move amendment No 14:
In page 20, to delete lines 23 and 24.
I will withdraw the amendment but I may propose a revised wording to section 21(6) of the Bill on Report Stage.
Amendment, by leave, withdrawn.
Section 21 agreed to.
Sections 22 to 36, inclusive, agreed to.
SECTION 37
I move amendment No. 15:
In page 32, between lines 28 and 29, to insert the following:
“(4) The Minister shall, when making an order under subsection (1), provide a mechanism to allow a person to whom a service is being or is to be delivered by a public body to instruct that public body that they do not regard collection of their personal data by any public body directly or on a case by case basis as burdensome and in such an instance subsection (3)(b) shall not apply.”.
Amendment put and declared lost.
I move amendment No. 16:
In page 33, between lines 17 and 18, to insert the following:
“(5) The Minister shall, when making an order under subsection (1), have regard to whether provision is made for a person’s right to verify their identity other than by the presentation of a public services card or access to that person’s public service identity.”.
Amendment put:
The Committee divided: Tá, 4; Níl, 3.
Tá
- Chambers, Jack.
- Murphy, Paul.
- O'Brien, Darragh.
- O'Brien, Jonathan.
Níl
- Burke, Peter.
- Neville, Tom.
- O'Donovan, Patrick.
Amendment declared carried.
Question proposed: "That section 37, as amended, stand part of the Bill."
I do not agree. I intend to bring forward an amendment on Report Stage.
Question put and declared carried.
Sections 38 to 43, inclusive, agreed to.
SECTION 44
Amendments Nos. 17 to 21, inclusive, are related and will be discussed together.
I move amendment No. 17:
In page 35, to delete line 23 and substitute the following:
“(c) view a copy of a data-sharing agreement under which his or her personal data has been disclosed between public bodies, and”.
These are a series of technical amendments to section 44, which provides for the establishment of a personal data access portal to allow citizens to see what personal data public bodies hold about them and the purpose for which it is used. On Report Stage in the Seanad, I accepted an amendment tabled by Senator Higgins to section 44(2)(d), that the portal would allow data subjects to view any data-sharing agreements used as a basis for data being shared. As said in the Seanad, this is important and I accepted it because it provides the basis for the sharing. Amendment No. 17 is a slightly revised version of the text proposed by Senator Higgins. This amendment moves the text to section 44(2)(c), which is a more appropriate location for the provision.
Amendment No. 18 deletes Senator Higgins' original text since it will be superseded if the text I propose in amendment No. 17 is accepted.
Amendments Nos. 19 to 21, inclusive, are technical amendments to insert references to the new section 44(2)(c) so that public bodies have a basis to provide the data-sharing agreement to the portal and that the provision of the data-sharing agreement would only occur on the request of the data subject. I ask members to accept the amendments.
Amendment agreed to.
I move amendment No. 18:
In page 35, to delete lines 27 and 28.
Amendment agreed to.
I move amendment No. 19:
In page 35, line 33, to delete “subsection (2)(a) and (b)” and substitute “subsection (2)(a), (b) and (c)”.
Amendment agreed to.
I move amendment No. 20:
In page 36, line 5, to delete “subsection (2)(a) or (b)” and substitute “subsection (2)(a), (b) or (c)”.
Amendment agreed to.
I move amendment No. 21:
In page 36, line 9, to delete “subsection (2)(a) or (b)” and substitute “subsection (2)(a), (b) or (c)”.
Amendment agreed to.
Section 44, as amended, agreed to.
Section 45 agreed to.
SECTION 46
Amendments Nos. 22 and 23 are related and may be discussed together.
I move amendment No. 22:
In page 37, to delete lines 21 and 22.
