Skip to main content
Normal View

Select Committee on Justice and Equality debate -
Thursday, 3 May 2018

Data Protection Bill 2018: Committee Stage (Resumed)

I remind members that all mobile phones must be switched off as they interfere with the recording and broadcasting equipment.

We are resuming consideration of Committee Stage of the Data Protection Bill 2018. I welcome the Minister for Justice and Equality, Deputy Charles Flanagan, and his officials. We will endeavour to conclude Committee Stage this evening, if at all possible.

NEW SECTIONS

Amendments Nos. 50, 51 and 65 are related and may be discussed together.

I move amendment No. 50:

In page 28, between lines 35 and 36, to insert the following:

“Communication with data subjects by political parties, candidates for and holders of certain elective political offices

38. (1) A specified person may, in the course of that person’s electoral activities in the State, use the personal data of a data subject for the purpose of communicating in writing (including by way of newsletter or circular) with the data subject.

(2) Communicating in accordance with subsection (1) shall, for the purposes of Article 6(1)(e), be considered to be the performance of a task carried out in the public interest.

(3) In this section, “specified person” means—

(a) a political party,

(b) a member of either House of the Oireachtas, the European Parliament or a local authority, or

(c) a candidate for election to the office of President of Ireland or for membership of either House of the Oireachtas, the European Parliament or a local authority.

(4) In this section and in sections 45, 55 and 56, “electoral activities” includes the dissemination of information, including information as to a person’s activities and policies, that might reasonably be of interest to electors.”.

During the debate on Second Stage I stated that I was minded to introduce new provisions to put in place a robust legal basis for the making of representations by Members of the Houses of the Oireachtas and members of local authorities. Assisting constituents by making representations and requests on their behalf is a valuable as well as a time-honoured aspect of our democratic system. Amendment No. 50 introduces a new section that will facilitate specified persons in using personal data in the course of their electoral activities in the State for the purpose of communicating with data subjects. Under subsection (2), such communication is considered to be the performance of a task being carried out in the public interest.

Amendment No. 51 introduces a new section that will provide a robust legal basis for the making of representations on behalf of individuals. Where special categories of personal data are involved, subsection (3) will require that measures to limit access to the data be taken in order to prevent unauthorised consultation, alteration, disclosure or even erasure of data. Subsection (4) establishes a legal basis for responding to representations and requests received by public authorities and public bodies from elected representatives on behalf of data subjects.

The amendments cover the subject matter of amendment No. 65 tabled by Deputy Jim O'Callaghan. An issue that remains under consideration in my Department and the Department of Housing, Planning and Local Government is the extent to which the Electoral Acts may need to be looked at and tweaked. If necessary, I will table an appropriate amendment on Report Stage in that regard. I am in consultation with the Department of Housing, Planning and Local Government.

I will support amendments Nos. 50 and 51. I welcome that the Minister has put down these amendments. It is appropriate that there is recognition of the important role that democracy plays and how it operates in this country. We are sometimes too self-deprecating as politicians. We are not simply politicians but elected representatives of the people, and the people are entitled to have their democracy protected. I will support amendments Nos. 50 and 51. I will withdraw amendment No. 65 in light of amendments Nos. 50 and 51 but I may bring forward Report Stage amendments relating to amendments Nos. 50 and 51 with the purpose of strengthening them since there are other aspects of democratic and electoral activity which need to be covered and are not covered in the Minister's amendment.

These amendments are a sop to politicians who are freaked out by the potential implications of the GDPR and are overstating them. Under the GDPR, the legitimate interest of communicating with constituents is covered but we are trying to say that any communication by a politician is in the public interest, which is a stretch, given some of the bile that is foisted on householders by politicians claiming that it is in the public interest. It is not necessary. The British authorities had something like amendment No. 50. I will not make a big deal about it here. My point is that political work is covered by "legitimate interest" and we do not need this extra clause. It is a stretch to say that some of the stuff that is sent out by politicians or would-be politicians is in the public interest because it is only in the interests of them getting re-elected.

I will not repeat that. That is exactly what I was going to say. The GDPR covers this. I do not know if this is necessary but it may not do any great harm. If people accept and consent to their data being used, provided they are stored safely and securely, that seems to be in compliance with the GDPR.

I welcome what Deputies have said. I take Deputy Daly's point though I do not particularly agree with it. She says she does not agree with the amendments but feels they are not necessary. That is the point raised by Deputy Ó Laoghaire too. I make the point, which the amendment covers, regarding the need to ensure that public representatives continue to do what is an important part of our duty. It is fair to say that it is within the public interest to make representations but I wonder about the respondent - the person or body to which the representation is made - and whether that might be regarded in the same way as we would view it. The amendment is important. I acknowledge what Deputy O'Callaghan said. If there are further issues which are not immediately apparent now that might be covered in amendment No. 65, then it is open to us all to come back on Report Stage. I acknowledge the importance of these amendments and welcome, if not the support, then the lack of opposition.

Amendment agreed to.

I move amendment No. 51:

In page 28, between lines 35 and 36, to insert the following:

“Processing of personal data and special categories of personal data by elected representatives

38. (1) For the purpose of enabling an elected representative to perform his or her functions as such a representative, the processing of personal data and special categories of personal data of a data subject by or on behalf of that representative shall be lawful where he or she receives a request or representation from the data subject or where, in accordance with subsection (2), he or she receives a request or representation from another person on behalf of the data subject.

(2) A person may make a request or representation on behalf of a data subject where the data subject—

(a) has given his or her consent to the making of the request or representation, as the case may be, or

(b) is, by reason of his or her physical or mental incapacity or age, unable to make a request or representation on his or her own behalf.

(3) In processing special categories of personal data under subsection (1), an elected representative shall impose limitations on access to that data to prevent unauthorised consultation, alteration, disclosure or erasure of that data.

(4) For the purpose referred to in subsection (1) and to the extent that disclosure is necessary and proportionate to enable an elected representative to deal with a request or representation referred to in that subsection, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of the data subject, it shall be lawful for a person to disclose to the representative or a person acting on his or her behalf personal data and special categories of personal data of a data subject who makes the request or representation, or on whose behalf the request or representation is made, as the case may be, to enable that representative respond to that request or representation.

(5) In this section, “elected representative” means—

(a) a member of either House of the Oireachtas,

(b) a member of the European Parliament,

(c) a member of a local authority.”.

Amendment put and declared carried.
SECTION 38

Amendments Nos. 52 to 56, inclusive, are being taken together. I invite Deputies Daly and Wallace to address these amendments.

I move amendment No. 52:

In page 29, line 2, to delete “and special categories of personal data”.

Much of the wording of section 38 is taken directly from the GDPR. I still think we have reason to be concerned about what the section might permit. Article 23 of the GDPR is the relevant part. It does not make an explicit distinction between the processing of personal and special categories of data but, throughout the GDPR, we are told that special categories of data should be treated with special care, hence we are attempting to separate it in amendment No. 56 and in the related amendments, for example, amendment No. 52, separating the two categories of data, personal data and "special categories of personal data".

I accept that Article 23 of the GDPR refers to the prevention, investigation, detection and prosecution of criminal offences, which is inserted in the Bill in section 38(b). The problem these amendments try to address relates to the scope the word "preventing" introduces with regard to criminal offences, particularly relating to special categories of personal data, such as religious beliefs, political opinion, ethnicity and so on. Section 38 of the Bill is not part of Part 5 of the Bill, which relates to processing of personal data for law enforcement purposes. The processing of data referred to in section 38 does not apply to An Garda Síochána, for example. The kind of processing proposed in section 38 might well be done by private companies. Section 38 essentially permits racial profiling if we include the processing of special categories of data. A body other than the Garda, for example, can profile a person based on ethnicity, religion and political opinions in the name of preventing, in the broadest sense, a criminal offence.

The last amendment is listed as being in section 39. It is actually section 38, as the line numbers would indicate. Under the GDPR in general, processing of personal data for purposes other than that for which they were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were collected in the first place. In other words, if one gives Twitter one's phone number to verify when one is connecting from a different device, it cannot start ringing that person about other stuff. That is straightforward but there is some wriggle room, according to Recital 50, on processing for purposes which are incompatible with the basis on which the data were initially collected. That can be allowed in two circumstances, first, where somebody gives consent for that to happen and, second, when the "processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest".

Section 38 tries to give effect to this wriggle room but it goes a little too far because it allows for the processing of both sensitive categories of data, including the serious stuff about political opinions, sexual orientation and so on, and the general personal data, for reasons other than the purposes for which it was collected, in order to prevent a threat to national security, to prevent, investigate or prosecute crimes or to get legal advice or legal proceedings.

In amendments Nos. 52, 53 and 55, we are proposing that further processing of personal data would be lawful for all of those reasons with the tweak that, rather than it being for preventing crime, we would use the tighter wording of "avoiding prejudicing the prevention" of crime. There is a further small tweak in amendment No. 53, that further processing would be allowed only if "having regard to the fundamental rights and legitimate interests of the data subject". It is necessary and proportionate for various crime and terror-fighting purposes.

The wording for our first amendment is taken from the British wording and our second amendment is a balancing requirement.

In amendment No. 56 we propose that further processing of very sensitive data would be permitted for all of the aforementioned except the prevention for crime. Our reason is that the GDPR does not apply to competent authorities like the Garda. What section 38 asks us to prove is a right for public bodies or companies to collect or compile databases on things like people's political opinions, trade union membership, religious beliefs and so on for the purposes of preventing crime, which is a bit broad.

For example, the Irish Naturalisation and Immigration Service, INIS, has loads of documentation and data about people. Let us say the Garda says there is crime afoot, it thinks it is linked to an area where there is a higher concentration of immigrants, for example, and it wants to hoover up all of the data, closed-circuit television, CCTV, surveillance and so on that is linked to an immigrant community in a particular area. That is racial profiling. It is very hard to see how information held by private companies or public bodies would be so important to prevent a crime yet outweigh the balance of people's individual rights and so on. That is where my colleague and I are coming from.

On balance, other information about political opinions could be important. Let us say there was an urgent situation to prevent a threat to public security and a bunch of neo-Nazis threatened to set off a bomb in Dublin and the Garda needed to get information from a social media site. Such a situation would not be hampered by our amendments. I wish to stress that our amendments do not prevent the reuse of personal data in general, just special category data. Names, phone numbers, addresses, emails and all of that can still be reused for a crime prevention aim. We do not seek to stop that but we want to prevent the more personal and sensitive information being abused.

We think the terminology “avoiding prejudicing the prevention, investigation or prosecution of” is stronger. Again, our amendment is based on the British wording. Anybody can say something is for the prevention of crime. A controversial CCTV scheme is being introduced on that basis even though there is no evidence that extra crime has taken place in that area. If there is an immediate likelihood of a criminal incident then that is a different situation. I have outlined our motivation for tabling our amendments.

Amendment No. 54 is a ministerial amendment and all of the other amendments were tabled by Deputies Clare Daly and Mick Wallace. I wish to advise everyone that if the question on amendment No. 54 is agreed, then amendment No. 55 cannot be moved as one is an alternative to the other.

Amendment No. 54 is merely a drafting amendment that seeks to insert the word "detecting" after the word "preventing", which will have the effect of bringing the wording into line with provisions elsewhere in the Bill. I note the point made by the Chairman regarding amendments Nos. 54 and 55. In any event, I am unable to accept amendments Nos. 52, 53, 55 and 56 and I shall give my reasons.

Amendment No. 53, in section 38, has a provision for the processing of personal data for certain public interest purposes for which the data were originally collected but only to the extent that such processing is necessary for and proportionate to the purpose, and that acts very much as a restrictor. The position is as follows. Statutory provisions that permit, or require, further notification or disclosure of personal data are to be found right across the Acts of the Oireachtas.

Let me give a brief example. Section 42 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 refers to a range of designated persons such as financial institutions, auditors and property service providers who know, may suspect or may have reasonable grounds to suspect, on the basis of information that they have, that another person has been or is engaged in an offence of money laundering or terrorist financing. Of course there is an obligation that such knowledge or suspicion on those grounds be reported not only to the Garda but also to Revenue.

Under sections 2 and 3 of the Criminal Justice (Withholding of Information on Offences against Children and Vulnerable Persons) Act 2012, it is an offence to withhold any information on offences referred to in that Act. The Children First Act 2015 requires a range of mandated persons, including health practitioners, teachers and youth workers, who know, believe or suspect that a child has been harmed, is being harmed or, indeed, is at risk of being harmed, to report that to Tusla.

I am sure that committee members would agree that the public interest in such cases should not in any way be jeopardised or compromised. This section provides an effective and appropriate safeguard in the words "necessary and proportionate". I cannot accept the proposals in amendments Nos. 52 and 56 to remove the reference to special categories of personal data in section 38 and add a new section. Neither can I accept insertion of the words “having regard to the fundamental rights and legitimate interests of the data subject” as an addition in amendment No. 54, because this would place an additional burden on, for example, a youth worker reporting suspected harm to a child or perhaps even a bank official reporting his or her suspicion that certain transactions may from time to time be linked to money laundering or illegal activity.

I see where Deputy Daly is coming from but I think there are adequate safeguards. If I were to accept her amendments, I would be jeopardising long-standing obligations on persons.

Amendment put and declared lost.

I move amendment No. 53:

In page 29, line 4, after “that” to insert “, having regard to the fundamental rights and legitimate interests of the data subject,”.

Amendment put and declared lost.

I move amendment No. 54:

In page 29, line 6, to delete “preventing, investigating” and substitute “preventing, detecting, investigating”.

Amendment put and declared carried.

As amendment No. 54 has been passed, amendment No. 55 cannot be moved.

Amendment No. 55 not moved.
Section 38, as amended, agreed to.
NEW SECTION

I move amendment No. 56:

In page 29, between lines 7 and 8, to insert the following:

“Processing of special categories of personal data

39. Without prejudice to the processing of personal data for a purpose other than the purpose for which the data has been collected which is lawful under the Data Protection Regulation, the processing of special categories of personal data for a purpose other than the purpose for which the data has been collected shall be lawful to the extent that such processing is, having regard to the fundamental rights and legitimate interests of the data subject, necessary and proportionate for the purposes—

(a) of preventing a substantial threat to national security, defence, or public security,

(b) of avoiding prejudicing the investigation or prosecution of criminal offences,

(c) set out in paragraphs (a) or (b) of section 44.”.

Amendment put and declared lost.
Sections 39 and 40 agreed to.
NEW SECTIONS

I move amendment No. 57:

In page 30, between lines 2 and 3, to insert the following:

"Application to access data

41. (1) No application to access data processed for journalistic purposes may be made by any party, including, for the avoidance of doubt, an authorised officer, An Garda Síochána, the Garda Síochána Ombudsman Commissioner, the Revenue Commissioners or the Defence Forces, except by way of application to the High Court by motion and affidavit and on notice to the journalist data processor.

(2) In determining whether to allow access to data processed for journalistic purposes, the High Court shall have regard to the importance of freedom of expression in a democratic society and to the importance of confidential sources of information to the right of freedom of expression.

(3) The High Court may permit access to data processed for journalistic purposes, including for the purpose of identifying confidential sources of information, only where the journalist processor whose data is sought is the subject of investigation for suspected commission of a serious criminal offence or for unlawful activity which poses a serious threat to the security of the State.

(4) (a) In exceptional cases, where the security of the State is under immediate threat or where it is suspected that a serious criminal offence is likely to be committed in the immediate future, an application may be made ex parte to the High Court for access to data processed for journalistic purposes.

(b) Where an ex parte application under this section is made, the journalist processor whose data is the subject of the application shall be notified of the application by, and given the opportunity to make representations before, the High Court as soon as practicable.

(5) An appeal shall, by leave of the High Court, lie from a determination of that Court under this section on a question of law to the Court of Appeal.".

This is a matter of concern for several organisations such as the Irish chapter of the National Union of Journalists, NUJ, and the Irish Council of Civil Liberties, ICCL. The committee had a lengthy discussion recently on the importance of independent journalism, journalists' sources and their importance for the functioning of a democratic society. There are many discussions in the public domain about recent data breaches in significant media outlets in this State that have caused a lot of concern about potential interference with journalists and what they do. That is wrong. It is a matter of concern for free media and democracy in this country, so it is vitally important that journalists and their sources are protected. They are integral to a functioning democracy that holds Government, Opposition and public institutions to account.

I do not believe the Bill adequately provides for this. That is a view shared by others. I will be pressing the amendment.

We had considerable debate on this in the Seanad. The text of Deputy Ó Laoghaire's new section seems to be inspired by the recommendation of this committee arising from the pre-legislative scrutiny of the communications (retention of data) Bill 2017.

The joint committee's report was issued recently but the Government, and more importantly the Attorney General, have not yet had the opportunity to examine the recommendations in the detail this deserves. I have doubts as to whether this is the correct location for a far-reaching statutory provision of this kind. I ask Deputies to appreciate that the potentially far-reaching nature of this amendment, and the provision of proposed subsection (3) whereby the High Court could permit identification of confidential sources of information where a journalist is the subject of investigation for suspected commission of a serious criminal offence, raise several important issues, not least what is meant by a serious offence. Does it cover dangerous driving or domestic violence? There is no definition of any kind and the result is that journalistic privilege may in effect be put at risk rather than be safeguarded.

Balancing the rights of journalists to protect their sources with other sources is rightly a matter for the courts. For example, the European Court of Human Rights has underlined that protection of confidential sources is an essential means of enabling the press to perform its important function as a public watchdog. That should not be interfered with except in the most exceptional of circumstances where some vital public or individual interests may be at stake. I do not disagree with the points raised by Deputy Ó Laoghaire but I am very concerned about the imported consequences of the amendment in the form of the text as it is. This is an issue that deserves the fullest of consideration. I do not believe we should decide it in the context of this Bill. Therefore, I will not accept the amendment now.

I find myself in the frightening position of agreeing with the Minister. The amendment raises very important issues that go beyond the data protection measures, the general data protection regulation, GDPR, and this legislation. The Minister's point about what is a serious offence involves a balancing of rights which are adjudicated by the courts, and as Deputy Wallace just said to me, if at some stage we did have a crusading independent media and journalist corps, it would be nice to have their interests protected, but we are a long way from that given the conduct of many journalists in front of the Charleton tribunal. That is another story.

I thought that the Minister looked decidedly more uncomfortable than Deputy Daly during that.

I invite Deputy Daly to feel more comfortable when agreeing with the Minister.

The Minister should beware.

I expect that Deputy Wallace will say something similar.

I will withdraw the amendment, not so much because of its location, because this is a data protection Bill and data retention is relevant as well, but on the basis of the text.

I had better say something or the Minister will be disappointed. Deputy Daly and the Minister would make a lovely couple.

Deputy Ó Laoghaire is right that journalism has a powerful role to play in democracy and in helping to ensure that we have a fair society, but sadly we do not have that yet in this country. We long for the day. I would defend the Minister's position on this.

I thank the Deputy for that insightful contribution.

Amendment, by leave, withdrawn.

We are moving on to the grouping of amendments Nos. 58 to 62, inclusive. If amendment No. 58 is agreed, amendment No. 60 in the name of Deputy O'Callaghan cannot be moved. Amendments Nos. 59 and 60 are physical alternatives to amendment No. 58.

I move amendment No. 58:

In page 30, to delete lines 4 to 6 and substitute the following:

"41. (1) For the purposes of Article 86, personal data may be disclosed where a request for access to a record is granted under and in accordance with the Act of 2014 pursuant to an FOI request, a request for access to environmental information is granted under and in accordance with the Regulations of 2007 pursuant to a request for environmental information or a request to release documents for re-use is granted under and in accordance with the Regulations of 2005 pursuant to a request.".

The amendment is intended to put the access to information regimes on an equal footing with freedom of information regimes. These include the right to access environmental information under the European Communities (Access to Information on the Environment) Regulations 2007 to 2014 and the European Communities (Re-Use of Public Sector Information) Regulations 2005 to 2015. There is no good reason to refer in the Data Protection Bill 2018 only to freedom of information without also including the other major regimes accessed under those regulations. This amendment can correct that and would be a useful addition to the Bill.

Amendment No. 58 replicates my amendments Nos. 59 and 60 and I am happy to go with Deputy Ó Laoghaire's amendment. He has given a good account of why it has been put forward. Section 41 deals with circumstances when a request under the Freedom of Information Act 2014 means that personal data contained in a record may be disclosed if it comes pursuant to a freedom of information request. The objective of the amendments is to broaden the applicable statutory provisions so that they include not just the Freedom of Information Act 2014 but also the European Communities regulations on re-use of public sector information and on access to information on the environment.

On amendment No. 59, I am concerned about the proposed deletion of the words "contained in a record" as the concept of a record is integral to the operation of the Freedom of Information Act. Section 2 contains a comprehensive definition of the term. Access rights under the Act include access to records. Section 11 provides that every person has a right to and shall, on request, be offered access to any record held by any freedom of information body. Section 12 also references a record. Therefore, reference to a record appears to be right and proper.

On amendments Nos. 58 and 60 to 62, inclusive, I accept, subject to the advice of the Attorney General, the principle of extending the scope of the section to include the regulations of 2005 and 2007. I have asked my officials to consult the Office of the Parliamentary Counsel with a view to ensuring the text is appropriate and does not in any way conflict with other sections. In short, if Deputies withdraw their amendments, I will give a commitment to table an appropriate amendment on the subject on Report Stage with which I will certainly attempt to meet concerns.

