Dáil Éireann Debate, Thursday - 5 July 2018
22. Deputy Donnchadh Ó Laoghaire asked the Minister for Justice and Equality the way in which and when he plans to legislate for the prohibition of micro-targeting of minors under the Data Protection Act 2018. [29660/18]
View answerDuring discussions on section 30 of the Data Protection Act 2018 in the Select Committee, and once again during Report Stage discussions, I pointed out that the processing of personal data for marketing and profiling purposes takes place under the so-called “legitimate interests” ground in Article 6.1(f) of the GDPR, and that the Court of Justice had already addressed the issue of whether national law could impose additional conditions on processing carried on under the corresponding provision of the 1995 Data Protection Directive in Joined Cases C-468/10 and C-469/10. In its ruling, the Court of Justice had underlined the importance of free movement of personal data under the 1995 Directive and concluded that Member States were not permitted to impose additional conditions that would have the effect of amending the scope of any of the grounds in Article 7 of the Directive. Those grounds are now set out in Article 6.1 of the GDPR.
The Office of the Attorney General subsequently advised my Department that insofar as section 30 purports to make it an offence for any company or corporate body to process the personal data of a child for the purposes of direct marketing or profiling, such a prohibition appears to go beyond the margin of discretion afforded to Member States in giving further effect to the GDPR and would conflict with Article 6(1)(f), read in conjunction with Recital (47). Put simply, it is not an option for a Member State to unilaterally prohibit a category of processing activities which might otherwise be lawful under Article 6.1(f). Since commencement of section 30 could, therefore, give rise to a substantial risk of infringement proceedings against the State pursuant to Article 258 of the Treaty on the Functioning of the European Union, I requested my Department to clarify the matter with the European Commission.
The European Commission have confirmed that processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest and that Article 6(1)(f) of the GDPR does not exclude processing for such purposes in relation to a child, but stresses the importance of balancing the legitimate interest of the controller with the interests and fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. The reference to a child in Article 6(1)(f) and recital (47) underlines that such assessment must be performed with particular care where personal data of a child are processed. They have pointed out that the processing of personal data of a child for the purposes of direct marketing is therefore not as such unlawful. They have also indicated that subject to Article 22 (automated decision-making), processing of personal data of a child for the purposes of profiling is not generally prohibited, albeit the processing must take into account that children merit specific protection as clarified in recital (38). Moreover, the European Commission have indicated that the term "micro-targeting" is not mentioned in the GDPR and that it is a concept unknown to the GDPR.
Apart from this apparent conflict with the GDPR, the Office of the Attorney General has pointed out that section 30 gives rise to difficulties under Article 38.1 of the Constitution and under Article 7 of the European Convention on Human Rights. Article 38.1 provides that no person shall be tried on any criminal charge save in due course of law. In order for a domestic offence provision to comply with Article 38.1, it must be clear, precise and foreseeable in its application. This is not the case here since it is not clear what might constitute the processing of personal data of a child for the purposes micro-targeting. Whereas the GDPR refers to both direct marketing and profiling, the concept of micro-targeting does not appear in the GDPR and its scope remains uncertain and undefined. It is also a requirement under Article 7 of the Convention that offence provisions must be sufficiently clear and precise so as to enable individuals to ascertain which conduct constitutes a criminal offence and to foresee the consequences of engaging in such conduct.
I hope that the preceding information will indicate to the Deputy that there are serious matters that require consideration, including in relation to the risk of infringement proceedings against Ireland, in the context of any commencement of section 30.