Amendment No. 22 removes the provision in section 46(6) that any contracts the data-sharing and governance board enters into in respect of consultancy shall be subject to public competition. This was an amendment to section 46 which was tabled and accepted in the Seanad. The Office of the Attorney General has since advised that it has significant issues with the provision. Public procurement law applies across the board to all public bodies and it is not the norm to specify in legislation that it applies to a particular body or type of contract. The Attorney General has advised that the inclusion of this provision could call into question whether procurement law applies to some bodies but not others. I know that would not be the intention of anybody here. We cannot have that situation so the provision must be deleted. I reassure the committee that the laws of public procurement apply to the data governance board in the same way that all the laws of the land would apply to such a body.
Amendment No. 23 is a technical amendment to section 47(6) concerning membership of the data governance board, to add the word "persons", which was inadvertently omitted from the text.
As the Minister of State said, this is a reversal and deletion of an amendment that he accepted in the Seanad. I suggest that the Minister of State withdraw amendment No. 22, subject to further discussion. It is an amendment to provide transparency. I understand, on the basis of the discussions and the agreement of the Minister of State to accept the amendment, that another amendment from Senator Higgins was then withdrawn. It was amendment No. 59 on, presumably, Committee Stage in the Seanad. Will the Minister of State agree to withdraw this now and have further discussion on Report Stage?
I also ask the Minister of State to withdraw amendment No. 22. We will support No. 23, but given that No. 22 reverses an amendment the Minister of State accepted in the Seanad, similar to those he withdrew previously, I ask him to withdraw this one for consistency. We can discuss it before Report Stage and he can always resubmit it then.
I will press the amendment. I accept the spirit of what Senator Higgins proposed. I am the Minister of State with responsibility for procurement. We want to avoid any situation where existing procurement contracts and contracts put in place through competitive practice, which are already laid out in frameworks and underpinned by European Union directives on procurement, would be in any way undermined by the proposed amendment. I said at the time that we would reflect on all the proposals that were made in the Seanad and bring forward proposals on Committee Stage where that would be necessary. I do not want a situation where we have legislation which is directly in conflict with the established practices of our procurement policies and EU directives on procurement. The procurement practices are laid out by the Office of Government Procurement and the procurement executive, who are accountable to me. I would not want to undermine the job that they do. I will press the amendment and, if we require further discussion on this on Report Stage, I would welcome that. I reiterate that my officials and those of the procurement section in my Department would be willing to speak to the Deputies and Senator if that signal is made.
The Minister of State mentioned existing contracts. Surely the legislation cannot be applied retrospectively to any existing framework or contract? If something has to be rolled over, the wording of the amendment is that they are subject to public competition. I am not sure how that would provide any specific directive with legislative consequences for the office of the Minister of State, the procurement process or even EU law. It simply mentions public competition. It is general, ambiguous wording. I am not sure how the retrospective element the Minister of State mentioned in his initial remarks would follow through.
The procurement of any services by the Government and public bodies is not specified in any legislation. We do not do that as a norm. To underpin a specific element of public procurement in specific legislation could reflect on other public procurement and suggest that there is somehow an issue with the legality of it. Rather than do that, the established practice laid out under EU procurement directives is the manner in which we will pursue all procurement across the board, whether in health, education, defence, the Office of Government Procurement or local authorities. They are all laid out on the same basis.
We have received advice from the Attorney General that singling out one element could infer a question about the legality of the others which I know, of course, is not what we intend. It is on that basis that I am seeking to delete lines 21 and 22.
I do not get from where the Minister of State is coming. We are talking about the functions of the board. The Bill reads "The board shall" and lists what its functions will be, of which No. 5 is, "The Minister may enter into an arrangement for the provision of consultancy, advice and other services to the board". The Minister of State is proposing to take out the line, "Any contracts in respect of consultancy, advice or other services to the board shall be subject to public competition". I do not see the issue. We are saying that, if a contract is to be entered into by the board for the provision of consultancy, advice or any other service, it will be subject to public competition. My understanding is it would actually complement the public procurement process.