I will come first to Deputy Donnchadh Ó Laoghaire and then to Deputy Jim O'Callaghan to respond to the Minister's invitation, for want of any other word.

In the light of what the Minister has said and with a view to retabling the amendments on Report Stage if there is nothing forthcoming, I will withdraw amendment No. 58.

On amendment No. 59, there is a definition and the Act was referenced. I do not have it to hand, but I am not necessarily clear on what harm would be done if the words "contained in a record" were not included or there was a broader view on the information on a person that might be owned by a data processor or any organisation. For the avoidance of doubt, it seems that there is sense in simply stating all information, whether in what might be defined as a record or not, will be contained. I will consider it, but I am happy to withdraw amendment No. 58.

In the light of the new consensus between Fine Gael and Sinn Féin, it ill behoves me to interfere with or interrupt it. I will follow Sinn Féin's example. We will not push the amendment now but will come back to it on Report Stage.

The Deputy also wishes to be involved.

I am taking the lead from Sinn Féin.

We will call it as we see it.

The next Government might be about three parties, rather than two.

There could also be room for Independents.

I do not think so. Fine Gael might have had its fill of them this time.

Let us keep doing well.

Amendment, by leave, withdrawn.
SECTION 41

I move amendment No. 59:

In page 30, line 4, to delete "contained in a record".

This is complementary to the last amendment and probably amendment No. 62.

Yes and they will be withdrawn or not moved.

Amendment, by leave, withdrawn.
Amendments Nos. 60 to 62, inclusive, not moved.
Section 41 agreed to.
NEW SECTION

Amendments Nos. 63, 64 and 66 are related and will be discussed together. Acceptance of amendment No. 63 in the Minister's name involves the deletion of section 42.

I move amendment No. 63:

In page 30, between lines 13 and 14, to insert the following:

Processing of special categories of personal data

42. Subject to compliance with the Data Protection Regulation and any other relevant enactment or rule of law, the processing of special categories of personal data shall be lawful to the extent the processing is —

(a) authorised by section 38 and sections 43 to 51, or

(b) otherwise authorised by Article 9.”.

This is essentially a drafting amendment and presents section 42 in a clearer format and wording.

Amendment agreed to.
Section 42 deleted.
SECTION 43

I move amendment No. 64:

In page 30, line 23, to delete "any right or obligation" and substitute "specific rights or obligations".

Are the members pressing the amendment?

Has it been discussed already?

It was part of a previous grouping and I asked if members wished to speak to it.

I did not address the matter as I thought Deputy Clare Daly might do so.

Yes. Did the grouping contain amendments Nos. 63, 64 and 66?

That is correct. We are now deciding on amendment No. 64. The time to address it was before, but nobody indicated at the time.

In that case, I will allow the Deputy to speak to it, if she so wishes.

Is the Chairman referring to amendment No. 64 or amendment No. 66?

We are dealing with amendment No. 64.

I will be brief. To be honest, I do not know why the amendments have been grouped like this, as they deal with two sections. That probably has caused part of the confusion, about which I am sorry.

Section 43 deals with providing for a general exemption from the prohibition on processing special categories of data imposed on either the controller or the subject by employment or social welfare law. All we are trying to do is change the words "any right or obligation" to "specific rights or obligations", which would be much more in line with Article 9. We have a little concern that it is being left too general and that it would allow special categories to be processed for reasons for which they do not need to be processed. It is a slight change.

On section 45, there is a degree of concern. Deputy Mick Wallace has an amendment that is much the same on the matter. I will oppose section 45. All of its purposes are covered by Article 9 of the GDPR. In the possible or likely event that the section is agreed to, I still believe it requires amendment. There is a view, which I share, that section 45 creates a loophole in allowing companies from other jurisdictions to operate here. It essentially creates a position where companies not dissimilar to Cambridge Analytica or other organisations which are mining and exploiting data in that way could operate and use data gathered here, provided they did not interfere in electoral activity in the State. That is not covered, but it is the purpose of amendment No. 66. I will oppose the section, but I will also press the amendment.

Deputy Mick Wallace also has his name to the amendment.

I will oppose the section. We might be deemed to be wiser to oppose it and adhere to the GDPR in full, rather than trying to shape the section. My amendment is a fallback position if the section is not completely opposed. We would like to return to it on Report Stage. Article 9 of the GDPR is very clear that the processing of data relating to political opinion without the full and informed consent of the data subject is prohibited, except in certain and very limited circumstances. Section 45 of the Bill is a bizarre attempt to carve out an exception for the processing of political opinion that is simply not provided for in the GDPR. We could write it into Irish law via section 45, but it would simply be superseded in any case by the GDPR. The phrase "subject to suitable and specific measures" appears many times in the Bill and points us back to section 35, to which the Minister referred as a toolbox for processing and protecting the rights of the data subject. Section 35 and the suitable and specific measures therein are extremely important and, in the case of the most important, lifted from various parts of the GDPR. The section does not require explicit consent, which is optional. Ministers do not have to use the toolkit in the section. Section 45 is a bizarre attempt to carve out exemptions from the GDPR, particularly in the light of the Cambridge Analytica story and the fundamental threat to democracy that such companies pose.

Removing section 45 would not affect the use of the electoral register or the work of the Referendum Commission.

Article 13 of the GDPR explains the necessary steps we should take in terms of electoral activities such as door-to-door canvassing to adhere to the GDPR. The Office of the Data Protection Commissioner recently published guidelines on how canvassers would have to adapt. It will not affect polling companies or the use of focus groups or market research, only in the sense that consent will be required from the person being polled. Obtaining this consent should not be especially difficult or onerous. In any case, the GDPR absolutely requires the seeking of this consent, as per Article 9, in processing special categories of data such as those relating to political opinion.

I do not see any legal difference between the current wording of "any right or obligation" and "specific rights or obligations". Where any right or obligation is conferred or imposed by law, it is a specific right or obligation. Apart from that, there is a grammatical problem because of the plural nouns "rights or obligations" being used with a singular verb. This means that the wording would read "exercising or performing specific rights or obligations which is conferred or imposed". For these reasons, I cannot accept the amendment.

Amendment No. 66 brings us back to the Seanad, where I introduced amendments to ensure the processing of political opinions for electoral purposes would apply only in the course of elections within the State. That was an issue. Of course, the content is based on Recital (56) of the GDPR which makes it quite clear that, where in the course of electoral activities the operation of the democratic system in a member state requires political parties to compile personal data for people's political opinions, the processing of such data may be permitted for reasons to do with the public interest, provided that appropriate safeguards are established. I am at a loss to determine the consequences of what Deputy Donnchadh Ó Laoghaire has in mind. I do not recognise circumstances in which such personal data would be shared with a private company. They would more likely be used during the course of an election campaign when parties were canvassing and seeking reactions to election manifestoes or questionnaires and the voting intentions of constituents. I am not sure whether the amendment is needed and even if I were minded to accept it, I am not clear on the actors and entities involved. I will not accept it today, but there might be scope for further debate on it. With its current wording, I cannot accept it.

I wish to speak briefly to amendment No. 64. Article 9 of the GDPR, from which the section is derived, states the processing of special categories of data in the context of employment and social welfare law is allowed as long as the "processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject" in these areas. That is where we took the word "specific" instead of "any". We think it is more in line with Article 9.

On amendment No. 66 and the section, I am in favour of the deletion of the entire section. It was the subject of a huge amount of debate in the Seanad. Polls, focus groups and canvass tallies will all still be allowed if the section is deleted. All that has to happen is for consent to be gained to note somebody's political view, only if someone is planning to use it with the person's name and address or IP address in the course of one or other of these activities. It is not really a big ask. Notably, there was a letter yesterday in the newspapers from Digital Rights Ireland, Data Compliance Europe, Dr. T. J. McIntyre of the Faculty of Law in UCD, FP Logue Solicitors, Rossa McMahon and the Irish Council for Civil Liberties. The top people in this area are warning us. They have taken successful legal actions against the State. Because of their knowledge, they are warning us and arguing for the removal from the section of the blanket exemptions in the processing of personal data which reveal political opinions. That is why we are pushing to oppose the section. The State will pay heavily if we do not delete the section. Parties and candidates will still be able to run an analysis of election results in granular form. They will still be able to have super sophisticated analysis of polling data. The only things involved are personal data that can identify people in the context of their political opinions, and the State would be well served by deleting the section in its entirety.

I do not see any difference between what is in place and what is proposed in amendment No. 64. I know that the Minister has said the same. I have to say his suggestion that the use of the word "is" is a reason not to support the amendment is not a strong one. I will not support the amendment because I do not believe it would add anything to the Bill.

On section 45, as elected representatives, we should be supporting the political process. Deputy Donnchadh Ó Laoghaire should be allowed to move around Cork South-Central and, if he comes to a house where the individuals tell him that they will vote for him, he should be able to record that information. He should not have to ask them whether they would mind if he was to record their names such that they would be recorded as Sinn Féin supporters. It is completely artificial. We need to recognise the reality. I will not support the deletion of section 45.

I will not support the amendment either. It is part of a political process that parties and candidates are entitled to identify the political opinions people hold. Some people want to express their political opinions, while others want to keep theirs private, but at times it is an objective fact as to what is a person's political opinion. We do not need to be so nervous about it that it has to be protected.

The amendment does not attempt to impinge on what political parties do in this jurisdiction or, at least, for its purposes. Its intention is to prohibit the gathering of data in this jurisdiction for use elsewhere. There is a belief, which I share, that it is not currently prohibited and that it is something we should seek to do.

The other point made by Deputy Jim O'Callaghan and the Minister is fine, but the issue is why are we drafting a provision when all of these practices and behaviours in canvassing and making representations are provided for under the GDPR? This is a regulation, not a directive. Most of it has direct effect. There is a margin of appreciation of certain provisions, but as Article 9 of the GDPR has direct effect, I do not see any need for section 45 in that context. People have spoken about lawyers' holidays. The greatest example will be when the GDPR and the Act will be in conflict. Section 45 is a prime example in that regard.

I wish to address the point made by Deputy Jim O'Callaghan. If a really nice individual whom I like comes to my door and asks me for my vote and I tell him that I will give it to him and he happens to be from Fianna Fáil, I might not want it to be made public or recorded that I was actually prepared to support Fianna Fáil. Someone might want to make a call and agree to support a fellow, but I can understand that person not necessarily wanting it to be made public or recorded.

This is an absolutely enormous section which has caused huge controversy. Even as we sit here, a load of people are commenting on it, including some of the experts in Ireland on data protection because they believe this is a serious category.

To answer some of the points made by Deputy Jim O'Callaghan, it is not about canvassing or recording details. All of that good stuff can continue. It is about targeting and isolating an individual and personal data. That has very big implications. If the debate on the section is continued on Report Stage, there will again be huge controversy.

I thank the Deputy. As there is no other member offering, I will revert-----

We might consider tabling an amendment to section 45 on Report Stage.

That is okay. Does the Minister have anything further to add?

I have to contrast the differing opinions insofar as some members say this is revolutionary and foreboding, while others say it is not necessary because it is already catered for.

We will see.

Amendment put and declared lost.
Section 43 agreed to.
Section 44 agreed to.
NEW SECTION

Deputy Jim O'Callaghan indicated that he would withdraw amendment No. 65.

Amendment No. 65 not moved.
SECTION 45

I move amendment No. 66:

In page 31, between lines 12 and 13, to insert the following:

“(2) This section does not permit the sharing or processing of personal data revealing political opinion with or by any private company, as defined under section 2(1) of the Companies Act 2014 without the consent of the data subject even when that private company has been contracted by the actors or entities specified under paragraphs (a),(b) or (c).”.

Amendment put and declared lost.
Question proposed: "That section 45 stand part of the Bill."

Deputy Clare Daly has indicated that she is opposed to the section. Is she happy that she has covered the points she wanted to make?

Yes, absolutely.

Question put:
The Committee divided: Tá, 5; Níl, 3.

  • Brophy, Colm.
  • Fitzpatrick, Peter.
  • Flanagan, Charles.
  • Lawless, James.
  • O'Callaghan, Jim.

Níl

  • Daly, Clare.
  • Ó Caoláin, Caoimhghín.
  • Wallace, Mick.
Question declared carried.

I apologise, Chairman, but I meant to interject when we were on section 42. Perhaps I am too late, but there is something I wish to raise on Report Stage.

If the Deputy wishes to so indicate, he may take the opportunity to do so briefly.

I reserve the right to speak and possibly introduce amendments about external databases that hold special categories of personal data. The ISideWith online campaign has data for more than 100,000 individuals which are available to be used in micro-targeting. They are held in the United States beyond the jurisdiction of the GDPR, but they could still potentially be used in the future to affect Irish elections and referenda and pose a threat to democracy. I wish to raise this issue on Report Stage.

It is duly noted and the Deputy will be in a position to proceed to discuss it.

Section 46 agreed to.
SECTION 47

Amendments Nos. 67 to 70, inclusive, in the names of Deputies Clare Daly and Mick Wallace are being discussed together. I understand Deputy Mick Wallace will take the lead.

I move amendment No. 67:

In page 31, line 24, after “subjects,” to insert “and subject to subsection (2),”.

Recital 52 of the GDPR states exemptions in the processing of special categories of personal data can be provided for in member state law in settling claims for benefits and services under the health insurance system. I acknowledge that section 47 invokes suitable and specific measures which revert to some of the safeguards provided in section 35, but Recital 52 of the GDPR makes absolutely no references to occupational pensions, for example, as is the case in respect of section 47(c) or to the mortgaging of property, as provided for in section 47(d). This section essentially provides for exemptions from the requirement for explicit consent under the GDPR for the processing of special or sensitive categories of data. That is fine, as long as we adhere to the possible exemptions provided for in the GDPR. However, we are surely overstepping the mark in this section and going beyond services provided under the health insurance system, as per Recital 52 of the GDPR. Why could consent not be sought in the instances given in section 47(c) and (d)? Surely obtaining consent in these instances would not be too onerous or difficult. The proposed insertions in amendment No. 70, subsection (2)(a) and (b), even stipulate that processing might take place without the consent of the data subject if the data controller could not reasonably be expected to obtain consent for whatever reason. In other words, obtaining consent should be a reasonable step.

The provisions of the GDPR provide for exemptions from the requirement for consent for processing with a view to safeguarding public health, but that is not necessarily what health insurance companies do. The processing of health data is not necessary for the management of the health service. It obviously has some function in that regard, but I do not think it should process such data without having to ask for our permission. For example, VHI is running a TV advertisement campaign asking members to sign up to be DNA-tested by it in order that it can help an individual to find out the future ailments to which he or she might be genetically disposed, but that is not the reason it is doing it. It is doing it in order that it can charge higher premiums to individuals who are predisposed to something that could trigger an illness later. It wants our data in order that it can levy higher premiums. It is not doing it for the good of the health service. There is no reason we should give such data to it; it should have to obtain an individual's consent first. That is all we are asking for.

It is an even bigger problem in the case of the banks because this allows for an exemption for the banks to process health data in the case of mortgage applications. The Government's proposal is that the banks can do this without obtaining the consent of the person concerned. That is ludicrous. Everybody knows that when he or she fills in the application form for a mortgage, he or she will have to fill in numerous forms. I do not think one of them being a consent form would be too onerous. It woud not stop the banks or insurance companies from obtaining the information, but they would have to have our consent first.

Section 47 has been included to address a specific issue arising from the strict definition of consent included in the GDPR. The matter also arose during the preparation of legislation in a number of other member states, of which we are aware.

The matters referred to in section 47, paragraphs (a) to (d), inclusive, insurance or life assurance policies, pensions, annuities and mortgages, are normally the subject matters of a detailed contract between the data subject and an insurance company or a financial institution. In order to determine contributions, it may well require obtaining information on the health of the data subject, or his or her welfare or disposition. Article 6(1)(b) of the GDPR permits the processing of non-sensitive personal data.

Article 9.2 does not permit the processing of such personal data for contractual purposes. The question then is whether the explicit consent of the data subject in Article 9.2(a) provides a sufficiently robust ground for securing the benefits of such a contract. The difficulty that arises relates to the strict definition of "consent" in Article 4.11 of the GDPR. It prescribes that for the consent to be valid, it must be "freely given". Recital 43 states that consent should not provide a valid legal ground for the processing of personal data "where there is a clear imbalance between the data subject and the controller". My concern, which is shared by a number of other member states, is that the insurance company or financial institution may in certain circumstances, in the absence of this section, seek to resile from the contract with the data subject on the basis that the consent of the subject could not have been freely given. The need for the provision has been discussed and agreed with the Attorney General and I am not inclined, therefore, to accept the amendments.

I agree with the Minister's comments. I worked in the insurance industry and the health insurance industry, in particular, and, therefore, I am familiar with the motivation behind the section. Deputy Daly will be glad to know that the advertisements that the VHI or other health insurers run and any tests they may perform as regards a predisposition to various conditions and diseases under law can have no effect on the premiums they charge because of community rating, which means health status and categories of illness are immaterial when it comes to premium pricing.

There is a difficultly with the amendments. The Minister stated that one of the grounds for the purposes of a contract is that consent be freely given. Life insurance has always been risk-rated as opposed to community-rated and there is a difficulty in this regard. For instance, when completing a proposal form, one is required to outline various health conditions and information which is necessary for actuarial pricing for the performance of the contract. Under the amendment, there is the possibility of the data subject withholding consent. I do not know how that would work if a contract has been signed. If a client filled out a proposal form to take out a life insurance contract and at a later stage withheld consent for the use of this information, how could a claim be processed if no one has access to the information that was the subject of the contract in the first place? The amendments are well-intentioned but they are problematic and I do not see how they could work. I will oppose the amendments.

On foot of the Minister's comments, we were going to withdraw the amendments but Deputy Lawless has almost tempted me to reintroduce them. I will withdraw them for now and reserve the right to table them again on Report Stage.

Amendment, by leave, withdrawn.
Amendments Nos. 68 to 70, inclusive, not moved.
Section 47 agreed to.
NEW SECTION

Amendments Nos. 71 to 76, inclusive, are related and will be taken together. If amendment No. 71 is agreed to, amendments Nos. 72 to 76, inclusive, cannot be moved. Acceptance of the amendment involves the deletion of section 48.

I move amendment No. 71:

In page 31, between lines 30 and 31, to insert the following:

"Processing of special categories of personal data and Article 10 data for reasons of substantial public interest

48. (1) Processing of special categories of personal data shall be lawful where the processing is carried out in accordance with regulations made under subsection (3).

(2) Article 10 data may be processed where the processing is carried out in accordance with regulations made under subsection (3).

(3) Regulations may be made authorising the processing, where necessary for reasons of substantial public interest, of either or both of the following —

(a) special categories of personal data, and

(b) without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016, Article 10 data.

(4) Without prejudice to the generality of subsection (3), regulations made under that subsection shall identify

(a) the substantial public interest concerned, and

(b) the suitable and specific measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data which is authorised by the regulations.

(5) For the purposes of subsection (4)(b), subsections (2) to (6) of section 35 shall apply in like manner to regulations made under subsection (3) as they apply to regulations made under section 35.

(6) Regulations may be made under subsection (3) by—

(a) the Minister, following consultation with such other Minister of the Government as he or she considers appropriate and the Commission, or

(b) any other Minister of the Government following consultation with the Minister, such other Minister of the Government as he or she considers appropriate and the Commission.

(7) The Minister or any other Minister of the Government, as the case may be, making regulations under subsection (3) shall have regard to the need for the protection of individuals with regard to the processing of their personal data, and without prejudice to the generality of that need, have regard to—

(a) the nature, scope and purposes of the processing,

(b) the nature of the substantial public interest concerned,

(c) any benefits likely to arise for the data subjects concerned,

(d) any risks arising for the rights and freedoms of such subjects, and

(e) the likelihood of any such risks arising and the severity of such risks.

(8) Regulations made under subsection (3) shall—

(a) respect the essence of the right to data protection, and

(b) enable processing of such data only in so far as is necessary and proportionate to the aim sought to be achieved.

(9) In this section, "Article 10 data" has the meaning assigned to it by section 52.".

The amendment provides for the replacement of section 48 with a new section. The section replaces section 2B(1)(b)(II) of the 1988 Act. However, the original wording of section 48 was narrower in scope than section 2B(1)(b)(II) and it did not extend to personal data in respect of criminal convictions and offences. This is because data relating to criminal convictions and offences fall within the definition of "sensitive personal data" under the 1988 Act whereas they form the subject matter for a separate Article 10 under the GDPR. The purpose of the amendment, therefore, is to bring section 48 more fully into line with the 1988 Act. Yesterday, I outlined some of the statutory instruments made under the corresponding section 2(B) of the 1988 Act in respect of the historic institutional abuse inquiry in Northern Ireland, the coroner's inquest into the death of Arlene Arkinson, and the coroner's inquest into the Kingsmill massacre. The processing of personal data under those regulations could involve the processing of personal data in respect of criminal convictions or offences or the alleged commission of an offence. These are matters of great importance and they necessitate the making of regulations to facilitate processing of sensitive personal data. The provisions of section 48 will permit the making of similar regulations in the future where that is justified for reasons of substantial public interest such as those I have outlined.

