Dáil Éireann Debate, Tuesday - 29 September 2020
643. Deputy Gary Gannon asked the Minister for Children, Disability, Equality and Integration if his attention has been drawn to the fact that under the GDPR, according to the decision of the Court of Justice of the European Union in Nowak v Data Protection Commissioner, the same information may relate to more than one individual and this does not affect the right of access; and if he will make a statement on the matter. [27312/20]
View answer644. Deputy Gary Gannon asked the Minister for Children, Disability, Equality and Integration if he acknowledges that a person’s identity at birth is their personal data according to the definition of personal data in Article 4 of the GDPR (details supplied). [27313/20]
View answer645. Deputy Gary Gannon asked the Minister for Children, Disability, Equality and Integration if he acknowledges that deceased persons do not have rights under the GDPR (details supplied). [27314/20]
View answerI propose to take Questions Nos. 643 to 645, inclusive, together.
These questions relate to specific provisions of the GDPR, the interpretation of that legislation and the Nowak judgement from the Court of Justice of the European Union.
Data protection responsibilities fall on the relevant data controller, and it is the data controller who is obliged to interpret and implement data protection requirements and responsibilities, in relation to the personal data that they hold.
Under the GDPR and Data Protection legislation, an individual can ask a data controller for their personal data held by the controller and I understand that the Nowak judgement gave further interpretation of the scope of ‘personal data’. However, I am aware that there can be constraints on the release of data, even where a person is deceased, as the rights of third parties may have to be taken into account.
The challenge posed by GDPR and data protection legislation, in relation to birth information, is that elements of that information can constitute shared personal data.
More widely, the Deputy may be aware of impact that GDPR is having on bodies locating individuals for the purposes of information and tracing. The current difficulties arise because of the absence of the necessary, sufficiently robust statutory basis for sharing of information in the context of information and tracing.
I am acutely aware of the complexity of the interface between GDPR and information and tracing, which by its nature involves the personal information of more than one individual. I am planning to address this issue in legislative proposals to establish the necessary statutory framework. The legal opinion forwarded by the Deputy will be taken into consideration in that context.