This is what the Minister of State said in the Seanad:
Amendment No. 57 is an amendment to section 56 in respect of the functions of the Data Governance Board to provide [that the Minister may] enter into an arrangement for the provision of consultancy, advice and any other services to the board. This is a standard provision given to most boards. I would expect that the skill sets each member will bring to the board will be sufficient for it to carry out its functions internally most of the time. However, I foresee circumstances where it would appropriate for the board to seek external advice and assistance on specific matters. We discussed this during a previous debate on the Bill. This particularly arises where the board is developing data management rules, procedures and standards and may need to draw on specialised, technical advice on certain matters. Nobody would want a situation where we tie the hands of the board so it could not get external advice. I propose to accept amendment 58 [for this reason].
Perhaps the Minister of State might explain about the procurement process. We are saying if the boards enter into contracts for the provision of consultancy, advice and other services, those contracts would be subject to public competition. If we were to take out that line, would we not be saying the contracts would not have to go through the public procurement process and would not have to be subject to public competition and that the board could actually go to one individual and enter into a contract with him or her privately without having a public competition?
What we are saying is that the procurement of consultancy services which, as I said in the Seanad, may very well be necessary and legal and accounting services, if we do not have that skill set, would be subject to existing procurement law. Procurement across all agencies, Departments and public bodies is already carried out under a strict code, for which I am the Minister of State with responsibility. On the advice of the Attorney General, the net result could be perceived as calling into question the legality of everything else we procured. If committee members are in agreement that I make this amendment today, we can have a further discussion on the matter on Report Stage when I can provide further assurances for the Deputies, if they so wish. I again invite Deputies to engage with my Department. We do not specify in any other legislation where there is a necessity for the procurement of services, of which there are probably thousands, if not tens of thousands, that anything other than what is pre-determined in law would be the norm. The law on procurement is set out in EU directives and applied by the Office of Government Procurement in my Department and the procurement executive. The advice I have been given is that proceeding with provision this could call into question all other elements of procurement law set out in other legislation in which it is not reflected. I know that that is not the intention and that it certainly was not the intention in the Seanad. It is not my intention to do so either.
I do not accept that. I sit on the Committee of Public Accounts and one of the consistent findings in most of the Comptroller and Auditor General's reports concerns the failure to comply with public procurement law. It happens across all Departments where there is a failure in certain cases to comply with public procurement law. I see nothing in the Bill that it should be subject to public competition, contradicting existing procurement law. I do not see why there is that contradiction. Therefore, we will not be supporting the amendment.
I share Deputy Jonathan O'Brien's concerns. If the Minister of State has concerns about the clarity of other legislation, he could amend the particular line he is proposing to delete to allow it to fall within existing procurement law. Simply deleting it is not the answer when we know that the current guidelines are soft. As Deputy Jonathan O'Brien mentioned, there are huge issues that arise at the Committee of Public Accounts on a regular basis with a failure to comply with procurement law. Basic legislative interpretation means that we know that this is the function of the board and it relates specifically to it and the contracts it enters into. It does not go beyond any other aspect of procurement law. Someone could not make a challenge on the basis of section 46(6) because, if it does not reference them specifically and relate to them, one could not make that legislative interpretation. I am not sure where the Attorney General's advice follows through in that regard. We cannot interpret other legislation or another precedent elsewhere. Perhaps the Minister of State might amend the amendment and clarify the position on Report Stage but just deleting the lines and forget about the matter is inappropriate at this stage.
If the members are agreeable, if the amendment is accepted, I will revert to them on this issue on Report Stage when I will provide further clarification.
The Minster of State is a nice guy, but my trust levels are very low when it comes to Ministers.
The Deputy and I have had a lot of engagement and he knows that I have followed through on everything to which I have committed previously in the carrying out of legislation. If the committee is agreeable to the amendment, I will provide further clarification. If there is an amendment or insertion necessary that would not in any way conflict with how procurement law is currently carried out, and we can come up with a formula of words, then fine, but if we cannot do so, I do not want in any way to undermine existing procurement practices. If members are agreeable to the amendment, I will reflect on the issue with my officials. I again extend an invitation to them to engage with us.
I will agree that, if the Minister of State leaves in the lines, I will reflect on the issue and if he comes up with an alternative wording, I will be more than happy to vote in favour of that amendment.