I will not accept amendments Nos. 72 and 73 because they seek to narrow the scope of the regulation-making power under the section. If I was to confine the scope of the section to the processing of data by public authorities in cases of urgency, it would mean that the making of regulations such as those we made to facilitate the McAleese committee and its important work would no longer be possible. I have concerns about the content and the cumulative impact of the proposals in amendments Nos. 74 to 76, inclusive, and I am not minded to accept them.

We dealt with many of the issues relating to the section during the debate on amendment No. 5. The amendment relates to the processing of sensitive categories of data, which can only be done in the substantial public interest. None of us will have a problem with the example cited by the Minister but we are concerned to head off that interpretation being stretched in the future based on the current definition. The Sinn Féin position is similar. We propose that regulations under the section should be examined by a body or organisation that has data protection expertise. Amendment No. 72 provides that anybody who wants to rely on the substantial public interest ground to process special category data should be a public authority. That is both a matter of principle and a matter of the public authorities having an obligation to appoint data protection officers.

We propose in amendment No. 74 that the data protection officer of the relevant public authority the Minister wants to give permission to process special category data has to conduct a privacy impact assessment on the proposal and refer it back to him or her whereupon he or she can take the findings on board and, if not, make a statement in the Houses as to why not. Sinn Féin's amendment is similar. Regulations would be referred in draft form to the DPC for his or her opinion and he or she would have three months to think about them and refer them back to the Minister. If the Sinn Féin amendment is considered to be drafted appropriately, I am happy to go with it over ours.

Amendment No. 76 is of a piece with our amendments Nos. 96 and 111, which we discussed earlier. It is about oversight.

The amendments are not quite similar and I am concerned about the Minister's proposal to delete and replace the entire section because it would mean our amendments would be lost. Section 48(4) is the result of a Sinn Féin amendment that was made in the Seanad. I have sought to refine it to take account of a point made by the Minister to tighten it up.

To identify the point exactly, rather than section 48(4)(a) seeking an impact assessment, it would be defined as an opinion. The Minister made the point in the Seanad that the provisions would have some implications for the independence of the data protection commissioner. This is an attempt to refine that. Deputy Daly's amendment diverges from the existing section 48(4)(a) in part (c). Will the Deputy explain the difference in (c) to me?

Where is it? I cannot see it.

Section 48(4)(c). That is the implication of our amendment. It is to try to preserve and enhance an amendment that was made in the Seanad.

It is appropriate that one should be able to process personal data for the purposes of substantial public interest. The Minister has given examples. In recent days, we have seen other issues that have arisen which may result in an investigation. That also illustrates an example of how, on occasion, the processing of personal data is necessary on the basis of substantial public interest. I will support the Minister's amendment, No. 71. The amendments put forward by Deputies Daly, Ó Laoghaire and Wallace seek to put further obstacles in the way of regulations that are to be made by the Minister under section 48.

We need to remember that we did something quite novel yesterday. We introduced an amendment that requires the Minister to seek prospective approval from the Houses of the Oireachtas before he introduces these regulations, so if he decides to introduce regulations in accordance with section 48, he has to lay them before the Houses of the Oireachtas. He has to do that because it is a form of secondary legislation. Law is being made. I would be concerned about handing out these regulations to get the approval of some unelected official, such as a data protection officer or another public authority that will then assess whether they think it is necessary or proportionate for laws to be made. We keep delegating our responsibility. Regulations and statutory instruments are a delegation of legislation. They go to the Minister but they are still legislation, which is why, yesterday, we wanted to have prospective approval of those regulations. I will not support putting it out to some other unelected individual who will have a process for recommending them or giving an assessment. We, as legislators, need to say that it is our responsibility to make laws, that we will see them and if we do not like them, we can vote them down.

On the issue of "substantial public interest", German data protection legislation specifically restricts processing in this sense to public authorities, and I think we should do the same. We are talking about sensitive personal data and I do not see any reason private companies would be processing sensitive data for what is referred to as "substantial public interest".

There is validity to Deputy O'Callaghan's point in the sense that what we agreed yesterday on Oireachtas oversight has maybe moved the goalposts since we tabled these amendments. We tabled two amendments to get around the legal prohibition on us placing an obligation on the Data Protection Commissioner to do anything. We have probably favoured Deputy Ó Laoghaire's amendment over ours but we were worried how that might stack up in that legal context and we put them in as reserves. I am happy enough to withdraw these for now with the option, when we look at the final draft, to see how it might fit in. Amendment No. 76 is consequential on amendment No. 5, and, on the point that Deputy O'Callaghan made about democratic oversight, we need to get that one passed. We are okay with withdrawing the others.

If I can clarify before the Minister responds, are Deputies Daly and Wallace proposing to withdraw amendments Nos. 72, 73 and 74?

I wanted to short-circuit matters by saying that I agree fully with the point raised by Deputy O'Callaghan. This is not an academic exercise. There are practical obligations and a practical process here. I am prepared to look at what we did yesterday with regard to amendments Nos. 35 and 37. We can go back to that later.

Will Deputy Ó Laoghaire indicate where he is on this grouping?

I am conflicted because the Seanad took a view on this and voted against the Government to include this impact assessment process with good reason. I take the point that Deputy O'Callaghan raised about decisions being made by the Oireachtas. There is no provision here that ensures that the Data Protection Commissioner would take a decision. Any decision could only be made by a Minister and now perhaps requires prospective sanction by the Dáil and Seanad. Any decision that is made by elected representatives has to be based on gathering the information available, evaluating it, and then taking the decision. The expert in these matters will be the Data Protection Commissioner. The commissioner's say on what additional exceptions and special categories might be required to be processed is necessary information, even with the prospective approval of the Dáil. We should have that and should be able to evaluate it. I will not support the Minister's amendment and will press my own.

The Deputy heard the robust debate in the Seanad and the manner in which it dealt with this issue. It is fair to say that the Seanad is more academically minded than the Dáil. I think, from time to time, that the Seanad does not have the practical experience of life that we bring as Members of the Dáil. I would not be overly exercised at the debate in the Seanad as far as this issue is concerned. I feel that, were we to accept these amendments, it would be grossly excessive with regard to the obligation on outside bodies. We would find it very difficult to get matters done in a way that might be regarded as efficient or timely in response to a public interest issue.

There are echoes of a former Taoiseach's intent in what I just heard. I can tell that Deputy Brophy cannot wait to meet his colleagues from the Seanad.

I have a feeling my colleagues from the Seanad will have heard well before I get an opportunity to meet them.

I wish the Deputy good luck nevertheless.

I wonder if this Seanad referred to by the Minister is the same one that his party was trying to get rid of not so long ago.

I, too, referred to that.

I was an abolitionist.

If I went on, I would probably find myself in some difficulty.

This point of an onerous obligation assumes that this will happen frequently. It should not happen frequently. If we are talking about new special categories being taken into account and saying that the Minister would be able to provide for that, that should not be happening willy-nilly or frequently but should be infrequent. One would hope that it would not happen any more often than once a year or even less often than that. I do not see why the Data Protection Commissioner cannot match up to that job. I do not think it is an onerous obligation. If it is, it means that the provision is being abused and that we are looking for new special categories to be sanctioned too frequently.

I remind members that if amendment No. 71 passes, irrespective of those withdrawn, none of the other amendments can then be moved.

Amendment put and declared carried.

As a consequence of the amendment being agreed to, neither amendment No. 75 nor amendment No. 76 can be moved. Amendments Nos. 72 to 74, inclusive, have already been withdrawn.

Amendments Nos. 72 to 76, inclusive, not moved.
Section 48 deleted.
SECTION 49

I move amendment No. 77:

In page 33, line 13, to delete “health professional” and substitute “health practitioner”.

This is a drafting amendment.

Amendment agreed to.
Section 49, as amended, agreed to.
Sections 50 and 51 agreed to.
SECTION 52

Amendments Nos. 78 to 81, inclusive, and 110 are related and may be discussed together.

I move amendment No. 78:

In page 35, line 2, to delete “compliance with Article 6(1), to”.

The purpose of amendment No. 80 is to provide a basis for possible future regulations to combat bribery and corruption. Members will recall that I recently launched important proposals to strengthen our law relating to bribery and corruption and I thank the committee for its contribution thereto. It will be necessary for any such future regulations to have regard to the policies and principles set out in subsection (5). Advance consultation with the Data Protection Commissioner will also be necessary. Amendments Nos. 78 and 79 are consequential drafting amendments.

I am not inclined to accept amendments Nos. 81 and 110 in the names of Deputies Wallace and Clare Daly but I recognise that a provision on these lines was carried yesterday.

They are consequential on yesterday's provisions and they relate to the same oversight provisions. For consistency, they should be allowed. They are in line with what we agreed yesterday but relate to a different section.

Amendment agreed to.

I move amendment No. 79:

In page 35, line 7, to delete “or” where it secondly occurs.

Amendment agreed to.

I move amendment No. 80:

In page 35, between lines 7 and 8, to insert the following:

“(b) assess the risk of bribery or corruption, or both, or to prevent bribery or corruption, or both, or”.

Amendment agreed to.

I move amendment No. 81:

In page 35, to delete lines 11 to 15 and substitute the following:

“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission,

and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee,

or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission,

and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”.

Amendment agreed to.
Section 52, as amended, agreed to.
SECTION 53

Amendments Nos. 82, 83 and 93 will be taken together.

I move amendment No. 82:

In page 35, line 35, after “candidate” to insert “, or in relation to the scripts completed by him or her in an examination,”.

This is a small set of amendments, primarily to do with access to examination scripts. It is designed to tidy up the process and in no way seeks to restrict the current situation in which candidates have access to, and can talk about, their examination scripts. Amendment No. 110 is at the heart of the issue and seeks to include a provision to safeguard access in the examination process, particularly in the case of rights relating to the removal of scripts from institutions.

In an important ruling of December last year, the European Court of Justice in Luxembourg ruled that examination scripts fall under the heading of personal data under EU data protection law. The consequences of that judgment are such that the Department of Education and Skills and the Attorney General are now examining the issue. I am not in a position to accept these amendments today but I assure Deputies Brophy and Burke that I will bring forward appropriate amendments on Report Stage in due course. It is an important point and I accept it.

I am willing, obviously, to accept that but it is very important because access to an examination script could have major implications for the examination process and marking systems. I will wait to see what the Minister comes back with on Report Stage.

I thank Deputy Brophy for bringing the matter to my attention.

Amendment, by leave, withdrawn.
Amendment No. 83 not moved.
Section 53 agreed to.
SECTION 54

Amendment No. 84 is a standalone amendment in the names of Deputies Wallace and Clare Daly.

I move amendment No. 84:

In page 36, to delete lines 17 and 18 and substitute the following:

“him or her to—

(I) make representations to the controller in relation to the decision,

(II) request human intervention in the decision-making process,

(III) request to appeal the decision.

(2) In the case of requests made under subsection 1(b)(ii) or (iii) the controller shall—

(a) comply with the request, and

(b) notify the data subject in writing of—

(i) the steps taken to comply with the request, and

(ii) in the case of an appeal under section 1(b)(iii), the outcome of the appeal.”.

Article 22.1 of the GDPR specifically states that people should not be subjected to automated decision-making, which it describes as "profiling". The GDPR provides member states with possible exemptions and Article 22.2(b) is different from (a) and (c) in the sense that there does not seem to be a provision in (c) for a data subject's right to obtain human intervention on behalf of the controller. I also accept the fact that section 54 of the Bill refers to suitable and specific measures and, therefore, the toolbox of safeguards. I accept that automated decision-making might be necessary at times but we are uncomfortable with blanket, catch-all, automated decision-making. In the Seanad debate, the Minister talked about the unintended consequences of amending this section in line with our amendment, suggesting it would facilitate wrongdoing and fraud. Perhaps the Minister can clarify this.

One of the problems with this section of the Bill is that it is not specific in any way on the matter of automated decision-making. It gives the power to introduce automated decision-making in a whole host of cases and we feel this may alienate certain vulnerable people from the institutions of the State. I do not know if anybody has seen the film "I, Daniel Blake" by Ken Loach, which would remind one of the issue in this case.

Section 54 gives further effect to Article 22 of the GDPR, which deals with the automated processing of personal data including profiling. Paragraphs 2(a) and (c) of Article 22, which have direct effect, permit automated processing, including profiling, where it is necessary for entering into, or the performance of, a contract between a data subject and a controller and where the data subject has given explicit consent. Paragraph 2(b) of Article 22 permits such processing where it is authorised by the European Union or national law but subject to appropriate safeguards. Recital 71 of the GDPR mentions measures to combat fraud and to monitor tax evasion, areas where such activity is relevant under national law but subject, again, to safeguards.

Section 54 makes it clear that the steps that need to be taken to safeguard the interests of the data subject must include an arrangement whereby the data subject has the opportunity to make representations on any intended decisions. This means, in the first place, that a data subject has the information on any proposal to make such a decision and, secondly, has the opportunity to bring any concerns to the attention of the controller.

As I have said, the general data protection regulation, GDPR, mentions fraud and tax evasion as areas justifying automated processes. It seems to me that the existing safeguards are adequate and are GDPR compliant. The essential features of amendment No. 84 are contained in section 54. I am not inclined to accept it. In this regard we must ensure that our laws combating fraud and tax evasion are fully fit for purpose.

Article 29 of the GDPR is the god of guidance on the GDPR. On automated processing the GDPR says that minimum safeguards must provide an explanation of the decision reached and a way for the data subject to obtain human intervention, to express his or her point of view and to contest the decision. This Bill refers to making what are called representations. It is not clear at what stage the data subject can make representations and there is no guarantee that he or she will get a human intervention if it is wanted. There is no obligation on a controller in this regard. We have to see this in the context of the fallibility of machines. It is crucial that there needs to be a clear right for people in Ireland to get a human intervention and an appeal process for any decisions that are made by the machine. This is what our amendment provides for. We have to be cognisant that over the next ten years, automated decision-making is going to become much more prevalent. There is a problem with the wording of the Bill in that the rights enshrined in the GDPR are somewhat circumscribed by this. Unless we clearly delineate the rights now, there will be confusion and possible court cases in the future. It is far better not to use the phrase "make representations", which is in the Bill. If the phrase is to be used, then accept our amendment.

I refer again to section 54 and to section 51, which require that any automated processing must be authorised or required by, or under, an enactment. Further, it requires that the effect of any decision is either to grant a request of the data subject or that adequate steps have been taken to safeguard the interests of the data subject. This covers the points raised by Deputy Clare Daly and therefore I am not inclined to accept amendment No. 84.

Amendment put and declared lost.
Section 54 agreed to.
SECTION 55
Question proposed: "That section 55 stand part of the Bill."

Under Article 21 everybody has a right to object to having their data processed for the purposes of direct marketing. The Government inserted this new section in the Bill in the Seanad that says receiving direct mail from a political party or the Referendum Commission is not direct marketing, so a person has no right to object. Essentially, it limits a person's right to object to being spammed so long as the bodies sending unsolicited mail are political parties or candidates. Is the Government doing this to get around the freepost thing that everybody gets in an election, which is sent out by An Post? If it is, then deal with that. By doing it this way the legislation is just allowing any unsolicited mail from a political party or candidate to get through. I do not believe this would be desirable.

On section 55 and direct marketing for the purposes of Article 21, the reason for excluding direct mailing from direct marketing in these cases is that the enhanced right to object to direct marketing activity should not apply to direct mailing for these purposes. This exception is based on the idea that citizens not only have rights but also obligations to inform themselves as part of their civic responsibilities. During Seanad discussions on this Bill, Senator Norris referred in passing to his practice of sending information circulars on his parliamentary activities to the Trinity College electorate by direct mailing. This section is intended to contribute to the formation and maintenance of an informed electorate in the State as part of our democratic system of government. I was not minded to recall the incidents, as referred to by Deputy Clare Daly, but it is important that direct mailing be retained as part of the civic engagement.

We can see that democracy is under threat in many western democracies, but if one tries to identify where democracy is under threat or how it is under threat - this is my opinion and people may disagree - it is under threat because of the deluge of information being pushed out to individuals, to a large extent through social media. We do not know who the funders are, the information is not verified and the publishers of the information are not identified. We have a Constitution that has established that the people can elect people to the Dáil. We have a process whereby democracy manifests itself. People might not like it and they may believe it is not democratic enough, but it is the method by which the people of Ireland elect the Government. Unless we start standing up for the democratic structures in the State, we will expose ourselves to the threats to democracy that have had an impact in other countries. We should not be embarrassed by the fact that candidates in an election, be they members of a political party or independent, can market themselves to tell people to vote for them. It is an integral part of the democratic process. The more we keep undermining ourselves and apologising for our existence, the more we undermine democracy. We should stand up and be proud of the fact that we are politicians, that we get elected and that we represent the people. That is the end of my party broadcast.

That is not the issue here. There is nothing to stop politicians continuing to mail people, every day of the week if they like. Section 55, however, prevents a constituent from objecting to that process. This is an entirely different matter. While I will continue to use my Oireachtas envelopes, with which I think I am informing my constituents, if someone contacts me and gives me their name and address and objects to that, I believe the objection should be upheld. This section removes their right to object. It does not stop politicians from continuing to burn down the rain forest to churn out reams of paper to tell people how great we are.

I might table an amendment on Report Stage if we are going to bring something else in, but I am happy with it as it is.

Deputy Daly has clarified the intent of the opposition to the section. Are there further comments?

I was not going to comment. I find it amusing that people view communications from themselves in one way but view as completely different the communications from others who are engaged in the same career path. If people chose to communicate with an individual through a letter in an envelope or if people chose to communicate by direct mail, it is the same process at heart and we should respect the integrity of all our colleagues' ability to communicate.

I did not hear anyone else saying that it was not. I said that a citizen or a resident had a right to object to any material they got from me and from Deputies Brophy, O'Callaghan or Ó Caoláin or whoever.

I have heard that loud and clear.

I would like to reinforce that. A thread is emerging in this debate that rather than going out and canvassing during elections or gathering data, candidates should stay behind closed doors and pray for people to vote for them. No one is suggesting that. We are trying to ensure that we comply with an EU law that will have a direct effect, and where people hold data around political opinions and constituents' issues, they must mind it carefully, delete it where appropriate and have proper consent for it.

In that regard, if a person repeatedly receives letters that he or she considers nuisance mail, it is reasonable for that person to have the right to say that he or she does not wish to receive such mail. Democracy in this country is more feeble than I thought if such a right is considered a threat to it.

It may not be directly relevant to the amendment but a threat to democracy is posed by how the mainstream media and the State-run, Government-controlled broadcaster, RTÉ, shapes the news. We have serious reservations about the threat posed to democracy by how RTÉ operates-----

Many people wish for RTÉ to be controlled by the Government but it certainly does not seem to be.

I thought Deputies who wish to speak must do so through the Chair. The notion that social media is less authentic than mainstream media is a bit odd.

Perhaps the Minister wishes to reveal whether or not he controls RTÉ.

I am surprised that members see this section as new or novel. The Data Protection Act 1988 contains reference to direct marketing and direct mail. Much of this is subjective on the part of the recipient. All Members have seen signs stating "no junk mail" in the course of canvassing. Such a sign is an objection in itself. However, I recall more than one occasion on which I did not leave a leaflet but was subsequently contacted by or spoke to the householder and pointed out that I had honoured the sign declining junk mail only to be told that it did not apply to me but, rather, the other crowd. This is merely subjective.

It applied to Deputy O'Callaghan's crowd.

I am inclined to accept what Deputy O'Callaghan has stated on the section. There is a practical issue in terms of day-to-day activities and people have the right to object. People exercise that right at the ballot box.

The ultimate judgment.

Question put and declared carried.
SECTION 56
Question proposed: "That section 56 stand part of the Bill."

Section 56 undermines Article 21 of the GDPR and the right to object. I acknowledge that the section refers to personal data rather than special categories of data such as political opinion, sexual orientation, ethnicity and so on. However, no provision in the GDPR allows the Government to deny data subjects the right to object to the processing of personal data. The Minister may object and state that I want to deny the Referendum Commission the ability to do its job but that would not happen with our amendment as the work of the Referendum Commission would be permitted as per Recital 69 of the GDPR and the reference therein to a compelling and legitimate interest. The Referendum Commission is a legitimate interest under the GDPR and section 56 of the Bill makes no difference to it. Section 56 is, therefore, unnecessary. Surely we should have the basic right to object if our data is being processed in an inappropriate manner for election purposes.

Deputy Wallace mentioned Article 21. A strict reading of the right to object indicates that it is subject to compelling and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. I believe that the effective operation of our democratic system depends on the right of those seeking or in elected political office to communicate their programmes, manifestos, policies, platforms, decisions and, often, achievements to the electorate. There is a corresponding obligation that voters be informed in order to promote the discharge of civic duties in society. That is the same argument as made previously. The section as drafted is not unimportant.

The points I made in regard to section 55 also apply to this section. I may consider tabling an amendment on Report Stage.

It is incredible that we are discussing a complicated document and are further unnecessarily complicating it. The entities to which the Minister referred, such as the Referendum Commission, political parties, political wannabes and others, can rely on existing legitimate interest grounds to carry out direct mailing and so on. These sections relate to removing a recipient's right to object. The sections remove the existing right under the articles of the GDPR for a person who does not wish to receive spam via phone, text messages and so on to object to that. The arguments being used to justify the section are neither valid nor accurate. We stand over our opposition to the section.

I wish the record to show my agreement to that.

With what is Deputy Ó Laoghaire in agreement?

The comments made by Deputy Clare Daly.

I was teasing the Deputy.

Question put and declared carried.
SECTION 57

Amendments Nos. 85 to 92, inclusive, 94, 95, 97 and 184 to 196, inclusive, are related and may be discussed together. Amendment No. 85 is in the names of Deputies Clare Daly and Wallace and I invite them to address it, subsequent amendments and the grouping in general.

Deputy Daly will speak to the amendment.

Will the Deputies share the joke? We all need it.

It has been a long week.

Members would prefer if we did not share it.

I do not know at whose expense the joke was but let us continue.

I move amendment No. 85:

In page 37, line 3, to delete “to 22” and substitute “to 21”.

It has been a very difficult week. I am aware that Deputy Ó Laoghaire is opposing the section, and Deputy Wallace and I support him in that regard. However, on the basis of the debate on the section in the Seanad, we did not think that approach would be heard or accepted and have, therefore, taken a harm mitigation approach. However, we support Deputy Ó Laoghaire on the section other than in that regard.

As discussed in regard to amendment No. 6, section 57 allows for the restriction of rights under various articles for the purpose of so-called important objectives in the public interest. Amendment No. 85 proposes to change the rights which can be restricted under the section to those outlined in Articles 12 to 21 of the GDPR rather than Articles 12 to 22. It is not a major change but would mean that people would have the right not to be subjected to automated decision-making or profiling under any circumstances under the section, which is important. The British legislation on this matter includes a provision similar to that which we are proposing and it is important in that regard.

On amendment No. 90, as previously mentioned, section 57 proposes that the Minister would have wide discretion in limiting the rights of persons under Articles 12 to 22 in respect of certain circumstances that are united under the vague banner of being in the general public interest.

The section also proposes to give the Minister wide discretion in limiting the rights of persons if he or she believes it is necessary to do so for the protection of the data subject or the rights and freedoms of others to do so. While this provision appears to be fair, the section does not include an obligation on the Minister to balance the rights and freedoms of data subjects with the rights and freedoms of others in circumstances in which he proposes to restrict the right of access to information under this section. I am concerned that the provisions under this section could be used to deny adopted persons' requests for information about where they come from on the basis that another party is involved. To oblige the Minister to balance rights would not be a great imposition. It is important that he should be obliged to do so.

This ties in with amendment No. 90 where the Minister also has the power to limit the rights of data subjects in respect of personal data kept for or obtained in the course of the carrying out of social work by a public body. On the face of it, this appears to be vaguely acceptable. However, if one scratches a little deeper, it becomes obvious that the restriction of rights could and, given the history of the State, probably would be used to refuse information to adopted children about their natural parents. If this is not the Minister's intention, I ask him to review these provisions and improve the wording. As matters stand, I propose to press the amendment.

Amendments Nos. 92 and 94 limit the Minister's right to invent a new public interest objective with a view to restricting rights. The key word in this context is "indicative". The 14 objectives listed are only some of the public interest objectives the Minister may use as a basis for restricting rights. A Minister can, at any time, add to these objectives without consulting elected representatives. As matters stand, restrictions of rights could be justified on any basis. Data centres, for example, have been justified on the basis that they are crucial and in the public interest. Given that a caveat could be applied in respect of anything, it is necessary to introduce some checks and balances. For this reason, we propose to restrict the public interest objectives by providing that a Minister who wants to designate an objective that is not already listed in the Bill as one that is of general public interest will be required to submit the proposal to the Oireachtas for approval. The amendment introduces a check on the Minister's powers in this regard.

Amendment No. 95 requires the Minister to consult the Data Protection Commission before making regulations and present to the Joint Committee on Justice and Equality his rationale should he ignore the advice of the commission. In that respect, the amendment is in line with previous amendments.

Of the 12 amendments in the group, six are in my name. The purpose of section 57 is to protect the public and other objectives of general public interest. I state categorically that it does not restrict, nor will it be used to restrict, the data protection rights of citizens. For example, the Medical Council or the Property Services Regulatory Authority may have good reason to investigate a doctor or estate agent on foot of a complaint by a patient or client alleging unfitness to practice or otherwise. If the data protection rights of the individuals in question are not restricted on a temporary basis while the complaint is investigated, the doctor or estate agent could apply to have his or her data rectified, restricted or erased in certain circumstances. Any of these actions would put paid to an investigation, which would be to the detriment of the complainant and the regulatory body charged with supervision.

Regulations made under this section will permit regulatory bodies to carry out their statutory obligations to conduct inquiries or investigate complaints in the knowledge that those being investigated will not be permitted to exercise data subject rights in a manner that could jeopardise the regulatory body's performance of its statutory functions. Persons under investigation will not be permitted to exercise rights to rectification or erasure of their personal data while the investigations are ongoing. I say this against the background of the importance of meeting the conditions set out in Article 23 of the general data protection regulation in the text of section 57.

Subsections (1) and (2) give effect to the introductory text of Article 23.1 of the GDPR. Subsection (3) restricts the exercise of data subject rights. These are important issues and include Cabinet confidentiality and parliamentary privilege. We need to be mindful of many examples, including in the context of protected disclosures and other whistleblowing activity.

Amendment No. 86 is a drafting amendment that substitutes revised text for subsection (2). Amendment No. 87 removes reference to judicial independence and court proceedings from subsection (3)(a)(i), while amendments Nos. 194 to 196, inclusive, make more detailed provision for restrictions on the exercise of data subject rights in the case of courts acting in their judicial capacity. Amendment No. 89 inserts reference to the Comptroller and Auditor General alongside the Data Protection Commission and Information Commissioner. This will protect investigations and inquiries undertaken by the Comptroller and Auditor General in the performance of his or her constitutional and statutory functions.

As regards other amendments, my position is as follows. While I cannot accept amendment No. 85, which is not in line with Article 23 of the GDPR, I can accept amendment No. 88 tabled by Deputies Clare Daly and Mick Wallace. Amendment No. 90 is unnecessary in light of the requirement in subsection (10) that any regulations must "respect the essence of the right to data protection and protect the interests of the data subject". I cannot accept amendment No. 91, which seeks to delete subsection (5)(b), nor can I accept amendment No. 92, which seeks to limit the scope of "important objectives of general public interest" contrary to Article 23.1(e) of the GDPR. As regards amendment No. 94, it repeats the content of the existing subsection (8) and paragraph (b) duplicates the content of subsection (11). For these reasons, I cannot accept the amendment. I will accept amendment No. 95.

Amendment No. 97 would, if accepted, breach the GDPR insofar as the controller or processor is responsible for carrying out impact assessments. This is not a task for the data protection authority, not least because it would erode the authority's independence, which is important in the context of the legislation. As I stated in respect of section 48, the cumulative effect of the provisions proposed would be excessive and disproportionate. The making of regulations could take six, eight or nine months or perhaps longer. There are circumstances in which we would find that to be less than acceptable. In view of the issues I have outlined, I will not accept amendment No. 97.

As with several other sections, the phrase "public interest" can be used to justify many things. While it is important to protect the public interest, it can often be used by organisations, agencies and government to make decisions that suit their objectives at a particular time. Articles 9 and 145 of the GDPR specifically cover these matters. In the absence of a proper definition of public interest and in view of the wide powers and discretion provided for the Minister under this section, I will oppose the section and support the amendments proposed by Deputies Clare Daly and Mick Wallace.

Before I call Deputy O'Callaghan, I welcome Ms Gina Long back to the clerk's seat.

She was our clerk from the outset back in the 1990s up to 2016.

I welcome Ms Long. She picked a terrible meeting to come back to. Of all the meetings in all the rooms.

I am not surprised Mr. Damian Byrne moved out for a while.

On section 57, yesterday we brought in amendment No. 5. If regulations are going to be made under section 57, the Minister is going to have to lay them before the Oireachtas for prospective approval. The Minister did not mention his own amendment, amendment No. 87. Will he tell us why he is removing judicial independence as one of the important objectives of general public interest? Is it because the Minister for Transport, Tourism and Sport has asked him to do so? Perhaps not. I would be interested to hear the logic behind that provision.

I am interested in amendment No. 92, proposed by Deputies Clare Daly and Mick Wallace. Subsection (7) of section 57 sets out important objectives of general public interest referred to in subsection (6). It is better to have it slightly vague so that paragraphs (a) to (n) are not exclusive and that one can go beyond them. Given the way this could be challenged in court, we could have a large corporation challenging regulations that have been made by the Minister and approved by the Oireachtas. If it is the case that subsection (7) states that the important objectives can only include (a) to (n), that is a good opportunity for them to say the regulations are not valid because they do not come within that list. On balance, we are better off not limiting the scenarios pursuant to which general public interest can be identified. It is very broad. If we limit it, there may be a situation that we have not envisaged whereby regulations in respect of public interest are introduced.

A lot of the time here, we are thinking of situations that will arise where a villainous Minister is issuing regulations supported by an oppressive Government and the rest of us are trying to oppose them. The reality is that it will be large corporations trying to challenge regulations that have been brought in by the State.

I will be supporting amendment No. 95. Amendment No. 96 is effectively provided for because of amendment No. 5. I do not think it is necessary for that reason. Amendment No. 97 is proposed by Deputy Donnchadh Ó Laoghaire. I would make the same point again. It is legislation that is being made by way of regulation although it is referred to as secondary legislation. We should do it. I understand Deputy Ó Laoghaire's point. We are not farming it out to the Data Protection Commissioner. We should make our decision based on what we view as being in the public interest. The elected Members of the Oireachtas are much more in tune with what is or is not in the public interest than any statutory body established by us.

In response to an issue raised by Deputy O'Callaghan in respect of amendment No. 85, removing reference to judicial independence and court proceedings, that provision in fact reappears in amendment No. 195, which is probably more appropriate. It provides that, "The rights and obligations ... are restricted to the extent that the restrictions are necessary and proportionate to safeguard judicial independence and court proceedings." This amendment is in respect of section 156, which we will address later on.

Amendment put and declared lost.

I move amendment No. 86:

In page 37, to delete lines 8 to 10 and substitute the following:

“(2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.”.

Amendment agreed to.

I move amendment No. 87:

In page 37, lines 14 and 15, to delete “judicial independence and court proceedings,”.

Amendment agreed to.

I move amendment No. 88:

In page 37, line 33, after “the”, where it firstly occurs, to insert “commercial”.

Amendment agreed to.

I move amendment No. 89:

In page 37, to delete lines 39 to 41 and substitute the following:

“(c) the personal data concerned are kept—

(i) by the Commission for the performance of its functions,

(ii) by the Information Commissioner for the performance of his or her functions, or

(iii) by the Comptroller and Auditor General for the performance of his or her functions.”.

Amendment agreed to.

I move amendment No. 90:

In page 38, line 4, to delete “Subject” and substitute “Having regard to the balance of the rights and freedoms of data subjects and the rights and freedoms of others, and subject”.

Amendment put and declared lost.

I move amendment No. 91:

In page 38, to delete lines 13 to 15.

Amendment put and declared lost.

I move amendment No. 92:

In page 38, to delete line 21 and substitute the following:

“(8) The important objectives of general public interest referred to in subsection (6) are limited to:”.

Amendment put and declared lost.
Amendment No. 93 not moved.

I move amendment No. 94:

In page 39, between lines 31 and 32, to insert the following:

“(8) (a) In circumstances where it is necessary to restrict the rights and obligations referred to in subsection (1) for important objectives of general public interest other than those listed in paragraphs (a) to (n) of subsection (7), the Minister shall cause to be laid before both Houses of the Oireachtas a written statement of those further objectives.

(b) Regulations may be made restricting the rights and obligations referred to in subsection (1) only if a resolution approving the written statement laid before the Houses under paragraph (a) has been passed by each House.”.

Amendment put and declared lost.

I move amendment No. 95:

In page 39, to delete lines 38 and 39, and in page 40, to delete lines 1 to 8 and substitute the following:

“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission, and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee,

or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission, and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”.

Amendment put and declared carried.

I move amendment No. 96:

In page 40, between lines 8 and 9, to insert the following:

“(11) Regulations may be made under this section only if—

(a) a draft of the proposed regulation has been laid before the Houses of the Oireachtas, and

(b) a resolution approving the draft has been passed by each House.”.

Amendment agreed to.

I move amendment No. 97:

In page 40, between lines 8 and 9, to insert the following:

“(11) (a) Any regulations under this section shall be referred to the Data Protection Commissioner before their enactment, who shall conduct an impact assessment, undertaken by the Data Protection Commission.

(b) The impact assessment shall have the purpose of ascertaining whether the proposed processing of special categories is—

(i) necessary,

(ii) proportionate,

(iii) in compliance with subsection (4),

(iv) in compliance with the GDPR.

(c) The impact assessment shall be returned to the Minister within three months of the Minister’s referral, and it shall make recommendations as to whether the proposed processing of special categories is in compliance with the criteria laid out in paragraph (b) and shall recommend any changes necessary to the regulation to ensure compliance, or may recommend that the Minister not proceed with the regulation.

(d) In the event that the Minister does not follow the recommendation of the Data Protection Commission, the Government shall—

(i) publish in Iris Oifigiúil a reasoned written explanation of the decision of the Government not to follow the recommendation of the Commission,

(ii) cause to be laid before the Houses of the Oireachtas a statement containing a reasoned written explanation of the decision of the Government not to follow the recommendation of the Commission.”.

Amendment put and declared lost.
Question, "That section 57, as amended, stand part of the Bill", put and declared carried.
Sections 58 to 64, inclusive, agreed to.
SECTION 65

Amendments Nos. 98 to 107, inclusive, are related and may be discussed together. They are all in the Minister's name.

I move amendment No. 98:

In page 42, to delete lines 33 to 39, to delete pages 43 and 44, and in page 45, to delete lines 1 to 7 and substitute the following:

“(1) Notwithstanding subsection (1) of section 8, the Data Protection Act 1988 (Section 2A) Regulations 2013 (S.I. No. 313 of 2013) and the Data Protection Act 1988 (Section 2A) Regulations 2016 (S.I. No. 220 of 2016) shall, in addition to applying for the purposes referred to in that subsection, apply for all other purposes for which they applied immediately before the commencement of that subsection and, in so far only as they apply for the second-mentioned purposes, they shall be deemed to have been made under section 37 and may be amended or revoked accordingly.

(2) (a) The Data Protection Health Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 57(5)(a).

(b) The Data Protection Health Regulations are amended—

(i) in Regulation 3, by—

(I) the deletion of the definition of “the Act”,

(II) the deletion of the definition of “health professional”, and

(III) the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘health practitioner’ has the same meaning as it has in the Health Identifiers Act 2014.”,

(ii) in Regulation 4(1), by—

(I) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and

(II) the substitution of “the physical or mental health of the data subject, but this restriction on providing information applies only to the extent to which, and for so long as, that likelihood pertains.” for “the physical or mental health of the data subject.”,

(iii) in Regulation 5, by—

(I) the substitution of “health practitioner” for “health professional” in each place it occurs,

(II) the substitution, in paragraph (1)(a), of “a request under the said Article 15 of the Data Protection Regulation” for “a request under the said section 4(1)(a)”, and

(III) the substitution, in paragraph (2)(a), of “within the meaning of section 2 of the Medical Practitioners Act 2007 or a medical practitioner practising medicine pursuant to section 50 of that Act” for “within the meaning of the Medical Practitioners Act 1978 (No. 4 of 1978), or registered dentist, within the meaning of the Dentists Act 1985 (No. 9 of 1985)”, and

(iv) by the deletion of Regulation 6.

(c) A request referred to in Regulation 4(1) of the Data Protection Health Regulations which includes a request for health data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.

(3) (a) The Data Protection Social Work Regulations shall continue in force upon and after the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) until the first set of regulations are made under section 57(5)(b).

(b) The Data Protection Social Work Regulations are amended—

(i) in Regulation 3, by—

(I) the deletion of the definition of “the Act”,

(II) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

and

(III) the substitution of the following definition for the definition of “social work data”:

“ ‘social work data’ means personal data kept for, or obtained in the course of, carrying out social work by a public authority, public body, voluntary organisation or other body but excludes any health data within the meaning of the Data Protection (Access Modification) (Health) (Regulations) 1989 (S.I. No. 82 of 1989) and ‘social work’ shall be construed accordingly.”,

(ii) in Regulation 4—

(I) in paragraph (1), by—

(A) the substitution of “a request under Article 15 of the Data Protection Regulation” for “a request under section 4(1)(a) of the Act”, and

(B) the substitution of “the physical or mental health or emotional condition of the data subject, but this restriction on providing information applies only to the extent to which, and for as long as, that likelihood pertains.” for “the physical or mental health or emotional condition of the data subject.”,

and

(II) in paragraph (3), by the substitution of “under Article 15 of the Data Protection Regulation” for “under section 4(1)(a) of the Act”, and

(iii) the deletion of Regulation 5.

(c) A request referred to in Regulation 4(1) of the Data Protection Social Work Regulations which includes a request for social work data (within the meaning of those Regulations) that was received but not responded to before the commencement of section 7 (in so far as it relates to the repeal of section 4(8) of the Act of 1988) shall be treated as if it were a request under Article 15 of the Data Protection Regulation.”.

These are merely drafting amendments. Section 65 is technical. Its purpose is to carry over certain regulations already made under the 1988 Act and thereby obviate the need to remake regulations under this Bill. I dare say the amendments are non-controversial.

Does any member wish to indicate to the contrary?

Amendment agreed to.

I move amendment No. 99:

In page 45, lines 8 and 9, to delete “, subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects,”.

Amendment agreed to.

Amendment No. 100 is a milestone.

I move amendment No. 100:

In page 45, between lines 19 and 20, to insert the following:

“(8) The Regulations of 2011 are amended—

(a) in Regulation 3, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”,

(b) in Regulation 4, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, processing” for “Processing”, and

(c) by the insertion of the following Regulation after Regulation 6:

“7. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 101:

In page 45, lines 21 and 22, to delete “and subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects”.

Amendment agreed to.

I move amendment No. 102:

In page 45, between lines 32 and 33, to insert the following:

“(9) The Regulations of 2015 are amended—

(a) in Regulation 2, by the substitution of “Subject to suitable and specific measures being taken to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and

(b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35 of the Data Protection Act 2018.”.

Amendment agreed to.

I move amendment No. 103:

In page 45, lines 34 and 35, to delete “and subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects”.

Amendment agreed to.

I move amendment No. 104:

In page 46, between lines 7 and 8, to insert the following:

“(10) The Regulations of 2016 are amended—

(a) in Regulation 2, by the substitution of “Subject to suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects, the processing” for “The processing”, and

(b) by the insertion of the following Regulation after Regulation 2:

“3. In these Regulations, “suitable and specific measures to safeguard the fundamental rights and freedoms of data subjects” shall be construed in accordance with section 35 of the Data Protection Act 2018.”.

Amendment agreed to.

I move amendment No. 105:

In page 46, line 10, to delete “Health Regulations” and substitute “Data Protection Health Regulations”.

Amendment agreed to.

I move amendment No. 106:

In page 46, between lines 11 and 12, to insert the following:

“ “Data Protection Social Work Regulations” means the Data Protection (Access Modification) (Social Work) Regulations 1989 (S.I. No. 83 of 1989).”.

Amendment agreed to.

I move amendment No. 107:

In page 46, to delete lines 19 and 20.

Amendment agreed to.
Section 65, as amended, agreed to.
SECTION 66

Amendments Nos. 108, 109, 117, 128, 129, 135 and 189 are related and may be discussed together.

I move amendment No. 108:

In page 47, line 27, to delete “States” and substitute “states”.

There are six amendments that are minor drafting amendments.

Nobody wishes to take up that amendment.

Amendment agreed to.
Section 66, as amended, agreed to.
Section 67 agreed to.
SECTION 68

I move amendment No. 109:

In page 51, line 37, after “matters,” to insert “and”.

Amendment agreed to.
Section 68, as amended, agreed to.
Section 69 agreed to.
SECTION 70

I move amendment No. 110:

In page 54, to delete lines 14 to 18 and substitute the following:

“(a) the Minister, provided that—

(i) the Minister has consulted with such other Minister of the Government as he or she considers appropriate,

(ii) the Minister has consulted with and sought the advice of the Commission, and

(iii) the Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, laid a written rationale for his or her proposed regulation before the Oireachtas Committee on Justice and Equality and any other relevant committee, or

(b) any other Minister, provided that—

(i) that Minister has consulted with the Minister and such other Minister of the Government as he or she considers appropriate,

(ii) that Minister has consulted with and sought the advice of the Commission,

and

(iii) that Minister has, if he or she intends to set out regulations which are not in line with the advice of the Commission, caused to be laid before the Oireachtas Committee on Justice and Equality and any other relevant committee a written rationale for his or her proposed regulations.”

Amendment agreed to.

I move amendment No. 111:

In page 54, between lines 36 and 37, to insert the following:

“(7) Regulations may be made under this section only if—

(a) a draft of the proposed regulation has been laid before the Houses of the Oireachtas, and

(b) a resolution approving the draft has been passed by each House.”.

Amendment agreed to.
Section 70, as amended, agreed to.
SECTION 71

Amendments Nos. 112 and 113 are in the Minister's name.

I move amendment No. 112:

In page 55, line 12, to delete “Where” and substitute “Other than where section 90 applies, where”.

These are drafting amendments to section 71(4) which is intended to ensure coherence between this section and the later section 90 to which mention is made in section 71(4)(b).