As I think the Deputy is an honourable person, I will meet him halfway along the road.
The Minister of State should withdraw the amendment.
In the full knowledge that it may be my intention to bring back the exact amendment-----
We will study the wording and, if it is appropriate, we will support it.
Amendment, by leave, withdrawn.
Section 46 agreed to.
SECTION 47
I move amendment No. 23:
In page 38, line 1, after “2” to insert “persons”."
Amendment agreed to.
Section 47, as amended, agreed to.
Sections 48 to 51, inclusive, agreed to.
NEW SECTION
I move amendment No. 24:
In page 40, between lines 18 and 19, to insert the following:
“Reporting
52. (1) The Board shall, not later than 30 June in each year, prepare and submit to the Minister a report on—
(a) the performance by it of its functions under this Act, and
(b) the matters, if any, on which advices have been provided to it by the committees, if any, established under section 48(1),
in the immediately preceding year, or, in the case of the period from the date the Board is first appointed to the next following 30 June, that period.
(2) The Minister shall, as soon as may be after receiving a report under subsection (1)—
(a) cause copies of it to be laid before each House of the Oireachtas, and
(b) publish a copy of it on a publicly accessible website.”."
Amendment agreed to.
Section 52 deleted.
Sections 53 and 54 agreed to.
SECTION 55
I move amendment No. 25:
In page 41, to delete lines 26 to 28 and substitute the following:
“(iii) is satisfied that the agreement is consistent with Article 5(1) of the General Data Protection Regulation,”.
I would like to have a bit of discussion on this amendment. It is diluting some of the safeguards that were secured in the Seanad amendments. The main impact of this change in the wording is that the condition of necessity and proportionality - this is my reading of it - is being removed. The reason it is being removed is not 100% certain. We have already accepted amendments from the Minister of State that insert "necessary and proportionate" into the wording. Could the Minister of State talk me through the amendment?
I accepted the amendment in the Seanad that the data protection officers and public bodies party to a data sharing agreement would certify that the agreement is in accordance with the principle of data protection as articulated in Article 5 of the GDPR. This is a technical amendment to tidy up the wording and to make specific reference to Article 5.1 of the GDPR, where the data protection principles are set out. Basically this is referencing the GDPR. It is strengthening the fact that while the GDPR is there, and we have to have regard to it, it is really just underlining the fact that we have to have regard to it. Does it in any way change the construct of the Bill? No. Does it make it any stronger than it was before we drafted it? Probably not. What it does is satisfy any doubt that might exist that there is not enough reference to the GDPR. It is on that basis that we are going ahead with it.
That is okay.
Amendment agreed to.
Section 55, as amended, agreed to.
Sections 56 to 59, inclusive, agreed to.
SECTION 60
I move amendment No. 26:
In page 44, between lines 26 and 27, to insert the following:
“(6) The Minister shall, on request from a Committee, send a copy of a data-sharing agreement received by him or her under subsection (1) to that Committee.
(7) In subsection (6), “Committee” means a Committee appointed by either House of the Oireachtas or jointly by both Houses of the Oireachtas, other than—
(a) the Committee on Members’ Interests of Dáil Éireann or the Committee on Members’ Interests of Seanad Éireann, or
(b) a subcommittee of a Committee referred to in paragraph (a).”.
Amendment agreed to.
Section 60, as amended, agreed to.
Sections 61 to 71, inclusive, agreed to.
NEW SECTION
Amendments Nos. 27 and 30 are related and may be discussed together.
I move amendment No. 27:
In page 50, between lines 6 and 7, to insert the following:
“Amendment of Act of 1997
72. Section 917D of the Act of 1997 is amended in subsection (1) by the substitution of the following definition for the definition of “digital signature”:
“ ‘digital signature’ in relation to a person, means—
(a) a qualified certificate (within the meaning of the Electronic Commerce Act 2000) provided to the person by the Revenue Commissioners (or a person appointed in that behalf by the Revenue Commissioners), and
(b) an advanced electronic signature (within the meaning of that Act) generated using the qualified certificate referred to in paragraph (a);”.”.