Amendment agreed to.

I move amendment No. 113:

In page 55, line 17, to delete “is restricted in accordance with section 90” and substitute “is restricted, as may be appropriate”.

Amendment agreed to.
Section 71, as amended, agreed to.
Sections 72 to 76, inclusive, agreed to.
SECTION 77

Amendments Nos. 114 to 116, inclusive, are related and may be discussed together.

I move amendments No. 114:

In page 58, line 23, to delete “and processor” and substitute “and a processor”.

Section 77 imposes an obligation on data controllers operating under Part 5 of the Bill to have a detailed contract with any processor that carries out data processing activities on their behalf. The intention is to ensure the controller retains overall control over the processing chain, especially where the processor needs to obtain the assistance of a sub-processor. A very simple example is where, for example, the Garda, acting as a controller, obtains documents in a foreign language and transmits them to a translation service, which would be a processor, for translation into the English language. If that translation service does not have the necessary expertise to translate the particular language into English, it may need to obtain the services of another service with the necessary translation expertise, which would be the sub-processor. The proposed amendments to section 77 are technical in nature, but the intention is simply to ensure the controller, which in my example is the Garda, retains control over the personal data contained in the documents. That will enable it to retain control over the data and facilitate the exercise of data subject rights. It will also enable it to demonstrate compliance with the requirements in Part 5 of the Bill to the Data Protection Commission if called upon by the commission to do so. A possible Report Stage amendment is being considered with regard to determining the controller-processor relationship between the Office of the Director of Public Prosecutions and the prosecuting counsel on behalf of the State.

Amendment agreed to.

I move amendment No. 115:

In page 58, line 35, after “processor” to insert “(in this section referred to as a “secondary processor”)”.

Amendment agreed to.

I move amendment No. 116:

In page 59, to delete lines 16 to 25 and substitute the following:

“(4) Where a controller gives an authorisation, whether specific or general in nature, to a processor, including a secondary processor (in this section referred to as “the procuring processor”) to procure the services of a secondary processor, the procuring processor shall inform—

(a) the controller, and

(b) where relevant, any processor who procured the services of the procuring processor in relation to the processing concerned, in advance of any such procurement or of a change in the terms of such procurement.

(5) Where a procuring processor procures the services of a secondary processor to carry out processing on behalf of a controller, subsections (1) and (2) shall apply to the procuring processor and the secondary processor, subject to the following modifications and any other necessary modifications:

(a) a reference to a “controller”, other than in subparagraphs (ii), (iv), (v) and (vi) of subsection (2)(d), shall be construed as a reference to the procuring processor,

(b) a reference to a “controller” in subsection (2)(d)(iv) shall be construed as a reference to the controller and the procuring processor,

(c) a reference to a “controller” in subsection (2)(d)(v) shall be construed as a reference to the controller or the procuring processor, as appropriate, and

(d) a reference to a “processor” shall be construed as a reference to a secondary processor.”.

Amendment agreed to.
Section 77, as amended, agreed to.
Sections 78 to 82, inclusive, agreed to.
SECTION 83

I move amendment No. 117:

In page 64, lines 34 and 35, to delete “data protection breach” and substitute “personal data breach”.

Amendment agreed to.
Section 83, as amended, agreed to.
SECTION 84

This is a standalone amendment.

I move amendment No. 118:

In page 66, between lines 15 and 16, to insert the following:

“(9) Should a data subject request information in relation to a personal breach which affects them, they have the right to be provided with all the pertinent information in respect of that breach and nothing in subsections (2), (4) or (6) shall place a restriction on their access to that information.”.

This amendment is pertinent in light of recent events. Section 84(1) deals with situations where a personal data breach occurs and is likely to result in a high risk to the rights and freedoms of a data subject. In such cases, the controller shall provide him or her with the details of the breach. I wish to add that if a data subject requests information in regard to a personal breach which affects him or her, he or she has a right to be provided with all of the pertinent information in respect of that breach. It would provide a statutory basis for people being given information without having to write to the Data Protection Commissioner or go to court. I am interested in hearing what the Minister has to say.

I have a problem with the clarity of the issue. As I mentioned in the Seanad when dealing with a similar amendment, I am unable to accept an amendment which would insert a new subsection (9) in section 84.

Under section 84 there is already an obligation on a controller to inform a data subject where there is a high risk to the data subject's rights and freedom arising from a breach. In such a case, the controller, in clear and plain language, must notify the data subjects of the nature of the breach, its likely consequences and a description of the measures taken or proposed to be taken to mitigate its possible adverse effects. The proposed amendment refers to a data breach which affects a data subject. It is far from clear what it is intended to mean. Under the GDPR and the law enforcement directive, the thresholds for informing the Data Protection Commissioner of a data breach and informing the data subject whose data protection rights have been breached are defined in terms of risks for the data subject arising from the breach.

If a data breach involves a high risk for the data subject, then the data subject must be given all relevant information and may require further information. I should add that acceptance of the amendment would also create a confusing and perhaps even undesirable divergence between the reporting thresholds in the section and the corresponding provision in the GDPR. I know where Deputy O'Callaghan is coming from, but I am somewhat concerned that we would be making matters less certain. For those reasons, I am not minded to accept the amendment. Perhaps the Deputy would like to think about it further.

I will reply briefly. Obviously, my concern is that under section 84(1), a data subject is only entitled to be given information in respect of a breach where that breach is likely to result in a high risk to the rights and freedoms of a data subject. Somebody who has breached a person's data rights will be able to justify not giving him or her the information on the basis that there was no high risk to the rights and freedoms of the data subject. I will re-examine the issue for Report Stage. The way to deal with it may be to table an amendment to section 84(1) rather than inserting a new subsection.

The Deputy is withdrawing the amendment.

Yes, for the time being.

Amendment, by leave, withdrawn.
Section 84 agreed to.
SECTION 85

Amendments Nos. 119 to 124, inclusive, are grouped.

I move amendment No. 119:

In page 66, lines 17 and 18, to delete “A controller, other than an independent judicial authority acting in its judicial capacity,” and substitute the following:

“A controller, other than—

(a) a court, or

(b) another independent judicial authority, acting in its judicial capacity,”.

This is a technical amendment. The revised wording is closer to the text of paragraph 2 of Article 32 of the directive. I will briefly refer to the other amendments at this stage.

I recognise the intent on the part of Deputies Daly and Wallace in respect of amendment Nos. 120 to 123, inclusive. They wish to bring the content of the section into line with the corresponding provision in the GDPR. While the directive does not contain or require the same level of detail, I will consider the matter with a view towards a Report Stage amendment if the Deputies withdraw their amendments today. I know what they are trying to achieve, but I do not want to have different consequences.

I see the reasoning of Deputy Ó Laoghaire but I cannot accept amendment No. 124 because it deals with the risk that a data protection officer might encounter non-co-operation, harassment, duress or even victimisation in the workplace as a result and would no longer be in a position to perform his or her duties. We considered that matter during the Seanad discussions in the context of a similar amendment. I am strongly of the view that a more effective remedy is already available to data protection officers under the Protected Disclosures Act 2014 and that it is better that we address these issues under that Act rather than introduce them into data protection.

We will not fight over this. The Minister is prepared to examine the issue on Report Stage. We are trying to protect the independence of the data protection officer.

While going along with that and taking on board the Minister's point that data protection officers might have recourse to the protected disclosures legislation, there might be some overlap in some cases. They might make protected disclosures to bring themselves within the scope of this Bill. We think it would be preferable to avoid the need for them to artificially bring themselves under the protected disclosures legislation if they could get protection under this Bill. That is what we are trying to do.

Part of the confusion is that Part 5 is a new Bill. A second Bill has been inserted into the Bill to give effect to the criminal justice directive. Due to the fact that the GDPR does not apply to the criminal justice system, not everything is transposed and so on. We are trying to give data protection officers specific protection against victimisation and being penalised for doing their job. We are allowed to go beyond the directive. That is what we are trying to do and it is necessary because by going beyond the directive we are bringing them in line with the GDPR. That is all that is being sought. We will withdraw the amendment, but if the Minister does not address the issue at a later Stage with something better we will come back with this.

Are amendments Nos. 120 to 123, inclusive, all being withdrawn?

The reason Deputies Daly and Wallace brought forward their amendments and I brought forward mine is that it is quite easy to imagine the circumstances in which a data protection officer is doing his or her job and the data controller has his or her own reasons for trying to frustrate the process. The organisation he or she is responsible for may not be complying properly with data protection or may be abusing or misusing people's data or being careless in some respect. One can see how it would be in the interests of the data controller to frustrate, victimise or harass a data protection officer. That is very apparent.

I appreciate there is the Protected Disclosures Act, but that could be a cumbersome mechanism in some respects. If this all relates to data I do not see how a data protection officer could not say to the Data Protection Commissioner that he or she has an issue with data protection in the organisation in which he or she works and is being frustrated by his or her superior, that is, the data controller and is seeking an intervention and assessment. That is reasonable. There are probably a number of ways that could be done. The existing subsection on corrective powers could be used to facilitate that.

I will press my amendment, but I will not call a vote. I would appreciate if the Minister could consider that. There must be another mechanism beyond the protected disclosure legislation, which would be potentially cumbersome and probably quite slow.

It is my firm belief that a more effective remedy already exists in law, namely, the 2014 Act, section 7 of which deals with the issue in a comprehensive way. I am satisfied that it provides an effective remedy where a data protection officer is experiencing difficulty in the performance of his or her functions.

An important thing to take into account is the fact that a data protection officer who makes such a protected disclosure would enjoy the extensive protections against dismissal and against victimisation or any form of loss or detriment which is provided specifically under Part 3 of the 2014 Act. I believe it is better and clearer if it is under that umbrella. I note what Deputy Ó Laoghaire has said.

Amendment agreed to.
Amendments Nos. 120 to 123, inclusive, not moved.
Section 85, as amended, agreed to.
NEW SECTION

I move amendment No. 124:

In page 67, between lines 22 and 23, to insert the following:

“Protection of Data Protection Officers

86. (1) The Data Protection Commission shall provide a protection, whereby Data Protection Officers may seek the assistance of the Data Protection Commissioner, due to the fact that the Data Protection Office is not in a position to carry out their role fully, due to inappropriate interference from the Data Controller, or duress, harassment or victimisation.

(2) Where the Commission receives a complaint under subsection (1), it shall, in addition, make a decision—

(a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

(b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.”.

Amendment put and declared lost.
SECTION 86
Question proposed: "That section 86 be deleted."

Having considered the matter and engaged in consultation, it appears the intended exclusion of Forensic Science Ireland from the provisions of chapter 4 of Part 5 is not required.

Question put and agreed to.
Section 87 agreed to.
SECTION 88

Amendments Nos. 125 to 127, inclusive, are related and may be discussed together.

I move amendment. No. 125:

In page 68, line 32, after “concerned” to insert “, including the legal basis for any transfers of data”.

With these amendments, we are adding two points of information to the list in section 88(2) that data subjects have a right to get from data controllers. Most of the items of information in subsection (2), such as information on controller's contact details and the right to lodge a complaint, are replicated in the GDPR and the directive but two of them, namely, the legal basis for any transfers and such further information as is necessary to enable the data subject to exercise his or her rights, which are in the GDPR, have not been included in this Bill. I understand that they are not specified in the directive but, unlike the GDPR, we can go beyond it to strengthen people's rights in this area. That is what we are trying to do.

Amendment No. 126 proposes that the obligation regarding legal transfers will only apply in individual cases where further information is necessary to enable the data subject to exercise his or her rights.

Amendment No. 127 is the third in the group.

Is there another amendment?

No. The amendments are Nos. 125 to 127, inclusive.

I do not believe amendment No. 127 should be grouped with the other two.

It relates to another section but it is part of the grouping.

It is funny that it is grouped here. It is slightly different as the GDPR Article 13.2(f) gives people the right to be given information about the existence of automated decision-making, including profiling. The right is not replicated in the directive or this Bill and we think it is no harm to put it in there as it could be valuable. The directive prohibits automated processing, including profiling, that results in discrimination. To enforce the right not to be profiled in a discriminatory way, a data subject has to know they have been subjected to automated processing. To know that, he or she would have to be told about it when he or she exercised his or her right to access information under section 89. At the moment, section 89 does not oblige controllers to inform people of the fact that they have been profiled or subjected to automated processing.

This section is in Part 5, which means we are talking about the potential profiling of innocent people in a discriminatory way by the Garda. We know that ethnic profiling has taken place, so we are trying to provide that a person who asks for information about what the Garda has been up to with his or her data will get the information they need.

Amendment No. 126 is not needed because paragraph (f) of subsection (2) imposes an obligation on the controller to provide further information to a data subject to enable him or her to exercise his or her Part 5 rights.

As regards amendment No. 127, section 89 gives effect to Article 14 of the directive. Rights relating to automated data processing, including profiling, are set out directly in Article 11 of the directive and in section 87 of the Bill.

I am reluctant to accept amendment No. 125, which proposes to insert a specific reference to the legal basis for any transfers of personal data in section 88. The existing reference to the legal basis for processing the data includes reference to transfers because of the wide definition of processing in section 66. In accordance with the definition in section 66, it is clear that processing includes the disclosure of data by transmission, dissemination or otherwise making the data available. This would include the transfer of personal data. My concern is that the inclusion of a specific reference to transfers of data in this section could well cast doubt on its usage, validity or application in other parts of the Bill. Subsection (2)(f)(iii) requires that information be given on categories of recipients, and this includes recipients in third countries and in international organisations.

I will not accept amendment No. 125 and amendment No. 126 is not needed. In respect of amendment No. 127, section 89 refers to Article 14 of the directive.

Section 88 deals with the right to information and it should be drafted in a broad way to facilitate access to that information for individuals. For that reason, I will support amendment No. 125. I also think amendment No. 126 is appropriate. The Minister's only objection to it is that it is not needed. That may be the case but I do not see any harm in replicating it, notwithstanding the fact that it is referred to previously. If there is any legal doubt over it, the fact that it is expressly contained in section 88 will be of assistance to the person who is seeking information.

I will not support amendment No. 127 as it is too vague. It refers to looking for information relating to the logic involved, but it is very difficult to get a definition of logic in statutes.

Amendment put and declared carried.

I move amendment No. 126:

In page 68, line 36, to delete “data.” and substitute the following:

“data;

(iv) such further information as is necessary to enable the data subject to exercise his or her rights under this Part.”.

Amendment put and declared carried.
Section 88, as amended, agreed to.
SECTION 89

I move amendment No. 127:

In page 69, line 30, to delete “interest.” and substitute the following:

“interest;

(vi) in circumstances where the data subject has been or is being subjected to automated decision-making, including profiling, the fact of same, and information in relation to the logic involved in the automated decision-making, as well as information in relation to the significance and envisaged consequences of such processing for the data subject.”.

Amendment put and declared lost.
Section 89 agreed to.
SECTION 90

I move amendment No. 128:

In page 71, line 23, to delete “sections 91(4)(ii) and 92” and substitute “section 91(4)(ii)”.

Amendment agreed to.

I move amendment No. 129:

In page 71, line 35, to delete “sections 91(4)(ii) and 92” and substitute “section 91(4)(ii)”.

Amendment agreed to.
Section 90, as amended, agreed to.
Section 91 agreed to.
SECTION 92

Amendments Nos. 130 and 131 will be discussed together by agreement.

I move amendment No. 130:

In page 76, line 4, to delete “privilege.” and substitute “privilege;”

The new paragraph (j) is inserted in subsection (3) of the section in order to protect investigations, inquiries and prosecutions undertaken by the data protection commission into alleged infringements of the law enforcement directive, including data breaches. It carries over the current provision in section 5(1)(gg) of the Data Protection Act 1988, which was overlooked during the drafting process.

Amendment agreed to.

I move amendment No. 131:

In page 76, between lines 4 and 5, to insert the following:

“(j) the performance by the Commission of its functions.”.

Amendment agreed to.
Section 92, as amended, agreed to.
Sections 93 to 98, inclusive, agreed to.
SECTION 99

I move amendment No. 132:

In page 82, line 39, to delete “an independent judicial authority acting in its judicial capacity” and substitute “the courts when acting in their judicial capacity”.

Amendment No. 132 is a drafting amendment that clarifies that the data protection commission shall be competent to supervise the data processing operations of all bodies except the courts when acting in their judicial capacity.

Amendment agreed to.
Section 99, as amended, agreed to.
Sections 100 to 102, inclusive, agreed to.
SECTION 103

Amendments Nos. 133, 137 to 154, inclusive, and 159 to 171, inclusive, are related and may be discussed together.

I move amendment No.133:

In page 84, after line 34, to insert the following:

“ “complainant” means a complainant within the meaning of Chapter 2 or Chapter 3;".

I will withdraw the amendment as there is already a definition of complainant contained in section 105. Amendment No. 138 is similar to amendment No. 137 which was tabled by Deputy Ó Laoghaire. On balance, I prefer his drafting which is more concise. It simply states that on receipt of a complaint the commission shall investigate the complaint, and issue a formal decision on the conclusion of the investigation, unless it is frivolous or vexatious. I think that capacity should be retained but there is also the statutory obligation on the commission to investigate the complaint.

Is Deputy O'Callaghan indicating he will withdraw amendment No. 138 in favour of amendment No. 137?

I will wait to hear what the Minister has to say first.

Before I bring in the Minister, I will indicate to members that amendments Nos. 138 and 139 are physical alternatives to amendment No. 137. Amendment No. 139 is a physical alternative to amendment No. 138. Amendments Nos. 144 to 146, inclusive, are physical alternatives to amendment No. 143. Amendment No. 148 is a physical alternative to amendment No. 146. Amendment No. 160 is a physical alternative to amendment No. 159. Amendments Nos. 164 to 167, inclusive, are physical alternatives to amendment No. 163. Amendment No. 169 is a physical alternative to amendment No. 168 and amendments Nos. 133, 137 to 154, inclusive, and amendments Nos. 159 to 171, inclusive, will be discussed together. I invite the Minister to respond to Deputy O'Callaghan and then I will bring in the other members when they have heard the Minister's response.

Sections 103, 107, 108, 109, 111, 120 and 121 deal with the complaints handling process, which is both streamlined and comprehensive. I will focus on the key amendments. As regards Deputy Ó Laoghaire's amendment No. 137 and Deputy O'Callaghan's amendment No. 138, both of which would replace section 107(1), I have a serious problem with the introduction of a discretion on the part of the commission not to investigate a complaint that is "frivolous or vexatious."

Amendments Nos. 139, 144, 159, 160, 164 would also allow the commission to decide not to investigate complaints on the basis that they were considered to be frivolous or vexatious. I am completely opposed to the introduction of this discretionary filter into the Bill for a number of reasons. First, it would not be compliant with the GDPR. Second, while the term "frivolous or vexatious" has a specific meaning in our law when used by the courts, that is, that the claim is unsustainable in law and is bound to fail, the term is not understood in other member states, except possibly in a common law jurisdiction such as the UK. On the contrary, to a data subject or a data protection authority in another member state, use of the word "frivolous" suggests that the matter is not regarded as sufficiently serious for investigation, while "vexatious" suggests that the complaint is seen as a deliberate intention to cause annoyance. The scope for such misunderstandings will be much greater under the "one-stop-shop" mechanism because the data protection commission will be acting as lead supervisory authority in many cross-border cases.

Unfortunately, the term "frivolous and vexatious" is used in section 10(1)(b) of the 1988 Act and it has created confusion and misunderstandings in recent years, especially in cross-border cases. In the Schrems judgment, Judge Hogan commented that the wording of that provision "is somewhat unfortunate and perhaps even unhelpful". Its use was widely misinterpreted and misunderstood in the aftermath of that case in which Mr. Schrems successfully contested the adequacy of the safe harbour mechanism. His original complaint concerning the shortcomings of the safe harbour mechanism had been rejected on the grounds that it was frivolous or vexations, that is, unsustainable in law because of the European Commission's decision to recognise the adequacy of privacy safeguards provided by the safe harbour mechanism.

The risk therefore of misinterpretation or misunderstanding will be very much greater in future because of the expected increase in the number of "one-stop-shop" cases handled by the data protection commission, which have originated in other member states. As I said, I cannot accept the alternative models put forward in the amendments to the complaints-handling mechanisms in Chapters 2 and 3 of Part 6. I ask for the understanding and support of the committee in the avoidance of any reference to the term "frivolous and vexatious". I believe that the robustness and effectiveness of the mechanisms outlined in Part 6 will be compromised by the introduction of a filter based on the commission's opinion as to whether a complaint it has received is "frivolous or vexations".

As regards amendments Nos. 140 and 161, a reference to consent of the parties is not required because an amicable resolution cannot take place without the consent of the parties in any event.

On section 108, I am not in favour of replacing reference to 107(5)(e) with a general reference to section 107(1) as proposed by amendment No. 147, where a complaint, following an examination by the commission under section 107(1), has been rejected or dismissed under 107(5)(a) or (b), a data subject has a specific right to appeal against that decision under section 148(a). Where the commission, following an examination of a complaint, has already issued an enforcement notice on the controller or processor in any of the situations referred to in section 107, the carrying out of a further inquiry would be unnecessary. The same applies where a data subject has been provided with advice by the commission, for example, where a data subject is seeking compensation and the commission explains that compensation remains a matter for the courts.