These are technical amendments. Amendment No. 27 concerns the Revenue Online Service, ROS, digital signatures. These signatures are used extensively by businesses for the filing and payment of tax and duties. I am proposing an amendment to the Taxes Consolidation Act of 1997, TCA, that will allow for other public bodies to accept ROS signatures when providing services to the public. This should allow for a greater number of transactions between businesses and public bodies to be carried out online in line with our ambitions to digitise public services to the greatest extent possible. A consequential technical amendment is also required to the Long Title of the Bill to refer to the proposed amendment of the TCA. This is provided for in amendment No. 30. These amendments will bring substantial benefits in terms of the range of additional services that could be offered to online businesses. I ask that the committee support them.
Amendment agreed to.
Sections 72 and 73 agreed to.
NEW SECTION
Amendments Nos. 28 and 31 are related and may be discussed together.
I move amendment No. 28:
In page 50, after line 17, to insert the following:
“Amendment of National Shared Services Office Act 2017
74. Section 6 of the National Shared Services Office Act 2017 is amended in subsection (1) by the substitution of “an Oifig Náisiúnta Seirbhísí Comhroinnte” for “Oifig Náisiúnta Seirbhísí Comhroinnte”.”.
This is a technical amendment to section 6 of the National Shared Services Office Act 2007 to correct an error in the Irish translation of the English name of the office. The English version of the title in section 6(1) is the National Shared Services Office; the definite article, "the", is included. In the Irish language version provided, Oifig Náisiúnta Seirbhísí Comhroinnte, the definite article was omitted. There are two articles in use in the English language, the definite article, "the", and the indefinite article, "a" or "an". As a result, omitting the definite article in English - this is like my leaving certificate modh coinníolach - does not render the noun indefinite. The use of the indefinite article serves for that purpose. For this reason, the definite article is regularly omitted in titles in English as it allows for the use of a more concise title in signage, for example the "Department of Education and Skills" or the title head of section 6. However, this is not possible in the Irish language as an omission of the definite article automatically renders a noun indefinite. The article "the" is clearly intended and expressed in the English version of the title in section 6(1) but in the Irish-language title, the article "an" is omitted. The purpose of the amendment is to correct this oversight.
An amendment is also required to the Long Title of the Bill to reflect that it provides an amendment to the National Shared Services Office Act 2017. This is provided for in amendment No. 31, which also provides for the insertion of a reference to the amendment to the Ministers and Secretaries Act of 2011 in the Long Title of the Bill. This relates to section 72 of the Bill, which provides for an amendment to section 17(a) of the Ministers and Secretaries Act to allow the Minister for Public Expenditure and Reform to collect and process public service information under Part 5 of this Bill. This reference should have been included in the Long Title when the Bill was first published but was omitted due to an oversight. The amendment is technical in nature and is intended to correct this.
Amendment agreed to.
SCHEDULE
I move amendment No. 29:
In page 51, to delete line 18.
This is a technical amendment to delete the Dún Laoghaire Harbour Company from the Schedule. This Schedule lists those public bodies that are not subject to the legislation. In the main, these are commercial State-owned enterprises. As the members are no doubt aware, the Dún Laoghaire Harbour Company was dissolved on 3 October 2018 and its assets and liabilities transferred to Dún Laoghaire-Rathdown County Council. Since the company is no longer in existence, it is appropriate to remove the reference from the schedule.
Amendment agreed to.
Schedule, as amended, agreed to.
TITLE
I move amendment No. 30:
In page 7, line 9, after “Board;” to insert “to amend the Taxes Consolidation Act 1997;”.
Amendment agreed to.
I move amendment No. 31:
In page 7, line 9, after “2005;” to insert the following:
“to amend the Ministers and Secretaries (Amendment) Act 2011; to amend the National Shared Services Office Act 2017;”.
Amendment agreed to.
Title, as amended, agreed to.
Bill reported with amendments.