Amendments Nos. 149 and 170, which seek to insert new sections into the Bill, contain provisions that are taken from surrounding sections without deletion of those provisions. This would give rise to confusion and legal uncertainty. I cannot accept the amendments as drafted but I am happy to come back to them on Report Stage. The word "where" is correct and is consistent with usage throughout the Bill. I cannot accept amendment No. 171.

In summary, sections 107, 108, 120 and 121 of the Bill provide, in my view, a coherent and streamlined approach to the future handling of complaints by the Data Protection Commission and I am not disposed to accepting amendments that would militate against that coherence or streamlined frame that is envisaged under the Bill.

In regard to the Minister's response to amendments 137 to 139, inclusive, I am sure that like me the other Deputies involved were of the view that these amendments would strengthen the obligations rather than weaken them or create any greater discretion, particularly, in the first instance, the word "investigate" as opposed to "examine" and, in the second instance, the reference to a formal decision, except where a matter is frivolous or vexatious. As mentioned by the Minister, the words "frivolous" and "vexatious" are frequently used in respect of cases which fail to reach a fairly low threshold. I note what the Minister says but it appears to me that as things stand in the Bill there is greater discretion and flexibility than would be the case were amendments Nos. 137 and 138 accepted, in regard in particular to the requirement for a formal decision, which, I think, is important.

The thinking behind these amendments is, in part, based on what has been told to us by the chairperson of GSOC, namely, that a lot of complaints come in at a very low level and her preference would be that those complaints, which are work-related complaints, be dealt with by senior officers of the garda against whom the complaint is made. The intention was to give the commission some leeway to reject complaints that appeared to be frivolous or vexatious. I appreciate the Minister's point that this has a legal connotation. I am happy if the Minister commits to look at this again on Report Stage. I think some mechanism and statutory power needs to be given to the commission to allow it deal with complaints that it believes do not merit extensive investigation. If this is not done, the commission will be bogged down in that it will have to investigate every complaint made, irrespective of how small it is and irrespective of the cost of any investigation in that regard. The investigating commission should be given the power to reject complaints which appear to be unlikely to succeed or disclose no cause of action.

I am happy to take another look at the amendments and to engage bilaterally with the Opposition Members who tabled them. I am anxious to ensure that the provisions of Part 6 are not compromised by the introduction of a new layer in terms of whether a complaint is frivolous or vexatious. I am conscious that there are different interpretations and different understandings in this regard. However, I will take another look at the amendments. I do not want to overestimate what is a real problem. Given the manner of interpretation of words such as this I am concerned. It is within this framework that I would be happy to discuss the matter further. I am happy to listen further to Deputy Ó Laoghaire and Deputy O'Callaghan, as always.

I beg leave of the committee at this point as I have an important meeting to attend at 5 p.m., for which I am already late. I will leave the committee in the very capable hands of the Minister of State, Deputy Pat Breen, who under the Department of the Taoiseach has special responsibility in this area.

The Minister of State, Deputy Breen, is taking up the baton.

He is very welcome.

I have all night.

I thank the Minister, Deputy Flanagan, for being here. I ask members to please note it is my sincere hope that we will drive this Bill to a conclusion this evening.

Are there any further contributions on this grouping before we move on?

I welcome that the Minister is willing to take another look at the amendments for Report Stage.

Amendment, by leave, withdrawn.

I move amendment No. 134:

In page 85, between lines 11 and 12, to insert the following:

“(3) Where a person is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3—

(a) a reference in sections 115, 126 and 133(10) to a controller shall be deemed to be a reference to the appropriate authority that, or the Minister who, made the designation, and not to the person, and

(b) a reference in sections 130(6) and 131(10) to a controller shall be deemed not to include a reference to the person.”.

Amendment agreed to.
Section 103, as amended, agreed to.
Section 104 agreed to.
SECTION 105

Amendment No. 135 is co-sponsored by the Minister and Deputy O'Callaghan and it was discussed with amendment No. 108. I ask Deputy O'Callaghan to move the amendment.

I move amendment No. 135:

In page 86, line 8, to delete “Article 77(2)” and substitute “Article 77(1)”.

Amendment agreed to.
Section 105, as amended, agreed to.
NEW SECTION

Amendments Nos. 136, 155 to 158, inclusive, and 172, 173 and 190 are related and may be discussed together by agreement.

I move amendment No. 136:

In page 86, between lines 18 and 19, to insert the following:

“Rights under Article 80(1)

106. (1) In addition to the rights conferred on a data subject under Article 80(1) to mandate a not-for-profit body, organisation or association to which Article 80(1) applies to lodge a complaint on his or her behalf with the Commission and, under section 15(7) to take a data protection action on behalf of the data subject, a not-for-profit body, organisation or association to which Article 80(1) applies may, independently of a data subject's mandate, and if it considers that the rights of a data subject under a relevant enactment have been infringed as the result of the processing of personal data in a manner that fails to comply with a relevant enactment, take the following actions on behalf of a data subject:

(a) lodge a complaint with the Commission under section 107;

(b) exercise the rights referred to in section 115 and section 148.

(2) Where the Commission or a court, in performing its functions under this Act, has reasonable doubts as to whether a particular body, organisation or association is one to which Article 80(1) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.”.

Deputy Clare Daly was supposed to speak to amendment No. 136. I would like to speak to amendments Nos. 155 to 158, inclusive. Section 115(7) of the Bill as drafted permits not-for-profit bodies such as, for example, Digital Rights Ireland, to bring an action on behalf of a data subject when it has been mandated by the data subject to do so. However, as argued by Dr. T.J. McIntyre during the pre-legislative scrutiny process, the Bill should provide that not-for-profit bodies also be allowed to independently bring actions without their having to be mandated by an individual data subject to do so. Amendment No. 155 seeks to remedy this. Perhaps the Minister of State, Deputy Breen, will explain why the Bill excludes this as I understand Article 80 includes this possibility as a discretionary provision, although in such cases compensation for damages would not be awarded unless the Article 80 body was specifically mandated by a data subject to bring the action.

Amendment No. 156 is an attempt to address the lack of provision in the Bill for a not-for-profit body of the type described in Article 80 of the GDPR, for example, Digital Rights Ireland, to bring an action for compensation for damages on behalf of a data subject. I do not understand why this is prohibited. Dr. T.J. McIntyre made a compelling case for it during the pre-legislative scrutiny phase. He said that, without it, there would be a gap in protection for data subjects. We must remember that when a data subject seeks to take a case for a data breach or violation of his or her data rights, he or she would in many instances be forced to discuss sensitive personal data publicly. Therefore, many people would be reluctant to come forward and become the public face of an issue. There is also the fact that many, if not most, individuals affected would not have the financial ability to bring an action themselves. Class actions are not permitted in Ireland as of yet. If a large number of people are affected by a single data breach, it makes sense on a practical level that they could be represented by a single Article 80 body instead of them taking cases individually, which the courts would not be equipped to handle. Surely it would make sense that Digital Rights Ireland, for example, should be allowed to act on behalf of such people if it is mandated to do so, as the GDPR permits, without taking the possibility of compensation off the table for complainants.

There are eight amendments in this grouping, all of which are in the names of Deputies Daly and Wallace. Would the Minister of State like to respond?

Yes. Section 115 makes provision for a judicial remedy in the case of infringements of the GDPR. Article 80.2 of the GDPR recognises that a member state may allow in its national laws for a not-for-profit body, association or organisation to take action on behalf of a data subject without the data subject's mandate. However, that is not part of our law and compliance with the GDPR does not require such a provision.

The restrictions in the Bill on the taking of compensation claims by a not-for-profit body, association or organisation is understandably intended to discourage speculative compensation claims, especially where the data subject will be relieved of any risk that costs of the action might be awarded against him or her. There are sound public policy reasons for discouraging the growth of a compensation culture in respect of data protection claims, which is reflected in the Bill's provisions. As Deputy Wallace may be aware, there is already concern at the level of compensation claims, which is contributing to increasing insurance premiums and affecting business, especially SMEs. I am very conscious of this matter when I wear my other ministerial hat.

I cannot accept subsection (8) as proposed in amendment No. 155 or subsection (9) as proposed in amendment No. 157. The same applies to amendment No. 136, which seeks to make provision for the taking of action on behalf of a data subject without a mandate, or permission, from him or her. Deputy Wallace referred to amendment No. 156. I cannot accept it, as it would allow courts to award compensation to data subjects in cases taken under section 115 by a not-for-profit body, association or organisation on their behalf.

Regarding amendment No. 158, the position is that Article 55 of the directive, unlike the GDPR, does not provide for actions to be taken on behalf of data subjects without their permission. For this reason, I cannot accept the amendment, which would allow a not-for-profit body, association or organisation to take action on behalf of a data subject under section 118 without his or her permission. This is understandable, given that the data subject might have specific reasons for not wishing the case to be taken.

I cannot accept the proposed changes in amendments Nos. 172 and 173 to section 126 for the reasons already outlined in respect of the GDPR. That being the case, amendment No. 190, which proposes to amend section 146(1) in order to accommodate the withdrawal of complaints by a not-for-profit body, association or organisation that has not been mandated to act on behalf of a data subject, is not required.

Would Deputy Wallace or any other member like to reply to the Minister of State's contribution?

We are being guided by Dr. McIntyre on this matter. We found him to be in a different class than everyone else, as he understands this matter better than all of us, so we will stick with his guidelines and press the amendments.

Deputies Wallace and Daly have tabled a significant amendment. The consequence of it would be that, if someone's data were breached and he or she did not want to make a complaint or take an action, a not-for-profit body could take an action on his or her behalf. It is very unusual in Irish law that someone might be able to take an action or make a complaint on behalf of an individual when the individual has not mandated that such a complaint would be made. Before a court, it would probably be struck out on grounds of lacking locus standi. It is a well-intentioned amendment, but I am concerned that a not-for-profit body could bring the complaint or take the action without permission. Significant legal costs will be associated with that. A not-for-profit body can hire lawyers to take the case who will cost a considerable amount of money and the financial cost to the data breacher would be significant.

Obviously, there must be a remedy, but given that this provision is so unusual and I do not believe that a not-for-profit body should be in a position to take an action on behalf of a person who does not want it taken, I would be slow to support the amendment.

As no other members wish to reply, does the Minister of State wish to make a further comment?

Deputy O'Callaghan said what had to be said, and as I have already outlined, this provision would cause many problems.

Amendment put:
The Committee divided: Tá, 3; Níl, 5.

  • Daly, Clare.
  • Ó Caoláin, Caoimhghín.
  • Wallace, Mick.

Níl

  • Breen, Pat.
  • Brophy, Colm.
  • Fitzpatrick, Peter.
  • Lawless, James.
  • O'Callaghan, Jim.
Amendment declared lost.
Section 106 agreed to.
NEW SECTIONS

I move amendment No. 137:

In page 87, to delete lines 5 to 8 and substitute the following:

“107. (1) For the purposes of section 106(2)(a), on receipt of a complaint the Commission shall investigate the complaint, and issue a formal decision on the conclusion of the investigation, save where subsections (2) to (4) apply, unless the Commission considers the complaint to be frivolous or vexatious.”.

I will withdraw the amendment with a view to resubmitting it on Report Stage.

Amendment, by leave, withdrawn.

Amendment No. 138 in the name of Deputy Jim O'Callaghan has already been discussed with amendment No. 133. If the question on amendment No. 138 is agreed to, amendment No. 139 cannot be moved.

I move amendment No. 138:

In page 87, to delete lines 5 to 8, and substitute the following:

“107. (1) For the purposes of section 106(2)(a), the Commission shall investigate, to the extent appropriate to ensure compliance with a relevant enactment and to identify any infringement thereof, the subject matter of the complaint unless the Commission is of the opinion that it is frivolous or vexatious and take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, to the extent appropriate.”.

I will withdraw the amendment with a view to resubmitting it on Report Stage.

Amendment, by leave, withdrawn.
SECTION 107

Amendment No. 139 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

I move amendment No. 139:

In page 87, to delete lines 6 to 8 and substitute the following:

“and, unless subsections (2) and (3) apply, take the following actions—

(a) cause such inquiry as it thinks fit to be conducted in respect of the complaint, unless the Commission is of the opinion that the complaint is frivolous or vexatious, and

(b) following such inquiry, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.”.

Amendment put and declared lost.

I move amendment No. 140:

In page 87, line 9, after “Commission,” to insert “with the consent of the parties concerned,”.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.

I move amendment No. 141:

In page 87, to delete lines 13 to 15.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.

Amendment No. 142 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

I move amendment No. 142:

In page 87, line 20, to delete “complaint, to take an action specified in subsection (5)” and substitute “complaint and following the conduct of an inquiry into the complaint under subsection (1)(a) to comply with section 109*”.

Amendment put and declared lost.

Amendment No. 143 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133. I advise that if the question on amendment No. 143 is agreed to, amendments Nos. 144 to 146, inclusive, cannot be moved.

I move amendment No. 143:

In page 87, to delete lines 21 to 39, and in page 88, to delete lines 1 to 3.

Amendment put and declared lost.

I move amendment No. 144:

In page 87, delete lines 23 to 28, and substitute the following:

“(a) reject the complaint if, in the opinion of the Commission, it is frivolous or vexatious;

(b) dismiss the complaint if, in the opinion of the Commission, there has not been an infringement of a relevant enactment;

(c) if the Commission is of the opinion that a person has contravened or is contravening a relevant provision (other than a relevant provision the infringement of which is an offence) the Commission may serve on the person concerned an enforcement notice, requiring it to take such steps as are specified in the notice within such time as may be specified to comply with the relevant provision concerned and without prejudice to the foregoing to do one or more than one of the following:”.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.

I move amendment No. 145:

In page 87, to delete lines 36 and 37.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.

I move amendment No. 146:

In page 87, lines 38 to 39, to delete all words from and including “as” on line 38 down to and including “considers” on line 39 and substitute “to the extent”.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.
Section 107 agreed to.
SECTION 108

Amendment No. 147 in the name of Deputy Jim O'Callaghan has already been discussed with amendment No. 133. I advise that if the question on amendment No. 147 is agreed to, amendment No. 148 cannot be moved.

I move amendment No. 147:

In page 88, line 5, to delete “section 107(5)(e)” and substitute “section 107(1)”.

I shall consider the amendment again on Report Stage.

Amendment, by leave, withdrawn.

Amendment No. 148 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

I move amendment No. 148:

In page 88, line 5, to delete “section 107(5)(e)” and substitute “section 107(1)(a)".

We will reintroduce the amendment on Report Stage.

Amendment, by leave, withdrawn.
Section 108 agreed to.
NEW SECTION

Amendment No. 149 in the names of Deputies Clare Daly and Mick Wallace has already been discussed with amendment No. 133.

I move amendment No. 149:

In page 88, between lines 11 and 12, to insert the following:

“Decision of Commission when inquiry under Chapter 2 conducted under section 107(1)(a)

109. (1) Where an inquiry has been conducted under section 107(1)(a)*, the Commission, having considered the information obtained in the inquiry, shall—

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect and dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, and having regard to the nature of the infringement, make a decision as to whether

(a) an enforcement notice should be served on the controller or processor requiring it to do one or more than one of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

(iv) bring processing operations into compliance with the provisions of a relevant enactment, in a specified manner and within a specified period;

(v) refrain from taking specified actions,

(b) a corrective power should be exercised in respect of the controller or processor concerned, and where it decides to so exercise a corrective power, the corrective power that is to be exercised, or

(c) such other action as the Commission considers appropriate should be taken.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

(4) The Commission shall—

(a) as soon as practicable after a decision under this section is made by it, give the controller or processor concerned a notice in writing setting out—

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor,

and

(b) as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

(i) the decision and the reasons for it,

(ii) the action, if any, taken on the basis of that decision,

(iii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.”.

Amendment put and declared lost.
Sections 109 and 110 agreed to.
SECTION 111

Amendments Nos. 150 to 154, inclusive, in the names of Deputies Clare Daly and Mick Wallace have already been discussed with amendment No. 133.

I move amendment No. 150:

In page 89, line 18, to delete “, where an inquiry has been conducted in respect of the complaint,”.

Amendment put and declared lost.

I move amendment No. 151:

In page 89, line 19, after “the” to insert “course of the Commission’s”.

Amendment put and declared lost.

Amendment No. 152 has already been discussed with amendment No. 133. Is the amendment being pressed?

I move amendment No. 152:

In page 89, line 24, after "addition," to insert "and having regard to the nature of the infringement".

We will withdraw this and the rest of the bunch as nobody agrees with us. We will reintroduce them on Report Stage.

The Deputies will not be pressing amendments Nos. 152 to 154, inclusive.

Amendments Nos. 155 to 158 are all part of the same process. We will withdraw them because the numbers are there to defeat them clearly. We reserve the right at this stage to enter them again.

That is already an indication. What are the Deputies' intentions for amendments Nos. 172, 173 and 190?

Are they relating to the same point?

We will be pushing them.

We can wait until we reach them in that case.

Amendment, by leave, withdrawn.
Amendments Nos. 153 and 154 not moved.
Section 111 agreed to.
Sections 112 to 114, inclusive, agreed to.
Amendments Nos. 155 to 157, inclusive, not moved.
Section 115 agreed to.
Sections 116 and 117 agreed to.
Amendment No. 158 not moved.
Section 118 agreed to.
Section 119 agreed to.
SECTION 120

Amendment No. 159 has already been discussed with amendment No. 133. If the question on amendment No. 159 is agreed, amendment No. 160 cannot be moved. Is the amendment being pressed?

I move amendment No. 159:

In page 95, lines 7 to 10, to delete all words from and including “examine” on line 7 down to and including “appropriate.” on line 10 and substitute the following:

“investigate to the extent appropriate to ensure compliance with a relevant provision and to identify any infringement thereof, the subject matter of the complaint unless the Commission is of the opinion that the complaint is frivolous or vexatious and take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, to the extent appropriate.”.

I will withdraw the amendment now but may come back to it on Report Stage.

Amendment, by leave, withdrawn.

I move amendment No. 160:

In page 95, to delete lines 8 to 10 and substitute the following:

“and unless subsections (2) and (3) apply, take the following actions:

(a) cause an inquiry to be conducted in respect of the complaint, unless the Commission is of the opinion that the complaint is frivolous or vexatious, and

(b) following such inquiry, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.”.

Amendment put and declared lost.

I move amendment No. 161:

In page 95, line 11, after "Commission," to insert "with the consent of parties concerned,".

I will withdraw the amendment now as the section deals with it adequately but I may return to this on Report Stage, along with amendments Nos. 164 to 167, inclusive.

Amendment, by leave, withdrawn.
Amendments Nos. 162 to 167, inclusive, not moved.
Section 120 agreed to.
SECTION 121

Amendment No. 168 has already been discussed with amendment No. 133. If amendment No. 168 is agreed, amendment No. 169 cannot be moved.

Amendments Nos. 168 and 169 not moved.
Section 121 agreed to.
NEW SECTION

Amendment No. 170 has already been discussed with amendment No. 133 and would insert a new section.

I move amendment No. 170:

In page 96, between lines 9 and 10, to insert the following:

Decision of Commission when inquiry under Chapter 3 conducted under section 120(1)(a)

122. (1) Where an inquiry has been conducted under section 120(1)(a), the Commission, having considered the information obtained in the inquiry, shall —

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect and dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, and having regard to the nature of the infringement, make a decision as to whether—

(a) an enforcement notice should be served on the controller or processor requiring it to do one or more of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

(iv) bring processing operations into compliance with the provisions of a relevant enactment, in a specified manner and within a specified period;

(v) refrain from taking specified actions,

(b) a corrective power should be exercised in respect of the controller or processor concerned, and where it decides to so exercise a corrective power, the corrective power that is to be exercised, or

(c) such other action as the Commission considers appropriate should be taken.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

(4) The Commission shall —

(a) as soon as practicable after a decision under this section is made by it, give the controller or processor concerned a notice in writing setting out —

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor, and

(b) as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

(i) the decision and the reasons for it,

(ii) the action, if any, taken on the basis of that decision,

(iii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.”.

Amendment put and declared lost.
Section 122 agreed to.
Amendment No. 171 not moved.
Section 123 agreed to.
Sections 124 and 125 agreed to.
SECTION 126

I move amendment No. 172:

In page 98, to delete lines 22 to 25 and substitute the following:

"(7) The court hearing a data protection action that has been brought, in accordance with section 118(1)(b), on behalf of a data subject by body, organisation or association to which subsection (2) of that section applies shall have the power to grant to the data subject on whose behalf the action is being brought one or more of the following reliefs:

(a) relief by way of injunction or declaration; or

(b) compensation for damage suffered by the plaintiff as a result of the infringement of the relevant enactment.”.

Amendment put and declared carried.

I move amendment No. 173:

In page 98, between lines 25 and 26, to insert the following:

“(8) The court hearing a data protection action that has been brought, in accordance with section 118(2)(b)*, on behalf of a data subject by a body, organisation or association independently of the data subject’s mandate, shall not award compensation for material or non-material damage suffered.".

We will withdraw the amendment while reserving the right to enter these amendments again on Report Stage.

We will withdraw or not move amendments Nos. 173 to 177, inclusive.

What happened to section 172?

We are not yet at section 172.

I am sorry. I meant amendment No. 172.

In fairness, he is probably not aware of the Chairman's ruling at the start of yesterday's meeting.

It is a fair point.

I should advise that the Minister has agreed with the Chairman's reading that there would be no challenge.

Should there have been a votáil?

It would be unnecessary as there has already been a determination.

Okay. The Minister has agreed to that process.

Yes. We have only had approximately three votes.

The Minister of State's colleagues and officials will confirm that what we are doing is with the Minister's agreement and totally above board.

Amendment, by leave, withdrawn.
Section 126, as amended, agreed to.
Sections 127 to 130, inclusive, agreed to.
SECTION 131

Amendments Nos. 174 to 179 are to be discussed together by agreement.

Amendments Nos. 174 to 177, inclusive, not moved.

I move amendment No. 178:

In page 106, line 4, to delete "Subject to subsection (11), a controller" and substitute "A controller".

Amendment No. 179 deletes subsection (11) of section 131 in consequence of the deletion of subsection (2) of section 139. This subsection, which is being removed for legal reasons on the advice of the Attorney General's office sought to give effect to the ne bis in idem principle.

However, in light of the evolving case law of the Court of Justice and the content of Recital 149, the Office of the Attorney General has advised that there is no good reason to maintain sections 139(2) or 131(11). Amendment No. 178 is a related drafting amendment.

Amendment agreed to.

I move amendment No. 179:

In page 106, to delete lines 13 and 14.

Amendment agreed to.
Section 131, as amended, agreed to.
Sections 132 to 134, inclusive, agreed to.
SECTION 135

Amendments Nos. 180 to 184, inclusive, are being taken together.

I move amendment No. 180:

In page 111, to delete lines 1 to 4.

On reflection, I think the commission should be entitled to define the scope and terms of an investigation that it considers fit to be carried out. I will withdraw this amendment on that basis.

I invite the Deputy to speak on the other amendments in this group.

I intend to push amendment No. 181, which relates to investigation reports. This section of the Bill does not state that an investigation report should be given to the complainant. It simply provides that such a report should be given to the processor or controller. I think the complainant should also get a copy of the report. Amendments Nos. 181 to 184, inclusive, are being proposed to facilitate this.

The Deputy will withdraw amendment No. 180, but the other amendments in this group are to stand.

I will push the other amendments.

I cannot accept amendments Nos. 181 to 184, inclusive, because they could seriously jeopardise the finalisation of an investigation by the commission and render it open to legal challenge on the grounds of due process. When a draft report is prepared by an authorised officer on foot of his or her investigation under section 137 of this Bill, fair procedure rules require the contents of that report to be shared with the controller or processor concerned for any representation that he or she may wish to make. The authorised officer is required to have regard to any such representations. This, of course, does not necessarily require changes to the report. The same considerations apply where the report is submitted to the commission for its consideration and for a decision under section 138. I fear that the sharing of a draft report with a complainant - an individual, or a not-for-profit body, organisation or association acting on his or her behalf – could provide very strong grounds for a later challenge to the validity of any decision reached by the commission and to any corrective action or fine it imposes on the controller or processor concerned. If significant sanctions, especially administrative fines, are to be imposed, it will be important to ensure high standards of due process and the integrity and independence of the investigative process are maintained throughout the investigation and adjudication process. Specific references to these aspects of the matter are included in Articles 58.4 and 83.8 of the GDPR. For these reasons, I cannot accept amendments Nos. 181 to 184, inclusive.

The Minister of State's point is valid in so far as it relates to a draft report, but I do not think it is valid in the case of a final report. Unfortunately, section 137 links the draft report and the final report. I will wait to hear what Deputy Wallace has to say.

He has indicated that he does not wish to speak on these amendments.

Okay. I will come back to this matter on Report Stage. I think the complainant should be given some access to a final report. Perhaps the Minister of State will try to consider that in advance of Report Stage. I can understand why a complainant might not be entitled to a draft report, but I see no basis for providing that a complainant should not be entitled to the final report.

I think the complainant has a right to know. Given the confusion on this issue, I think it would be better if Deputy O'Callaghan's amendments were agreed now. If the Minister needs to change the relevant sections of the Bill in light of the confusion I have mentioned, we can do so on Report Stage.

Would Deputy O'Callaghan like to respond to Deputy Daly before I call the Minister of State?

I think the argument that a complainant should not be allowed to get a draft report has some validity. I appreciate that the processor or controller is entitled to look at a draft report and point out what is wrong with it in advance of the completion of the final report. Rather than pushing these amendments now, I will consider them again in advance of Report Stage. I ask the Minister of State to do likewise in order to provide for a complainant to have access to a final investigation report.

I assure Deputy O'Callaghan that we will consult the Attorney General and give consideration to what he is proposing. Is that okay?

Amendment, by leave, withdrawn.
Section 135 agreed to.
Section 136 agreed to.
Amendments Nos. 181 and 182 not moved.
Section 137 agreed to.
Amendments Nos. 183 and 184 not moved.
Section 138 agreed to.
SECTION 139

I move amendment No. 185:

In page 115, to delete lines 23 to 25 and substitute the following:

"(2) Where a controller to whom section 109(2)(b), 110(2)(b) or 131(9) applies is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3, a decision by the Commission to impose an administrative fine in respect of the infringement or failure concerned shall be a decision to impose an administrative fine on the appropriate authority that, or, as the case may be, the Minister who, made the designation, and not on the controller.

(3) Where subsection (2) applies, a reference in sections 113(1)(a), 131(9)(b) and this Chapter to a controller shall be construed as a reference to the appropriate authority or Minister concerned.".

Amendment agreed to.

Amendments Nos. 186 to 188, inclusive, are being taken together.

I move amendment No. 186:

In page 115, between lines 31 and 32, to insert the following:

"(4) The Commission, as soon as practicable after—

(a) a decision to impose an administrative fine is confirmed under section 140(3)(a) or 141(2), or

(b) the court decides, under section 140(3)(b), to impose a different fine, shall give the controller or processor concerned a notice in writing, requiring the controller or processor to pay the amount of the fine concerned to the Commission within the period of 28 days commencing on the date of the notice.

(5) A controller or processor shall comply with a requirement referred to in subsection (4).

(6) All payments received by the Commission under this section shall be paid into or disposed of for the benefit of the Exchequer in such manner as the Minister for Finance may direct.".

Amendment No. 186 proposes to insert three new procedural subsections into section 139, which provides for the imposition of administrative fines. The proposed new subsection (4) provides that the commission will issue a notice requiring payment of a fine within 28 days of its decision to impose the fine. The proposed new subsection (5) requires the controller or processor concerned to comply with such a notice. The proposed new subsection (6) provides for the payment of any fines into the Exchequer. Amendment No. 188 corrects an incorrect reference to section 139 in section 140. I assure Deputy Ó Laoghaire that the issue at the heart of amendment No. 187, in his name - the recovery of any profits made by a controller or processor because of infringements - is dealt with in Article 83.2(k) of the GDPR. It provides that when determining the amount of any administrative fine, the data protection authority shall have regard to "financial benefits gained, or losses avoided, directly or indirectly, from the infringement". I thank Deputy Ó Laoghaire for his amendment, but I think the matter is adequately covered already in Article 83 of the GDPR.

Is the Minister of State referring to Article 83 of the GDPR or to a section of the Bill?

I am referring to Article 83.2(k) of the GDPR.

Okay. I was looking at Article 145.

I can read the relevant article of the GDPR if the Deputy wishes me to do so.

No. I am sure I can find it. If it is the case as far as the Minister of State and the Department are concerned that there is no requirement to provide for the Data Protection Commissioner to have these powers under Irish legislation so that it will be possible to recover profits gained on foot of offences under this Bill, I will be happy enough to withdraw my amendment.

It will be possible to take account of that when the fine is being determined.

Okay. I will have a think about the matter. I will withdraw my amendment for now.

If the Deputy is unhappy about this matter, he will have an opportunity to revisit it on Report Stage.

Amendment agreed to.
Amendment No. 187 not moved.
Section 139, as amended, agreed to.
SECTION 140

I move amendment No. 188:

In page 116, line 14, to delete “section 137(3)” and substitute “section 139(3)”.

Amendment agreed to.
Section 140, as amended, agreed to.
Sections 141 and 142 agreed to.
SECTION 143

I move amendment No. 189:

In page 117, line 16, to delete “5 years,” and substitute “5 years”.

Amendment agreed to.
Section 143, as amended, agreed to.
Sections 144 and 145 agreed to.
Amendment No. 190 not moved.
Section 146 agreed to.
SECTION 147

I move amendment No. 191:

In page 119, between lines 5 and 6, to insert the following:

“(c) decisions reached regarding complaint cases,”.

Amendment, by leave, withdrawn.
Section 147 agreed to.
SECTION 148

Amendments Nos. 192 and 193 are related and may be discussed together.

I move amendment No. 192:

In page 120, to delete lines 12 to 14 and substitute the following:

“(5) A decision of the Commission under Chapter 2 and 3 may, within 28 days from the date on which notice of the decision is received by him or her, be appealed to the court by the person concerned.”.

Section 148 deals with an appeal to the courts arising from a decision of the Data Protection Commission. The amendment seeks to change the parameters by which such an appeal may take place. Having re-read the Government's draft, I believe subsection (5) is probably better than my proposed subsection (5) as the former provides for a broader ground upon which a decision can be appealed. Anyone affected by the decision can appeal, whereas in the amendment the decision can be appealed only by the person concerned. On that basis, I will withdraw the amendment.

I will pursue amendment No. 193. A decision of the Data Protection Commission can be appealed to the Circuit Court and High Court. The Government proposes that a person may only appeal a decision to the High Court if he or she obtains the leave of the court. The amendment proposes to remove the words "by leave of that court" to give persons an entitlement to have their case heard by a High Court judge having taken a case to the Circuit Court.

As regards appeals against decisions of the Circuit Court and High Court in specific cases, subsection (11) provides for the possibility of appeal on a point of law "by leave of the Court" to the High Court or Court of Appeal, respectively. This is a standard provision in legislation of this kind and it will ensure that a further appeal on the merits of the case does not take place. For this reason, I cannot accept amendment No. 193.

As a decision can be appealed on a point of law, the appeal is limited in the first instance. However, a person must obtain the leave of the relevant court. Obviously in such circumstances, the judge who heard the case will not have found in favour of the plaintiff. The person who takes the case should be able to appeal. As matters stand, the judge who rejected his or her case can also refuse to allow an appeal.

Does the Minister of State wish to respond?

I understand the appeal will relate to a decision of the Data Protection Commissioner.

Yes. This refers to an appeal to the Circuit Court and a subsequent appeal to a higher court. I will withdraw amendment No. 192 and press amendment No. 193 to a vote, if necessary.

Amendment, by leave, withdrawn.

I move amendment No. 193:

In page 120, line 38, to delete “, by leave of that Court,”.

Amendment put and declared carried.
Section 148, as amended, agreed to.
Sections 149 to 154, inclusive, agreed to.
SECTION 155

I move amendment No. 194:

In page 123, to delete line 37, and in page 124, to delete lines 1 to 17 and substitute the following:

“(2) The assigned judge shall, in particular—

(a) promote awareness among judges of the provisions of the Data Protection Regulation, the Directive and any enactment, rule made under section 156(3) or other rule of law that gives further effect to the Data Protection Regulation or effect to the Directive, and ensure compliance with those provisions, and

(b) handle, and investigate to the extent appropriate, complaints in relation to data processing operations of the courts when acting in their judicial capacity.”.

Amendment agreed to.
Section 155, as amended, agreed to.
NEW SECTIONS

I move amendment No. 195:

In page 124, between lines 17 and 18, to insert the following:

“Restrictions on obligations of controllers and rights of data subjects for objective of safeguarding judicial independence and court proceedings

156. (1) The rights and obligations provided for in—

(a) Articles 12 to 22 and Article 34, and Article 5 in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22, and

(b) sections 84, 88, 89, 90 and 91, and section 68 in so far as it relates to those sections,

are restricted to the extent that the restrictions are necessary and proportionate to safeguard judicial independence and court proceedings.

(2) Subsection (1) is without prejudice to any other enactment or rule of law which restricts the rights and obligations referred to in that subsection.

(3) Without prejudice to the generality of subsection (1), a panel may make such rules as it considers necessary for the purpose of ensuring the effective application of a restriction under that subsection.

(4) Rules made under subsection (3) may relate to such matters as the panel considers appropriate for the purpose referred to in that subsection and, without prejudice to the generality of that subsection, may—

(a) relate to one or more than one of the following:

(i) a class or classes of data subject;

(ii) a category or categories of personal data;

(iii) civil or criminal proceedings, or both;

(iv) a class or classes of civil or criminal proceedings, or both;

(v) the circumstances in which, or the conditions under which, a restriction under subsection (1) shall apply,

(b) include, where relevant, specific provisions as to the matters referred to in Article 23(2), and

(c) make provision for such incidental, supplementary and consequential matters as appear to the panel to be necessary or expedient for the purposes of the rule.

(5) Rules under subsection (3) shall be published in such manner (which may include publication on the website of the Courts Service) as the panel considers appropriate.

(6) In this section, “panel” means a panel of three judges nominated by the Chief Justice for the purposes of this section.”.

Amendment agreed to.

I move amendment No. 196:

In page 124, between lines 17 and 18, to insert the following:

“Processing of personal data where court is controller

157. (1) The Superior Courts Rules Committee may make processing rules in respect of personal data that are contained in a record of a superior court of record.

(2) The Circuit Court Rules Committee may make processing rules in respect of personal data that are contained in a record of the Circuit Court.

(3) The District Court Rules Committee may make processing rules in respect of personal data that are contained in a record of the District Court.

(4) The panel referred to in section 156(6) may make processing rules in respect of personal data—

(a) that are not personal data to which subsection (1), (2) or (3) applies, and

(b) in respect of which a court, when acting in its judicial capacity, is a controller.

(5) Processing rules made under this section shall be binding on a processor of personal data in respect of which the rules are made.

(6) Processing rules made under subsection (4) shall be published in such manner (which may include publication on the website of the Courts Service) as the panel referred to in that subsection considers appropriate.

(7) In this section, “processing rules”, in relation to personal data, means rules made for the purposes of Article 28(3) of the Data Protection Regulation and Article 22(3) of the Directive, governing the processing by a processor of the personal data.”.

Amendment agreed to.
Sections 156 to 160, inclusive, agreed to.
NEW SECTIONS

The final group of amendments is extremely large. Amendments Nos. 197 to 245, inclusive, are related and may be taken together.

I move amendment No. 197:

In page 126, between lines 25 and 26, to insert the following:

“Reference to personal data in enactment

161. Subject to this Part, a reference in any enactment to personal data within the meaning of the Act of 1988 shall be construed as including a reference to personal data within the meaning of—

(a) the Data Protection Regulation, and

(b) Part 5.”.

As the Minister announced during Second Stage, a large number of existing Acts need to be amended to replace existing cross-references to the Data Protection Act 1988. The required amendments have been notified to the Department of Justice and Equality by the Departments concerned and have been drafted by the Office of the Parliamentary Counsel. In each case, the amendments are confined to what is strictly necessary to ensure compliance with the GDPR and this Bill. I do not consider it necessary to speak to the amendments individually. A limited number of additional Acts requiring amendments have been identified and the appropriate amendments will be tabled on Report Stage.

Amendment agreed to.

I move amendment No. 198:

In page 126, between lines 25 and 26, to insert the following:

“Reference to processing in enactment

162. Subject to this Part, a reference in any enactment to processing within the meaning of the Act of 1988 shall be construed as including a reference to processing within the meaning of—

(a) the Data Protection Regulation, and

(b) Part 5.”.

Amendment agreed to.

I move amendment No. 199:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Firearms Act 1925

163. The Firearms Act 1925 is amended by the insertion of the following section after section 27A:

“Provision of information by Commissioner to Minister for purposes of Act and Firearms (Firearm Certificates For Non-Residents) Act 2000

27B. (1) The Minister may request the Commissioner to provide any information necessary for the performance of the Minister’s functions under sections 9, 10, 11 and 17 and under section 2 of the Firearms (Firearm Certificates For Non-Residents) Act 2000, and the Commissioner shall, notwithstanding anything contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with that request.

(2) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 200:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 33AK of Central Bank Act 1942

164. Section 33AK(5) of the Central Bank Act 1942 is amended—

(a) in paragraph (az), by the substitution of “(S.I. No. 349 of 2016), or” for “(S.I. No. 349 of 2016).”,

(b) by the insertion of the following paragraph:

“(ba) to the Data Protection Commission that is required for the performance of that Commission’s functions under the Data Protection Regulation or the Data Protection Acts 1988 to 2018.”,

and

(c) by the insertion in subsection (10) of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”.”.

Amendment agreed to.

I move amendment No. 201:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Civil Service Regulation Act 1956

165. Section 2(2) of the Civil Service Regulation Act 1956 is amended—

(a) in paragraph (h), by the deletion of “and”,

(b) in paragraph (i), by the substitution of “Síochána, and” for “Síochána.”, and

(c) by the insertion of the following paragraph after paragraph (i):

“(j) in relation to a member of staff of the Data Protection Commission, the Commissioner for Data Protection or, where more than one Commissioner for Data Protection stands appointed, the chairperson (within the meaning of the Data Protection Act 2018).”.”.

Amendment agreed to.

I move amendment No. 202:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 24 of Misuse of Drugs Act 1977

166. Section 24 of the Misuse of Drugs Act 1977 is amended—

(a) in subsection (1)(c), by the substitution of “(including those containing any data that constitutes personal data)” for “(including any data within the meaning of the Data Protection Acts 1988 and 2003)”,

(b) in subsection (2)(c), by the substitution of “(including those containing any data that constitutes personal data)” for “(including any data within the meaning of the Data Protection Acts 1988 and 2003)”, and

(c) by the insertion of the following subsection after subsection (7):

“(8) In this section—

“Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

“personal data” means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 203:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 15A of Control of Clinical Trials Act 1987

167. Section 15A of the Clinical Trials Act 1987 is amended—

(a) by the substitution of the following paragraph for paragraph (d):

“(d) inspect and copy or extract information from any data including data that constitutes personal data within the meaning of—

(i) the Data Protection Regulation, or

(ii) Part 5 of the Data Protection Act 2018.”,

and

(b) the insertion of the following subsection after subsection (10):

“(11) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 204:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Data Protection Act 1988

168. (1) The Act of 1988 is amended—

(a) in section 24, by the substitution of the following subsection for subsection (1):

“(1) In this section “authorised officer” has the same meaning that it has in section 2(1) of the Data Protection Act 2018.”,

and

(b) in section 26—

(i) in subsection (1)—

(I) in paragraph (b), by the substitution of “notice, and” for “notice”, and

(II) by the deletion of paragraph (c),

and

(ii) in subsection (4)—

(I) in paragraph (a), by the substitution of “paragraph (a) or (b) of subsection (1) of this section” for “paragraph (a), (b) or (c) of subsection (1) of this section”, and

(II) by the substitution of “with a requirement or prohibition specified in the notice” for “with a requirement or prohibition specified in the notice, or, as the case may be, a contravention by him of section 19 of this Act,”.

(2) The amendments effected by subsection (1) shall not apply for the purposes of subsection (2) of section 8.”.

Amendment agreed to.

I move amendment No. 205:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Firearms and Offensive Weapons Act 1990

169. The Firearms and Offensive Weapons Act 1990 is amended by the insertion of the following section after section 16:

“Provision of information by Commissioner to Minister

16A. (1) The Minister may request the Commissioner of the Garda Síochána to provide any information necessary for the performance of the Minister’s functions under sections 9C and 9E and the Commissioner shall, notwithstanding anything contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with that request.

(2) In this section “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 206:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Comptroller and Auditor General (Amendment) Act 1993

170. The Comptroller and Auditor General (Amendment) Act 1993 is amended—

(a) in section 10, by the substitution of the following subsection for subsection (3):

“(3) In this section—

‘automated data’ means information that—

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or

(b) is recorded with the intention that it should be processed by means of such equipment;

‘data’ means automated data and manual data;

‘data equipment’ means equipment for processing data;

‘data material’ means any document or other material used in connection with, or produced by, data equipment;

‘manual data’ means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;

‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;”,

and

(b) by the insertion of the following section after section 18B:

“Application of this Act to the Data Protection Commission

18C. This Act applies to the Data Protection Commission as if it were a Department.”.”.

Amendment agreed to.

I move amendment No. 207:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 8 of Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993

171. Section 8 of the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 is amended in subsection (1A) by the substitution of “the functions of the Data Protection Commission under section 10 of the Data Protection Act 1988 and Part 6 of the Data Protection Act 2018” for “the functions of the Data Protection Commissioner under section 10 of the Data Protection Act 1988”.”.

Amendment agreed to.

I move amendment No. 208:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 18F of Health Insurance Act 1994

172. Section 18F of the Health Insurance Act 1994 is amended—

(a) in subsection (2)(d), by the substitution of “data (including data that constitutes personal data)” for “data (within the meaning of the Data Protection Acts 1988 and 2003)”, and

(b) in subsection (12), by the insertion of the following definitions:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 209:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 32B of Irish Medicines Board Act 1995

173. Section 32B of the Irish Medicines Board Act 1995 is amended—

(a) in subsection (3), by the substitution of the following paragraph for paragraph (l):

“(l) inspect and copy or extract information from any data, including data that constitutes personal data within the meaning of—

(i) the Data Protection Regulation, or

(ii) Part 5 of the Data Protection Act 2018.”,

and

(b) by the insertion of the following subsection after subsection (11):

“(12) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 210:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 77 of Central Bank Act 1997

174. Section 77 of the Central Bank Act 1997 is amended by the substitution of the following subsection for subsection (12):

“(12) In this section—

‘automated data’ means information that—

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose, or

(b) is recorded with the intention that it should be processed by means of such equipment;

‘data’ means automated data and manual data;

‘data equipment’ means equipment for processing data;

‘data material’ means any document or other material used in connection with, or produced by data equipment;

‘manual data’ means information that is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system;

‘relevant filing system’ means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.”.”.

Amendment agreed to.

I move amendment No. 211:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 1 of Health (Provision of Information) Act 1997

175. The Health (Provision of Information) Act 1997 is amended by the substitution of the following section for section 1:

“Requests for and provision of information

1. (1) The National Cancer Registry Board (established under the Health (Corporate Bodies) Act 1961) may request from any person personal data (including data concerning health and genetic data within the meaning of the Data Protection Regulation) held by, or in the possession of, that person for the purposes of the performance of that Board of its functions.

(2) Without prejudice to his or her obligations under the Data Protection Regulation and the Act of 2018, the person to whom a request is made under subsection (1) shall provide the personal data requested to the extent it is held by, or in the possession of, that person.

(3) The Health Service Executive may, for the purposes of compiling and maintaining a record of the names, addresses, telephone numbers, email addresses and dates of birth of persons who, for public health reasons, may be invited to participate in any cancer screening (including any breast, cervical or bowel cancer screening) programme operated by the Executive, request from any person the names, addresses, telephone numbers, e-mail addresses and dates of birth of persons held by, or in the possession of, that person.

(4) Without prejudice to his or her obligations under the Data Protection Regulation and the Act of 2018, the person to whom a request is made under subsection (3) may provide that information to the extent it is held by, or in the possession of, that person.

(5) In this section—

‘Act of 2018’ means the Data Protection Act 2018;

Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of the Data Protection Regulation.”.”.

Amendment agreed to.

I move amendment No. 212:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 7D of Comhairle Act 2000

176. Section 7D of the Comhairle Act 2000 is amended in subsection (3), by the substitution of “Subject to the Data Protection Regulation and the Data Protection Act 2018” for “Subject to the Data Protection Acts 1988 and 2003”.”.

Amendment agreed to.

I move amendment No. 213:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 33 of Commission To Inquire Into Child Abuse Act 2000

177. The Commission To Inquire Into Child Abuse Act 2000 is amended by the substitution of the following section for section 33:

“33. (1) Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to safeguard the effective performance by the Commission of its functions or a Committee of its functions, in so far as it relates to personal data (within the meaning of that Regulation) provided to the Commission or a Committee while the data is in the custody of the Commission or a Committee, or in the case of such data provided to the Confidential Committee, of a body to which it is transferred by the Commission upon the dissolution of the Commission.

(2) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 214:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Merchant Shipping (Investigation of Marine Casualties) Act 2000

178. Section 2(1) of the Merchant Shipping (Investigation of Marine Casualties) Act 2000 is amended in the definition of “record” by the deletion of the words “any form in which data (within the meaning of the Data Protection Act 1988) are held,”.”.

Amendment agreed to.

I move amendment No. 215:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 28 of Education (Welfare) Act 2000

179. Section 28 of the Education (Welfare) Act 2000 is amended—

(a) by the substitution of “controller” for “data controller” in each place it occurs,

and

(b) in subsection (3), by the deletion of “ “data controller” and “personal data” have the meanings assigned to them by the Data Protection Act 1988” and the insertion of the following:

“ ‘controller’ means a controller within the meaning of the Data Protection Regulation;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of the Data Protection Regulation;”.”.

Amendment agreed to.

I move amendment No. 216:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 38 of Planning and Development Act 2000

180. Section 38 of the Planning and Development Act 2000 is amended in subsection (2) by the deletion of “and the Data Protection Acts 1988 and 2003”.”.

Amendment agreed to.

I move amendment No. 217:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 30 of Residential Institutions Redress Act 2002

181. The Residential Institutions Redress Act 2002 is amended by the substitution of the following section for section 30:

“30. (1) Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to safeguard the effective performance by the Board of its functions and the Review Committee of its functions, in so far as it relates to personal data (within the meaning of that Regulation) provided to the Board while the data is in the custody of the Board or the Review Committee.

(2) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 218:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Official Languages Act 2003

182. Section 2(1) of the Official Languages Act 2003 is amended—

(a) in the Irish text, in the definition of “taifead”, by the substitution of “aon fhoirm ina gcoimeádtar sonraí (lena n-áirítear foirm mheaisín-inléite) nó rud” for “aon fhoirm ina gcoimeádtar sonraí (de réir bhrí an Achta um Chosaint Sonraí 1988), aon fhoirm eile (lena n-áirítear foirm mheaisín-inléite) nó rud eile” and

(b) in the English text, in the definition of “record”, by the substitution of “any form in which data are held (including machine-readable form)” for “any form in which data (within the meaning of the Data Protection Act 1988) are held, any other form (including machine-readable form)”.”.

Amendment agreed to.

I move amendment No. 219:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 86 of Personal Injuries Assessment Board Act 2003

183. Section 86 of the Personal Injuries Assessment Board Act 2003 is amended—

(a) in subsection (1), by the substitution of “but only if the processing (within the meaning of the Data Protection Regulation) of any particulars constituting personal data (within the meaning of that Regulation) in the database is in accordance with the Data Protection Regulation and the Data Protection Act 2018.” for “but only if the database is, for the time being, maintained in accordance with the Data Protection Act 1988”, and

(b) by the insertion of the following subsection after subsection (4):

“(5) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 220:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 66 of Civil Registration Act 2004

184. Section 66 of the Civil Registration Act 2004 is amended—

(a) in subsection (1), by the substitution of “Notwithstanding anything contained in any other enactment, but subject to the Data Protection Regulation and the Data Protection Act 2018, an tArd-Chláraitheoir may” for “Notwithstanding anything contained in the Data Protection Acts 1988 to 2003 or any other enactment, an tArd-Chláraitheoir may”, and

(b) by the substitution of the following subsection for subsection (2):

“(2) In this section—

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘information’ includes personal data;

‘personal data’ means personal data within the meaning of—

(a) the Data Protection Act 1988,

(b) the Data Protection Regulation, or

(c) Part 5 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 221:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 39 of Commissions of Investigation Act 2004

185. Section 39 of the Commissions of Investigation Act 2004 is amended—

(a) by designating the section as subsection (1),

(b) in that designated subsection (1), by the substitution of “Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to safeguard the effective operation of commissions and the future cooperation of witnesses, in so far as it relates to personal data (within the meaning of that Regulation) provided to a commission” for “Section 4 of the Data Protection Act 1988 does not apply to personal data provided to a commission”, and

(c) by the insertion of the following subsection after subsection (1):

“(2) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 222:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 55H of Health Act 2004

186. Section 55H of the Health Act 2004 is amended—

(a) in subsection (8), by the substitution of the following paragraph for paragraph (a):

“(a) submit a draft of the proposed procedures to the Data Protection Commission for its opinion as to whether any provision of the procedures would, if given effect, be likely to result in a contravention of the Data Protection Regulation or the Data Protection Act 2018, and”,

(b) in subsection (9), by the substitution of “the Data Protection Commission” for “the Data Protection Commissioner”, and (c) by the insertion of the following subsection after subsection (9):

“(10) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 223:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Safety, Health and Welfare at Work Act 2005

187. Section 2(1) of the Safety, Health and Welfare at Work Act 2005 is amended—

(a) by the substitution of the following definition for the definition of “record”:

“ ‘record’ includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data within the meaning of the Data Protection Regulation or Part 5 of the Data Protection Act 2018) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing;”,

and

(b) by the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”.”.

Amendment agreed to.

I move amendment No. 224:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 265 of Social Welfare Consolidation Act 2005

188. Section 265 of the Social Welfare Consolidation Act 2005 is amended—

(a) in subsection (1)—

(i) by the substitution of the following definitions for the definitions of “data controller” and “personal data”:

“ ‘controller’ means a controller within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;

‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

and

(ii) by the insertion of the following definitions:

“ ‘Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

and

(b) in subsection (2), by the substitution of “controller” for “data controller”.”.

Amendment agreed to.

I move amendment No. 225:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Railway Safety Act 2005

189. Section 2(1) of the Railway Safety Act 2005 is amended in the definition of “record” by the deletion of the words “in which data (within the meaning of the Data Protection Act 1988) are held, any other form”.”.

Amendment agreed to.

I move amendment No. 226:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 12 of Health (Repayment Scheme) Act 2006

190. Section 12(3) of the Health (Repayment Scheme) Act 2006 is amended by the substitution of “except after consultation with the Data Protection Commission” for “except after consultation with the Data Protection Commissioner within the meaning of the Data Protection Acts 1988 and 2003”.”.

Amendment agreed to.

I move amendment No. 227:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 19 of Electoral (Amendment) Act 2006

191. Section 19 of the Electoral (Amendment) Act 2006 is amended by the substitution of “A registration authority may,” for “Notwithstanding anything in the Data Protection Acts 1988 and 2003, a registration authority may,”.”.

Amendment agreed to.

I move amendment No. 228:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 67 of Pharmacy Act 2007

192. Section 67 of the Pharmacy Act 2007 is amended—

(a) in subsection (3), by the substitution of the following paragraph for paragraph (l):

“(l) inspect and copy or extract information from any data, including data that constitutes personal data within the meaning of—

(i) the Data Protection Regulation, or

(ii) Part 5 of the Data Protection Act 2018.”

and

(b) by the insertion of the following subsection after subsection (12):

“(13) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 229:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Passports Act 2008

193. The Passports Act 2008 is amended—

(a) in section 2, by—

(i) the deletion of the definitions of “Act of 1988”, “automated data” and “data”,

(ii) the insertion of the following definition:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

(iii) the substitution of the following definition for the definition of “biometric data”:

“ ‘biometric data’ means biometric data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

(iv) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(v) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

and

(vi) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018.”,

(b) in section 8, by the substitution in subsection (1) of “Subject to the Data Protection Regulation and the Act of 2018” for “Subject to the Data Protection Acts 1988 and 2003”, and

(c) in section 21(1)(b), by the substitution of “personal data” for “data” in each place it occurs.”.

Amendment agreed to.

I move amendment No. 230:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 2 of Chemicals Act 2008

194. Section 2(1) of the Chemicals Act 2008 is amended by—

(a) the substitution of the following definition for the definition of “record”—

“ ‘record’ includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data within the meaning of the Data Protection Regulation or Part 5 of the Data Protection Act 2018) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing;”

and

(b) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”.”.

Amendment agreed to.

I move amendment No. 231:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Nursing Homes Support Scheme Act 2009

195. The Nursing Homes Support Scheme Act 2009 is amended—

(a) in section 26, by the deletion of subsection (12), and

(b) in section 45(1), by the substitution of “Subject to the Data Protection Regulation and the Data Protection Act 2018” for “Notwithstanding any provision of the Data Protection Acts 1988 to 2003”.”.

Amendment agreed to.

I move amendment No. 232:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 23 of Criminal Justice (Miscellaneous Provisions) Act 2009

196. Section 23 of the Criminal Justice (Miscellaneous Provisions) Act 2009 is amended by the substitution of the following subsections for subsection (2):

“(2) The Data Protection Act 1988 shall, subject to any necessary modifications, apply and have effect in relation to the processing (within the meaning of that Act) of personal data (within the meaning of that Act) for the purposes of the operation of the Council Decision and the Schengen Convention.

(3) The Data Protection Act 2018 shall, subject to any necessary modifications, apply and have effect to the processing (within the meaning of Part 5 of that Act) of personal data (within the meaning of that Part) for the purposes of the operation of the Council Decision and the Schengen Convention.”.”.

Amendment agreed to.

I move amendment No. 233:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 201 of National Asset Management Agency Act 2009

197. The National Asset Management Agency Act 2009 is amended by the substitution of the following section for section 201:

201. (1)For the avoidance of doubt, an obligation on a credit institution or any other person under this Act to disclose information to NAMA, a NAMA group entity or the NTMA extends to personal data within the meaning of the Data Protection Regulation.

(2) In this section, “Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 234:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 12 of Communications (Retention of Data) Act 2011

198. Section 12 of the Communications (Retention of Data) Act 2011 is amended by the substitution of the following subsections for subsection (4):

“(4) The designated judge may, if he or she considers it desirable to do so, communicate with the Taoiseach or the Minister concerning disclosure requests and with the Data Protection Commission in connection with its functions under the Data Protection Regulation and the Data Protection Acts 1988 to 2018.

(5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 235:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 28 of Student Support Act 2011

199. Section 28 of the Student Support Act 2011 is amended—

(a) by the substitution of “controller” for “data controller” in each place it occurs,

(b) in subsection (1), by the substitution of “Notwithstanding anything contained in any enactment (other than the Act of 2018)” for “Notwithstanding anything contained in the Data Protection Acts 1988 and 2003 or any other enactment”,

and

(c) in subsection (5), by—

(i) the substitution of the following definitions for the definition of “data controller”:

“ ‘Act of 2018’ means the Data Protection Act 2018;

‘controller’ means a controller within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(ii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”

and

(iii) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”.”.

Amendment agreed to.

I move amendment No. 236:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Communications Regulation (Postal Services) Act 2011

200. The Communications Regulation (Postal Services) Act 2011 is amended—

(a) in section 65A(1), by—

(i) the deletion of the definition of “Act of 1988”,

(ii) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(iii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of the Data Protection Regulation;”,

and

(iv) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of the Data Protection Regulation;”,

(b) in section 66A(2), by the deletion of paragraph (a), and

(c) in section 66C—

(i) in subsection (1), by the substitution of “the Data Protection Regulation and the Data Protection Act 2018” for “the Data Protection Acts 1988 to 2003”,

and

(ii) by the substitution of the following subsection for subsection (2):

“(2) Article 21 (Right to object) of the Data Protection Regulation shall not apply to processing of personal data that is required for the purposes of carrying out legitimate postcode activity.”.”.

Amendment agreed to.

I move amendment No. 237:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Property Services (Regulation) Act 2011

201. The Property Services (Regulation) Act 2011 is amended—

(a) in section 2(1), by the insertion of the following definition after the definition of “connected relative”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(b) in section 42, by the substitution of the following subsection for subsection (2):

“(2) The Commissioner of the Garda Síochána shall, notwithstanding anything contained in any other enactment or rule of law, but subject to the Data Protection Regulation and the Data Protection Act 2018, comply with a request under subsection (1).”,

and

(c) by the substitution of the following section for section 93:

“Restriction of right of access to personal data in certain circumstances

93. Article 15 (Right of access) of the Data Protection Regulation is restricted, to the extent necessary and proportionate to enable the Authority to effectively perform its functions under this Act in so far as the functions relate to carrying out an investigation, in so far as it relates to personal data (within the meaning of that Regulation) processed by the Authority.”.”.

Amendment agreed to.

I move amendment No. 238:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 56 of Credit Union and Co-operation with Overseas Regulators Act 2012

202. Section 56 of the Credit Union and Co-operation with Overseas Regulators Act 2012 is amended—

(a) by the substitution of the following subsection for subsection (2):

“(2) A credit union may disclose to ReBo personal data within the meaning of the Data Protection Regulation.”,

and

(b) by the insertion of the following subsection after subsection (3):

“(4) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I will be waking up in the middle of the night calling out this procedure.

You are doing well.

It reminds me of when I used to go to mass.

I will let that go.

That was the point of going - to pray for our politicians.

I move amendment No. 239:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 8 of Health (Alteration of Criteria for Eligibility) Act 2013

203. Section 8 of the Health (Alteration of Criteria for Eligibility) Act 2013 is amended—

(a) in subsection (4), by the substitution of “Subject to compliance with the Data Protection Regulation and the Act of 2018 and subject to this section” for “Notwithstanding anything contained in the Data Protection Acts 1988 and 2003, but subject to this section”,

(b) in subsection (7), by the substitution of “the Data Protection Commission” for “the Data Protection Commissioner”,

(c) by the deletion of subsection (8),

(d) in subsection (9), by the substitution of “references in this section to personal data shall include references to special categories of personal data (within the meaning of section 2 of the Act of 2018)” for “references in this section to personal data shall include references to sensitive personal data”, and

(e) by the substitution of the following subsection for subsection (10):

“(10) In this section—

Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of the Data Protection Regulation.”.”.

Amendment agreed to.

I move amendment No. 240:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Health Identifiers Act 2014

204. The Health Identifiers Act 2014 is amended—

(a) in section 2(1)—

(i) by the insertion of the following definition after the definition of “Act of 2013”:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

(ii) by the insertion of the following definition after the definition of “conditions”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(iii) by the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

(iv) by the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

(v) in paragraph (g)(iii) of the definition of “secondary purpose”, by the substitution of “in accordance with the Data Protection Regulation and the Act of 2018” for “in accordance with the Data Protection Acts 1988 and 2003”,

and

(b) by the substitution of the following Part for Part 6:

“PART 6

APPLICATION OF DATA PROTECTION REGULATION

Application of Data Protection Regulation

27. Article 32 of the Data Protection Regulation shall apply to a deceased individual’s relevant information (individual) as it applies to a living individual’s relevant information (individual).”.”.

Amendment agreed to.

I move amendment No. 241:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 15 of the Freedom of Information Act 2014

205. Section 15 of the Freedom of Information Act 2014 is amended—

(a) by the substitution of the following subsection for subsection (3):

“(3) A record shall not be within subsection (2) by reason only of the fact that it contains information constituting—

(a) personal data within the meaning of the Data Protection Act 1988 to which that Act applies,

(b) personal data within the meaning of the Data Protection Regulation to which that Regulation and the Act of 2018 apply, or

(c) personal data within the meaning of Part 5 of the Act of 2018 to which that Act applies.”,

and

(b) by the insertion of the following subsection after subsection (4):

“(5) In this section—

Act of 2018’ means the Data Protection Act 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.

I move amendment No. 242:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 7 of Regulation of Lobbying Act 2015

206. Section 7 of the Regulation of Lobbying Act 2015 is amended—

(a) by the insertion of the following definition after the definition of “Commission”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

and

(b) by the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 243:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of Sport Ireland Act 2015

207. The Sport Ireland Act 2015 is amended—

(a) in section 40, by—

(i) the insertion of the following definition before the definition of “anti-doping organisation”:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

(ii) the insertion of the following definition after the definition of “anti-doping rule violation”:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(iii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of the Data Protection Regulation;”,

and

(iv) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of the Data Protection Regulation;”,

(b) in section 42(4), by the substitution of “Subject to compliance with the Data Protection Regulation and the Act of 2018, Sport Ireland shall” for “Sport Ireland shall”, and

(c) in section 43—

(i) in subsection (1), by the substitution of “Data Protection Regulation and the Act of 2018” for “Data Protection Acts 1988 and 2003”, and

(ii) by the deletion of subsection (3).”.

Amendment agreed to.

I move amendment No. 244:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 12 of Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016

208. Section 12 of the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 is amended—

(a) by designating the section as subsection (1),

(b) in that designated subsection (1), by the deletion of “(within the meaning of the Data Protection Act 1988)”, and

(c) by the insertion of the following subsection after subsection (1):

“(2) In this section—

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of—

(a) the Data Protection Act 1988,

(b) the Data Protection Regulation, or

(c) Part 5 of the Data Protection Act 2018.”.”.

Amendment agreed to.

I move amendment No. 245:

In page 126, between lines 25 and 26, to insert the following:

“Amendment of section 62 of Financial Services and Pensions Ombudsman Act 2017

209. Section 62 of the Financial Services and Pensions Ombudsman Act 2017 is amended—

(a) in subsection (2), by the substitution of the following paragraph for paragraph (b):

“(b) ensures compliance with the Data Protection Regulation and the Data Protection Act 2018.”,

and

(b) by the insertion of the following subsection after subsection (4):

“(5) In this section, ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).”.”.

Amendment agreed to.
SECTION 161
Question proposed: "That sections 161 to 165, inclusive, be deleted."

The Minister, Deputy Charles Flanagan, has already spoken on this proposal.

Question put and agreed to.
NEW SECTION

I move amendment No. 246:

In page 128, after line 1, to insert the following:

“Amendment of the Child and Family Agency Act 2013

166. The Child and Family Agency Act 2013 is amended in section 8(1) by the insertion of the following new paragraph after paragraph (g):

“(h) maintain a register of preventative and counselling services for the purposes of section 30 of the Data Protection Act 2018.”.”.

We have discussed this already. We will withdraw the amendment and reserve the right to reintroduce it on Report Stage.

Amendment, by leave, withdrawn.
Amendment No. 247 not moved.
Schedules 1 to 3, inclusive, agreed to.
TITLE

I move amendment No. 248:

In page 9, line 15, to delete “Decision 2008/977/JHA” and substitute the following:

“Decision 2008/977/JHA; to give further effect to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data done at Strasbourg on the 28th day of January 1981”.

Title, as amended, agreed to.

As the Bill has now completed Committee Stage, it is recommended that Members submit Report Stage amendments to the Bills office without delay, as Report Stage may be tabled at short notice. I thank members for a mighty piece of work. I thank the Minister, the Minister of State and his colleagues from the Department. I thank the members, Government and Opposition, for their co-operation throughout this two-day process. I also thank our colleagues who have joined us over this long session.

We thank the Chairman.

Top
Share